@docupace/pipeline 1.0.121 → 1.0.122

package/bin/xray-html-report.sh

@@ -0,0 +1,278 @@
+#!/usr/bin/env bash
+#
+# Renders a self-contained HTML report from `jf` simple-json output.
+#
+# The jf CLI only emits table/json/simple-json/sarif/cyclonedx — there is no
+# HTML or PDF format — so we build one from simple-json.
+#
+# Usage: xray-html-report.sh <output.html> <label:file.json> [label:file.json ...]
+#   e.g. xray-html-report.sh report.html "Dependencies:audit.json" "Image:docker.json"
+#
+# Missing or unparseable inputs are reported inside the HTML rather than
+# failing the build.
+
+set -uo pipefail
+
+OUT="${1:?usage: xray-html-report.sh <output.html> <label:file.json> ...}"
+shift
+
+PROJECT="${BITBUCKET_REPO_SLUG:-unknown}"
+COMMIT="${BITBUCKET_COMMIT:-unknown}"
+BRANCH="${BITBUCKET_BRANCH:-unknown}"
+BUILD_URL=""
+if [[ -n "${BITBUCKET_WORKSPACE:-}" && -n "${BITBUCKET_REPO_SLUG:-}" && -n "${BITBUCKET_BUILD_NUMBER:-}" ]]; then
+  BUILD_URL="https://bitbucket.org/${BITBUCKET_WORKSPACE}/${BITBUCKET_REPO_SLUG}/pipelines/results/${BITBUCKET_BUILD_NUMBER}"
+fi
+GENERATED="$(date -u '+%Y-%m-%d %H:%M:%S UTC')"
+
+if ! command -v jq >/dev/null 2>&1; then
+  echo "jq is required to build the HTML report" >&2
+  exit 1
+fi
+
+# ---------------------------------------------------------------------------
+# Flatten every input into one array of normalized findings.
+# SCA rows (vulnerabilities/violations) and source-code rows (secrets, sast,
+# iac) have different shapes, so each is mapped to a common set of fields.
+# ---------------------------------------------------------------------------
+# Emits one finding per line (JSONL). Passing the whole set through --argjson
+# instead would blow Linux's 128 KB per-argument limit on a real scan.
+build_findings() {
+  local label="$1" file="$2"
+  if [[ ! -s "$file" ]] || ! jq empty "$file" >/dev/null 2>&1; then
+    return 0
+  fi
+  jq -c --arg scan "$label" '
+    def sev_rank:
+      if . == "Critical" then 0
+      elif . == "High" then 1
+      elif . == "Medium" then 2
+      elif . == "Low" then 3
+      elif . == "Unknown" then 4
+      else 5 end;
+
+    def sca_rows(rows; kind):
+      (rows // [])[] | {
+        scan: $scan,
+        kind: kind,
+        severity: (.severity // "Unknown"),
+        rank: ((.severity // "Unknown") | sev_rank),
+        id: ((.cves // [] | map(.cve // empty) | join(", ")) as $c
+             | if $c == "" then (.issueId // "N/A") else $c end),
+        cves: (.cves // [] | map(.cve // empty)),
+        cvss: ((.cves // [] | map(.cvssV3 // empty) | first) // ""),
+        package: ((.impactedPackageName // "N/A") + " " + (.impactedPackageVersion // "")),
+        type: (.impactedPackageType // ""),
+        fixed: (.fixedVersions // [] | join(", ")),
+        applicable: (.applicable // ""),
