@docupace/pipeline 1.0.122 → 1.0.123-xray.0

package/src/tenable/scan.test.js

@@ -0,0 +1,284 @@
+import { describe, expect, jest, test } from '@jest/globals';
+import { scanOne, runTenableScan } from './scan.js';
+
+function makeFakeDocker(overrides = {}) {
+  return {
+    buildxAvailable: jest.fn().mockResolvedValue(true),
+    build: jest.fn().mockResolvedValue({ ok: true }),
+    save: jest.fn().mockResolvedValue({ ok: true }),
+    run: jest.fn().mockResolvedValue(0),
+    rmi: jest.fn().mockResolvedValue(undefined),
+    ...overrides,
+  };
+}
+
+function makeFakeFsops(overrides = {}) {
+  return {
+    mkdtemp: jest.fn().mockReturnValue('/work/.tenable-work.abc'),
+    mkdirp: jest.fn(),
+    exists: jest.fn().mockReturnValue(false),
+    listDir: jest.fn().mockReturnValue([]),
+    copyReports: jest.fn(),
+    readFile: jest.fn().mockReturnValue(''),
+    removeSync: jest.fn(),
+    ...overrides,
+  };
+}
+
+const baseCtx = (overrides = {}) => ({
+  reportDir: 'tenable-report',
+  scannerImage: 'tenable/cloud-security-scanner:latest',
+  shortSha: 'abc1234',
+  imageNamePrefix: 'my-repo',
+  codeBranch: 'main',
+  commit: 'abc1234567',
+  codeUser: 'Matt Fields',
+  codeRepoUrl: 'https://bitbucket.org/dp-cloud/my-repo',
+  minSeverity: 'Medium',
+  runInfo: { includeInScanArgs: false },
+  failOnMinSeverity: '',
+  docker: makeFakeDocker(),
+  fsops: makeFakeFsops(),
+  log: jest.fn(),
+  ...overrides,
+});
+
+describe('scanOne', () => {
+  test('builds, saves, scans and cleans up a normal target', async () => {
+    const docker = makeFakeDocker({ run: jest.fn().mockResolvedValue(0) });
+    const fsops = makeFakeFsops({
+      exists: jest.fn((p) => p === 'services/web/Dockerfile'),
+      listDir: jest.fn().mockReturnValue(['web-tenable.json']),
+    });
+    const ctx = baseCtx({ docker, fsops });
+
+    const result = await scanOne(
+      {
+        label: 'web',
+        slug: 'web',
+        buildContext: 'services/web',
+        dockerfile: 'services/web/Dockerfile',
+      },
+      ctx,
+    );
+
+    expect(result).toEqual({ slug: 'web', exitCode: 0 });
+    expect(docker.build).toHaveBeenCalledWith(
+      expect.arrayContaining([
+        'services/web',
+        '--file',
+        'services/web/Dockerfile',
+        '--tag',
+        'my-repo-web:tenable-abc1234',
+      ]),
+    );
+    expect(docker.save).toHaveBeenCalledWith(
+      'my-repo-web:tenable-abc1234',
+      expect.stringContaining('image.tar'),
+    );
+    expect(docker.run).toHaveBeenCalled();
+    expect(fsops.copyReports).toHaveBeenCalled();
+    expect(docker.rmi).toHaveBeenCalledWith('my-repo-web:tenable-abc1234');
+    expect(fsops.removeSync).toHaveBeenCalledWith('/work/.tenable-work.abc');
+  });
+
+  test('scans a pre-built image without building or removing anything', async () => {
+    const docker = makeFakeDocker();
+    const fsops = makeFakeFsops();
+    const ctx = baseCtx({ docker, fsops });
+
+    const result = await scanOne(
+      { label: 'image', slug: 'image', prebuiltImage: 'my-image:tag' },
+      ctx,
+    );
+
+    expect(result.exitCode).toBe(0);
+    expect(docker.build).not.toHaveBeenCalled();
+    expect(docker.save).toHaveBeenCalledWith(
+      'my-image:tag',
+      expect.any(String),
+    );
+    expect(docker.rmi).not.toHaveBeenCalled();
+  });
+
+  test('skips a target with no Dockerfile at the expected path', async () => {
+    const docker = makeFakeDocker();
+    const fsops = makeFakeFsops({ exists: jest.fn().mockReturnValue(false) });
+    const ctx = baseCtx({ docker, fsops });
+
+    const result = await scanOne(
+      {