+        summary: (.summary // ""),
+        direct: ((.components // []) | map((.name // "") + " " + (.version // "")) | unique | join(", ")),
+        location: "",
+        watch: (.watch // ""),
+        policies: (.policies // [] | join(", "))
+      };
+
+    def code_rows(rows; kind):
+      (rows // [])[] | {
+        scan: $scan,
+        kind: kind,
+        severity: (.severity // "Unknown"),
+        rank: ((.severity // "Unknown") | sev_rank),
+        id: (.ruleId // "N/A"),
+        cves: [],
+        cvss: "",
+        package: (.finding // .scannerShortDescription // "N/A"),
+        type: ((.cwe // []) | join(", ")),
+        fixed: "",
+        applicable: "",
+        summary: (.scannerDescription // .scannerShortDescription // ""),
+        direct: "",
+        location: ((.file // "") as $f
+                   | if $f == "" then "" else $f + (if (.startLine // 0) > 0 then ":" + ((.startLine) | tostring) else "" end) end),
+        watch: (.watch // ""),
+        policies: (.policies // [] | join(", "))
+      };
+
+    [ sca_rows(.vulnerabilities; "Vulnerability")
+    , sca_rows(.securityViolations; "Security violation")
+    , sca_rows(.licensesViolations; "License violation")
+    , sca_rows(.operationalRiskViolations; "Operational risk")
+    , code_rows(.secrets; "Secret")
+    , code_rows(.secretsViolations; "Secret violation")
+    , code_rows(.sast; "SAST")
+    , code_rows(.sastViolations; "SAST violation")
+    , code_rows(.iac; "IaC")
+    , code_rows(.iacViolations; "IaC violation")
+    , code_rows(.maliciousCode; "Malicious code")
+    ] | flatten | .[]
+  ' "$file" 2>/dev/null
+}
+
+TMP_FINDINGS="$(mktemp)"
+TMP_SOURCES="$(mktemp)"
+trap 'rm -f "$TMP_FINDINGS" "$TMP_SOURCES"' EXIT
+: > "$TMP_FINDINGS"
+
+for arg in "$@"; do
+  label="${arg%%:*}"
+  file="${arg#*:}"
+
+  status="ok"
+  if [[ ! -f "$file" ]]; then
+    status="not produced"
+  elif [[ ! -s "$file" ]]; then
+    status="empty"
+  elif ! jq empty "$file" >/dev/null 2>&1; then
+    status="unparseable"
+  fi
+  # Keys are quoted because `label` is a reserved word in jq's grammar — as a
+  # bare key it fails to compile ("unexpected label, expecting IDENT").
+  jq -cn --arg lbl "$label" --arg file "$file" --arg status "$status" \
+    '{"label":$lbl, "file":$file, "status":$status}' >> "$TMP_SOURCES"
+
+  if [[ "$status" == "ok" ]]; then
+    build_findings "$label" "$file" >> "$TMP_FINDINGS"
+  fi
+done
+
+count_sev() { jq -s --arg s "$1" '[.[]|select(.severity==$s)]|length' "$TMP_FINDINGS"; }
+TOTAL=$(jq -s 'length' "$TMP_FINDINGS")
+CRITICAL=$(count_sev Critical)
+HIGH=$(count_sev High)
+MEDIUM=$(count_sev Medium)
+LOW=$(count_sev Low)
+
+# ---------------------------------------------------------------------------
+# Render. jq's @html escapes every interpolated value.
+# ---------------------------------------------------------------------------
+jq -s -r \
+  --arg project "$PROJECT" \
+  --arg commit "$COMMIT" \
+  --arg branch "$BRANCH" \
+  --arg buildurl "$BUILD_URL" \
+  --arg generated "$GENERATED" \
+  --argjson total "$TOTAL" \
+  --argjson critical "$CRITICAL" \
+  --argjson high "$HIGH" \
+  --argjson medium "$MEDIUM" \
+  --argjson low "$LOW" \
+  --slurpfile sources "$TMP_SOURCES" '
+  def h: . // "" | tostring | @html;
+  def cls: if . == "Critical" then "critical"
+           elif . == "High" then "high"
+           elif . == "Medium" then "medium"
+           elif . == "Low" then "low"
+           else "unknown" end;
+
+  "<!DOCTYPE html>",
+  "<html lang=\"en\"><head><meta charset=\"utf-8\">",
+  "<title>Xray scan — \($project|h) @ \($commit[0:7]|h)</title>",
+  "<style>",
+  ":root{--crit:#b3121f;--high:#e8590c;--med:#f0a500;--low:#4c6ef5;--unk:#868e96}",
+  "*{box-sizing:border-box}",
+  "body{font:14px/1.5 -apple-system,BlinkMacSystemFont,\"Segoe UI\",Roboto,Helvetica,Arial,sans-serif;margin:0;padding:32px;color:#212529;background:#fff}",
+  "h1{font-size:22px;margin:0 0 4px}h2{font-size:16px;margin:32px 0 8px;padding-bottom:6px;border-bottom:2px solid #e9ecef}",
+  ".meta{color:#666;font-size:13px;margin-bottom:24px}",
+  ".meta code{background:#f1f3f5;padding:1px 5px;border-radius:3px}",
+  ".cards{display:flex;gap:12px;flex-wrap:wrap;margin:16px 0 8px}",
+  ".card{border:1px solid #dee2e6;border-radius:6px;padding:12px 18px;min-width:104px}",
+  ".card .n{font-size:26px;font-weight:600;line-height:1.1}",
+  ".card .l{font-size:11px;text-transform:uppercase;letter-spacing:.6px;color:#666}",
+  ".card.critical{border-top:3px solid var(--crit)}.card.critical .n{color:var(--crit)}",
+  ".card.high{border-top:3px solid var(--high)}.card.high .n{color:var(--high)}",
+  ".card.medium{border-top:3px solid var(--med)}.card.medium .n{color:var(--med)}",
+  ".card.low{border-top:3px solid var(--low)}.card.low .n{color:var(--low)}",
+  "table{border-collapse:collapse;width:100%;margin-top:8px;font-size:13px}",
+  "th,td{text-align:left;padding:7px 9px;border-bottom:1px solid #e9ecef;vertical-align:top}",
+  "th{background:#f8f9fa;font-size:11px;text-transform:uppercase;letter-spacing:.5px;color:#495057;position:sticky;top:0}",
+  "tr:hover td{background:#fcfcfd}",
+  ".sev{font-weight:600;white-space:nowrap}",
+  ".sev.critical{color:var(--crit)}.sev.high{color:var(--high)}.sev.medium{color:var(--med)}.sev.low{color:var(--low)}.sev.unknown{color:var(--unk)}",
+  ".pkg{font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:12px;word-break:break-all}",
+  ".sum{color:#555;max-width:460px}",
+  ".none{padding:16px;background:#ebfbee;border:1px solid #b7eb8f;border-radius:6px;color:#2b8a3e}",
+  ".warn{padding:12px;background:#fff9db;border:1px solid #ffe066;border-radius:6px;margin-bottom:16px}",
+  "footer{margin-top:40px;color:#868e96;font-size:12px;border-top:1px solid #e9ecef;padding-top:12px}",
+  "@media print{body{padding:0}th{position:static}.card{break-inside:avoid}tr{break-inside:avoid}}",
+  "</style></head><body>",
+
+  "<h1>JFrog Xray scan report</h1>",
+  "<div class=\"meta\">",
+  "<strong>\($project|h)</strong> &middot; branch <code>\($branch|h)</code> &middot; commit <code>\($commit[0:12]|h)</code><br>",
+  "Generated \($generated|h)",
+  (if $buildurl != "" then " &middot; <a href=\"\($buildurl|h)\">pipeline run</a>" else "" end),
+  "</div>",
+
+  "<div class=\"cards\">",
+  "<div class=\"card critical\"><div class=\"n\">\($critical)</div><div class=\"l\">Critical</div></div>",
+  "<div class=\"card high\"><div class=\"n\">\($high)</div><div class=\"l\">High</div></div>",
+  "<div class=\"card medium\"><div class=\"n\">\($medium)</div><div class=\"l\">Medium</div></div>",
+  "<div class=\"card low\"><div class=\"n\">\($low)</div><div class=\"l\">Low</div></div>",
+  "<div class=\"card\"><div class=\"n\">\($total)</div><div class=\"l\">Total</div></div>",
+  "</div>",
+
+  # Flag scans that produced nothing, so an empty report is never mistaken
+  # for a clean one.