+        label: 'web',
+        slug: 'web',
+        buildContext: 'services/web',
+        dockerfile: 'services/web/Dockerfile',
+      },
+      ctx,
+    );
+
+    expect(result).toEqual({ slug: 'web', exitCode: 0, skipped: true });
+    expect(docker.build).not.toHaveBeenCalled();
+  });
+
+  test('returns exitCode 1 and skips the scan when the docker build fails', async () => {
+    const docker = makeFakeDocker({
+      build: jest.fn().mockResolvedValue({ ok: false }),
+    });
+    const fsops = makeFakeFsops({ exists: jest.fn().mockReturnValue(true) });
+    const ctx = baseCtx({ docker, fsops });
+
+    const result = await scanOne(
+      {
+        label: 'web',
+        slug: 'web',
+        buildContext: 'services/web',
+        dockerfile: 'services/web/Dockerfile',
+      },
+      ctx,
+    );
+
+    expect(result).toEqual({ slug: 'web', exitCode: 1 });
+    expect(docker.save).not.toHaveBeenCalled();
+  });
+
+  test('cleans up and returns exitCode 1 when docker save fails', async () => {
+    const docker = makeFakeDocker({
+      save: jest.fn().mockResolvedValue({ ok: false }),
+    });
+    const fsops = makeFakeFsops({ exists: jest.fn().mockReturnValue(true) });
+    const ctx = baseCtx({ docker, fsops });
+
+    const result = await scanOne(
+      {
+        label: 'web',
+        slug: 'web',
+        buildContext: 'services/web',
+        dockerfile: 'services/web/Dockerfile',
+      },
+      ctx,
+    );
+
+    expect(result).toEqual({ slug: 'web', exitCode: 1 });
+    expect(docker.run).not.toHaveBeenCalled();
+    expect(fsops.removeSync).toHaveBeenCalledWith('/work/.tenable-work.abc');
+    expect(docker.rmi).toHaveBeenCalledWith('my-repo-web:tenable-abc1234');
+  });
+
+  test('propagates a non-zero scanner exit code (e.g. fail-on-min-severity threshold)', async () => {
+    const docker = makeFakeDocker({ run: jest.fn().mockResolvedValue(3) });
+    const fsops = makeFakeFsops({ exists: jest.fn().mockReturnValue(true) });
+    const ctx = baseCtx({ docker, fsops });
+
+    const result = await scanOne(
+      {
+        label: 'web',
+        slug: 'web',
+        buildContext: 'services/web',
+        dockerfile: 'services/web/Dockerfile',
+      },
+      ctx,
+    );
+
+    expect(result.exitCode).toBe(3);
+  });
+});
+
+describe('runTenableScan', () => {
+  test('skips entirely when credentials are missing', async () => {
+    const log = jest.fn();
+    const result = await runTenableScan({
+      tenableApiToken: '',
+      tenableApiUrl: '',
+      log,
+    });
+    expect(result).toEqual({ exitCode: 0, skipped: true, results: [] });
+    expect(log).toHaveBeenCalledWith(
+      expect.stringContaining('not set — skipping'),
+    );
+  });
+
+  test('scans TENABLE_IMAGE directly, ignoring SCAN_TARGETS', async () => {
+    const docker = makeFakeDocker();
+    const fsops = makeFakeFsops();
+    const result = await runTenableScan({
+      tenableApiToken: 'token',
+      tenableApiUrl: 'https://tenable.example',
+      tenableImage: 'prebuilt:tag',
+      scanTargetsEnv: 'web:deps:services/web:Dockerfile',
+      docker,
+      fsops,
+      log: jest.fn(),
+    });
+
+    expect(result.exitCode).toBe(0);
+    expect(result.results).toHaveLength(1);
+    expect(docker.save).toHaveBeenCalledWith(
+      'prebuilt:tag',
+      expect.any(String),
+    );
+  });
+
+  test('scans every target in SCAN_TARGETS and reports the worst exit code', async () => {
+    const fsops = makeFakeFsops({ exists: jest.fn().mockReturnValue(true) });
+    const docker = makeFakeDocker({
+      run: jest.fn().mockResolvedValueOnce(0).mockResolvedValueOnce(2),