+  ( $sources | map(select(.status != "ok")) ) as $bad
+  | if ($bad | length) > 0 then
+      "<div class=\"warn\"><strong>Incomplete scan data.</strong> "
+      + ($bad | map("\(.label) (\(.file)): \(.status)") | join("; ") | @html)
+      + " — findings below may be understated.</div>"
+    else empty end,
+
+  if $total == 0 then
+    "<div class=\"none\">No findings reported across "
+      + ($sources | map(select(.status=="ok")) | length | tostring)
+      + " scan(s).</div>"
+  else
+    ( [ .[] ] | group_by(.scan) | .[] |
+      "<h2>\(.[0].scan|h) — \(length) finding(s)</h2>",
+      "<table><thead><tr><th>Severity</th><th>Kind</th><th>ID</th><th>Component / finding</th><th>Fixed in</th><th>Details</th></tr></thead><tbody>",
+      ( sort_by(.rank, .package) | .[] |
+        "<tr>",
+        "<td class=\"sev \(.severity|cls)\">\(.severity|h)</td>",
+        "<td>\(.kind|h)</td>",
+        "<td class=\"pkg\">"
+          + ( if (.cves|length) > 0 then
+                (.cves | map("<a href=\"https://nvd.nist.gov/vuln/detail/\(.|@uri)\">\(.|@html)</a>") | join("<br>"))
+              else (.id|h) end )
+          + "</td>",
+        "<td class=\"pkg\">\(.package|h)"
+          + (if .location != "" then "<br>\(.location|h)" else "" end)
+          + (if .type != "" then "<br><span style=\"color:#868e96\">\(.type|h)</span>" else "" end)
+          + "</td>",
+        "<td class=\"pkg\">\(if .fixed == "" then "—" else (.fixed|h) end)</td>",
+        "<td class=\"sum\">\(.summary|h)"
+          + (if .applicable != "" then "<br><em>Applicability: \(.applicable|h)</em>" else "" end)
+          + (if .direct != "" then "<br><span style=\"color:#868e96\">via \(.direct|h)</span>" else "" end)
+          + (if .watch != "" then "<br><span style=\"color:#868e96\">watch: \(.watch|h)</span>" else "" end)
+          + "</td>",
+        "</tr>" ),
+      "</tbody></table>" )
+  end,
+
+  "<footer>Generated by <code>bin/xray-html-report.sh</code> from JFrog CLI simple-json output. ",
+  "Scans: " + ($sources | map("\(.label) [\(.status)]") | join(", ") | @html) + ".",
+  "</footer>",
+  "</body></html>"
+' "$TMP_FINDINGS" > "$OUT"
+
+echo "HTML report written to ${OUT} (total=${TOTAL} critical=${CRITICAL} high=${HIGH} medium=${MEDIUM} low=${LOW})"
+
+# Optional PDF, when a headless renderer happens to be on the runner.
+if [[ "${XRAY_REPORT_PDF:-false}" == "true" ]]; then
+  PDF_OUT="${OUT%.html}.pdf"
+  if command -v wkhtmltopdf >/dev/null 2>&1; then
+    wkhtmltopdf --enable-local-file-access "$OUT" "$PDF_OUT" && echo "PDF written to ${PDF_OUT}"
+  else
+    for chrome in google-chrome chromium chromium-browser; do
+      if command -v "$chrome" >/dev/null 2>&1; then
+        "$chrome" --headless --disable-gpu --no-sandbox \
+          --print-to-pdf="$PDF_OUT" "file://$(cd "$(dirname "$OUT")" && pwd)/$(basename "$OUT")" \
+          && echo "PDF written to ${PDF_OUT}"
+        break
+      fi
+    done
+  fi
+  [[ -f "$PDF_OUT" ]] || echo "No wkhtmltopdf/chromium on this runner — skipped PDF (HTML still produced)."
+fi