+    });
+
+    const result = await runTenableScan({
+      tenableApiToken: 'token',
+      tenableApiUrl: 'https://tenable.example',
+      scanTargetsEnv:
+        'web:deps:services/web:Dockerfile;worker:deps:services/worker:Dockerfile',
+      docker,
+      fsops,
+      log: jest.fn(),
+    });
+
+    expect(result.results.map((r) => r.slug)).toEqual(['web', 'worker']);
+    expect(result.exitCode).toBe(2);
+  });
+
+  test('logs and skips a target with no build context, without failing the run', async () => {
+    const log = jest.fn();
+    const fsops = makeFakeFsops({ exists: jest.fn().mockReturnValue(true) });
+    const docker = makeFakeDocker();
+
+    const result = await runTenableScan({
+      tenableApiToken: 'token',
+      tenableApiUrl: 'https://tenable.example',
+      scanTargetsEnv: 'web:deps::Dockerfile',
+      docker,
+      fsops,
+      log,
+    });
+
+    expect(result.exitCode).toBe(0);
+    expect(result.results).toHaveLength(0);
+    expect(log).toHaveBeenCalledWith(
+      expect.stringContaining('no build context'),
+    );
+    expect(log).toHaveBeenCalledWith(expect.stringContaining('nothing to do'));
+  });
+
+  test('falls back to a single default target when SCAN_TARGETS is unset', async () => {
+    const log = jest.fn();
+    const fsops = makeFakeFsops({ exists: jest.fn().mockReturnValue(true) });
+    const docker = makeFakeDocker();
+
+    const result = await runTenableScan({
+      tenableApiToken: 'token',
+      tenableApiUrl: 'https://tenable.example',
+      scanTargetsEnv: '',
+      buildContextFallback: '.',
+      dockerfileFallback: './Dockerfile',
+      docker,
+      fsops,
+      log,
+    });
+
+    expect(result.results).toEqual([{ slug: 'app', exitCode: 0 }]);
+    expect(log).toHaveBeenCalledWith(
+      expect.stringContaining('SCAN_TARGETS not set'),
+    );
+  });
+});

package/src/xray/cli.js

@@ -0,0 +1,37 @@
+#!/usr/bin/env node
+
+import { Command } from 'commander';
+import { notify } from './notify.js';
+
+const program = new Command();
+
+program
+  .command('notify')
+  .description(
+    'Post Xray findings to Slack (parent summary + one thread reply per finding)',
+  )
+  .option(
+    '-f, --report-args-file <path>',
+    'Path to the "label:file" report-args file',
+  )
+  .option(
+    '-m, --min-severity <severity>',
+    'Lowest severity to thread (Critical|High|Medium|Low)',
+  )
+  .option('-c, --notify-clean', 'Post even when there are zero findings')
+  .action(async (options) => {
+    try {
+      await notify({
+        ...(options.reportArgsFile && {
+          reportArgsFile: options.reportArgsFile,
+        }),
+        ...(options.minSeverity && { minSeverity: options.minSeverity }),
+        ...(options.notifyClean && { notifyClean: true }),
+      });
+    } catch (error) {
+      console.error(error.message);
+      process.exit(1);
+    }
+  });
+
+program.parse(process.argv);

package/src/xray/notify.js

@@ -0,0 +1,107 @@
+import fs from 'fs';
+import {
+  extractFindings,
+  countBySeverity,
+  buildBuildLink,
+  buildParentPayload,
+  buildThreadPayload,
+  parseReportArgs,
+  rankOf,
+  sortBySeverity,
+} from './report.js';
+import { postMessage } from './slack.js';
+
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+// Orchestrates the full bin/xray.sh flow: read the report-args file, collect
+// findings from each simple-json scan file, post a Slack summary, then thread
+// one message per finding at or above minSeverity. Dependencies are
+// injectable so this can be unit tested without touching fs or the network.
+export async function notify({
+  reportArgsFile = process.env.XRAY_REPORT_ARGS_FILE || '/tmp/xray-report-args',
+  minSeverity = process.env.XRAY_SLACK_MIN_SEVERITY || 'High',
+  notifyClean = process.env.XRAY_SLACK_NOTIFY_CLEAN === 'true',
+  channel = process.env.XRAY_SLACK_CHANNEL,
+  token = process.env.XRAY_SLACK_TOKEN,
+  project = process.env.BITBUCKET_REPO_SLUG || 'unknown',
+  branch = process.env.BITBUCKET_BRANCH || '',
+  buildLink = buildBuildLink({
+    workspace: process.env.BITBUCKET_WORKSPACE,
+    repoSlug: process.env.BITBUCKET_REPO_SLUG,
+    buildNumber: process.env.BITBUCKET_BUILD_NUMBER,
+  }),
+  readFile = (path) => fs.readFileSync(path, 'utf8'),
+  post = postMessage,
+  log = console.log,
+  delay = sleep,
+} = {}) {
+  const minRank = rankOf(minSeverity);
+
+  let reportArgsContent;
+  try {
+    reportArgsContent = readFile(reportArgsFile);
+  } catch {
+    log(
+      `No scan results file at ${reportArgsFile} — skipping Slack notification.`,
+    );
+    return { posted: 0, skipped: true };
+  }
+
+  const findings = [];
+  for (const { label, file } of parseReportArgs(reportArgsContent)) {
+    let raw;
+    try {
+      raw = readFile(file);
+    } catch {
+      log(`Skipping ${label} (${file}): not produced or empty.`);
+      continue;
+    }
+    let data;
+    try {
+      data = JSON.parse(raw);
+    } catch {
+      log(`Skipping ${label} (${file}): not produced or empty.`);
+      continue;
+    }
+    findings.push(...extractFindings(data, label));
+  }
+
+  const counts = countBySeverity(findings);
+  log(
+    `📊 Counts: Critical=${counts.Critical}, High=${counts.High}, Medium=${counts.Medium}, Low=${counts.Low}, Total=${counts.total}`,
+  );
+
+  if (counts.total === 0 && !notifyClean) {
+    log('✅ No vulnerabilities found, skipping Slack notification.');
+    return { posted: 0, skipped: true };
+  }
+
+  const parentPayload = buildParentPayload({
+    channel,
+    project,
+    branch,
+    buildLink,
+    counts,
+  });
+  const parentResponse = await post(parentPayload, token);
+  const threadTs = parentResponse?.ts;
+
+  if (!threadTs) {
+    log('❌ Failed to create parent Slack message:');
+    log(JSON.stringify(parentResponse));
+    throw new Error('Failed to create parent Slack message');
+  }
+
+  log(`✅ Parent message created. thread_ts=${threadTs}`);
+
+  let posted = 0;
+  for (const finding of sortBySeverity(findings)) {
+    if (finding.rank > minRank) continue;
+    await post(buildThreadPayload({ channel, threadTs, finding }), token);
+    posted += 1;
+    await delay(100);
+  }
+
+  log(`✅ Posted ${posted} finding(s) to thread.`);
+  return { posted, skipped: false, threadTs };
+}

package/src/xray/notify.test.js

@@ -0,0 +1,161 @@
+import { describe, expect, jest, test } from '@jest/globals';
+import { notify } from './notify.js';
+
+function makeReadFile(files) {
+  return (path) => {
+    if (!(path in files)) {
+      const err = new Error(`ENOENT: ${path}`);
+      err.code = 'ENOENT';
+      throw err;
+    }
+    return files[path];
+  };
+}
+
+describe('notify', () => {
+  test('skips Slack entirely when the report-args file is missing', async () => {
+    const log = jest.fn();
+    const post = jest.fn();
+    const result = await notify({
+      reportArgsFile: '/tmp/does-not-exist',
+      readFile: makeReadFile({}),
+      post,
+      log,
+      delay: jest.fn(),
+    });
+
+    expect(result).toEqual({ posted: 0, skipped: true });
+    expect(post).not.toHaveBeenCalled();
+    expect(log).toHaveBeenCalledWith(
+      expect.stringContaining('No scan results file'),
+    );
+  });
+
+  test('skips a scan file that is missing or invalid JSON, continues with the rest', async () => {
+    const files = {
+      '/tmp/report-args':
+        'bad:xray-report/bad.json\ngood:xray-report/good.json\n',
+      'xray-report/bad.json': 'not json',
+      'xray-report/good.json': JSON.stringify({
+        vulnerabilities: [{ severity: 'Critical', issueId: 'X-1' }],
+      }),
+    };
+    const post = jest.fn().mockResolvedValue({ ts: '111.222' });
+    const log = jest.fn();
+
+    const result = await notify({
+      reportArgsFile: '/tmp/report-args',
+      readFile: makeReadFile(files),
+      post,
+      log,
+      delay: jest.fn(),
+      channel: '#c',
+      token: 'xoxb-x',
+    });
+
+    expect(log).toHaveBeenCalledWith(expect.stringContaining('Skipping bad'));
+    expect(result.posted).toBe(1);
+  });
+
+  test('does not notify Slack when there are zero findings and notifyClean is false', async () => {
+    const files = {
+      '/tmp/report-args': 'clean:xray-report/clean.json\n',
+      'xray-report/clean.json': JSON.stringify({}),
+    };
+    const post = jest.fn();
+
+    const result = await notify({
+      reportArgsFile: '/tmp/report-args',
+      readFile: makeReadFile(files),
+      post,
+      log: jest.fn(),
+      delay: jest.fn(),
+      notifyClean: false,
+    });
+
+    expect(result).toEqual({ posted: 0, skipped: true });
+    expect(post).not.toHaveBeenCalled();
+  });
+
+  test('posts a clean parent message when notifyClean is true even with zero findings', async () => {
+    const files = {
+      '/tmp/report-args': 'clean:xray-report/clean.json\n',
+      'xray-report/clean.json': JSON.stringify({}),
+    };
+    const post = jest.fn().mockResolvedValue({ ts: '111.222' });
+
+    const result = await notify({
+      reportArgsFile: '/tmp/report-args',
+      readFile: makeReadFile(files),
+      post,
+      log: jest.fn(),
+      delay: jest.fn(),
+      notifyClean: true,
+      channel: '#c',
+      token: 'xoxb-x',
+    });
+
+    expect(post).toHaveBeenCalledTimes(1);
+    expect(result).toEqual({ posted: 0, skipped: false, threadTs: '111.222' });
+  });
+
+  test('throws when Slack fails to create the parent message', async () => {
+    const files = {
+      '/tmp/report-args': 'scan:xray-report/x.json\n',
+      'xray-report/x.json': JSON.stringify({
+        vulnerabilities: [{ severity: 'Critical' }],
+      }),
+    };
+    const post = jest
+      .fn()
+      .mockResolvedValue({ ok: false, error: 'invalid_auth' });
+
+    await expect(
+      notify({
+        reportArgsFile: '/tmp/report-args',
+        readFile: makeReadFile(files),
+        post,
+        log: jest.fn(),
+        delay: jest.fn(),
+      }),
+    ).rejects.toThrow('Failed to create parent Slack message');
+  });
+
+  test('only threads findings at or above minSeverity, sorted Critical -> Low', async () => {
+    const files = {
+      '/tmp/report-args': 'scan:xray-report/x.json\n',
+      'xray-report/x.json': JSON.stringify({
+        vulnerabilities: [
+          { severity: 'Low', issueId: 'L-1' },
+          { severity: 'Critical', issueId: 'C-1' },
+          { severity: 'Medium', issueId: 'M-1' },
+        ],
+      }),
+    };
+    const post = jest
+      .fn()
+      .mockResolvedValueOnce({ ts: '111.222' }) // parent
+      .mockResolvedValue({ ts: '111.222' }); // thread replies
+    const delay = jest.fn().mockResolvedValue();
+
+    const result = await notify({
+      reportArgsFile: '/tmp/report-args',
+      readFile: makeReadFile(files),
+      post,
+      log: jest.fn(),
+      delay,
+      minSeverity: 'Medium',
+      channel: '#c',
+      token: 'xoxb-x',
+    });
+
+    // parent + Critical + Medium, Low excluded
+    expect(post).toHaveBeenCalledTimes(3);
+    expect(result.posted).toBe(2);
+    const threadedIds = post.mock.calls
+      .slice(1)
+      .map(([payload]) => payload.blocks[0].text.text);
+    expect(threadedIds[0]).toContain('*Critical*');
+    expect(threadedIds[1]).toContain('*Medium*');
+  });
+});