@docupace/pipeline 1.0.122 → 1.0.123-xray.1

package/src/veracode/scan.test.js

@@ -0,0 +1,246 @@
+import { describe, expect, jest, test } from '@jest/globals';
+import { scanOne, runVeracodeScan, DEFAULT_WRAPPER_JAR } from './scan.js';
+
+function makeFakeVeracode(overrides = {}) {
+  return {
+    download: jest.fn().mockResolvedValue({ ok: true }),
+    runBuildCmd: jest.fn().mockResolvedValue({ ok: true }),
+    zip: jest.fn().mockResolvedValue({ ok: true }),
+    uploadAndScan: jest.fn().mockResolvedValue({ ok: true }),
+    ...overrides,
+  };
+}
+
+function makeFakeFsops(overrides = {}) {
+  return {
+    exists: jest.fn().mockReturnValue(true),
+    mkdirp: jest.fn(),
+    removeSync: jest.fn(),
+    ...overrides,
+  };
+}
+
+const baseCtx = (overrides = {}) => ({
+  vid: 'vid-1',
+  vkey: 'vkey-1',
+  shortSha: 'abc1234',
+  wrapperJar: DEFAULT_WRAPPER_JAR,
+  veracode: makeFakeVeracode(),
+  fsops: makeFakeFsops(),
+  log: jest.fn(),
+  ...overrides,
+});
+
+describe('scanOne', () => {
+  test('zips, uploads and cleans up a normal target', async () => {
+    const veracode = makeFakeVeracode();
+    const fsops = makeFakeFsops();
+    const ctx = baseCtx({ veracode, fsops });
+
+    const result = await scanOne(
+      {
+        label: 'web',
+        slug: 'web',
+        appname: 'my-app',
+        paths: ['services/web'],
+        skipped: false,
+      },
+      ctx,
+    );
+
+    expect(result).toEqual({ label: 'web', slug: 'web', exitCode: 0 });
+    expect(veracode.zip).toHaveBeenCalledWith('veracode-web.zip', [
+      'services/web',
+    ]);
+    expect(veracode.uploadAndScan).toHaveBeenCalledWith(
+      DEFAULT_WRAPPER_JAR,
+      expect.arrayContaining([
+        '-appname',
+        'my-app',
+        '-version',
+        'sha-abc1234-web',
+      ]),
+    );
+    expect(fsops.removeSync).toHaveBeenCalledWith('veracode-web.zip');
+  });
+
+  test('skips a target missing an appname or paths', async () => {
+    const veracode = makeFakeVeracode();
+    const ctx = baseCtx({ veracode });
+
+    const result = await scanOne(
+      { label: 'web', slug: 'web', appname: '', paths: [], skipped: true },
+      ctx,
+    );
+
+    expect(result).toEqual({ label: 'web', slug: 'web', exitCode: 1 });
+    expect(veracode.zip).not.toHaveBeenCalled();
+  });
+
+  test('returns exitCode 1 and skips upload when zipping fails', async () => {
+    const veracode = makeFakeVeracode({
+      zip: jest.fn().mockResolvedValue({ ok: false }),
+    });
+    const fsops = makeFakeFsops();
+    const ctx = baseCtx({ veracode, fsops });
+
+    const result = await scanOne(
+      {
+        label: 'web',
+        slug: 'web',
+        appname: 'my-app',
+        paths: ['services/web'],
+        skipped: false,
+      },
+      ctx,
+    );
+
+    expect(result).toEqual({ label: 'web', slug: 'web', exitCode: 1 });
+    expect(veracode.uploadAndScan).not.toHaveBeenCalled();
+    expect(fsops.removeSync).toHaveBeenCalledWith('veracode-web.zip');
+  });
+
+  test('returns exitCode 1 when the upload fails, but still cleans up the zip', async () => {
+    const veracode = makeFakeVeracode({
+      uploadAndScan: jest.fn().mockResolvedValue({ ok: false }),
+    });
+    const fsops = makeFakeFsops();
+    const ctx = baseCtx({ veracode, fsops });
+
+    const result = await scanOne(
+      {
+        label: 'web',
+        slug: 'web',
+        appname: 'my-app',
+        paths: ['services/web'],
+        skipped: false,
+      },
+      ctx,
+    );
+
+    expect(result).toEqual({ label: 'web', slug: 'web', exitCode: 1 });
+    expect(fsops.removeSync).toHaveBeenCalledWith('veracode-web.zip');
+  });
+});
+
+describe('runVeracodeScan', () => {
+  test('fails fast when credentials are missing', async () => {
+    const log = jest.fn();
+    const result = await runVeracodeScan({
+      vid: '',
+      vkey: '',
+      targetsEnv: 'web:my-app:src',
+      log,
+    });
+
+    expect(result).toEqual({ exitCode: 1, results: [] });
+    expect(log).toHaveBeenCalledWith(
+      expect.stringContaining('VERACODE_API_ID / VERACODE_API_KEY not set'),
+    );
+  });
+
+  test('fails fast when VERACODE_TARGETS is missing', async () => {
+    const log = jest.fn();
+    const result = await runVeracodeScan({
+      vid: 'vid-1',
+      vkey: 'vkey-1',
+      targetsEnv: '',
+      log,
+    });
+
+    expect(result).toEqual({ exitCode: 1, results: [] });
+    expect(log).toHaveBeenCalledWith(
+      expect.stringContaining('VERACODE_TARGETS not set'),
+    );
+  });
+
+  test('runs VERACODE_BUILD_CMD before packaging when set', async () => {
+    const veracode = makeFakeVeracode();
+    const fsops = makeFakeFsops();
+
+    await runVeracodeScan({
+      vid: 'vid-1',
+      vkey: 'vkey-1',
+      targetsEnv: 'web:my-app:src',
+      buildCmd: 'npm run build',
+      veracode,
+      fsops,
+      log: jest.fn(),
+    });
+
+    expect(veracode.runBuildCmd).toHaveBeenCalledWith('npm run build');
+  });
+
+  test('downloads the wrapper jar only when not already cached', async () => {
+    const veracode = makeFakeVeracode();
+    const fsops = makeFakeFsops({ exists: jest.fn().mockReturnValue(false) });
+
+    await runVeracodeScan({
+      vid: 'vid-1',
+      vkey: 'vkey-1',
+      targetsEnv: 'web:my-app:src',
+      veracode,
+      fsops,
+      log: jest.fn(),
+    });
+
+    expect(veracode.download).toHaveBeenCalledWith(
+      expect.stringContaining('vosp-api-wrappers-java'),
+      DEFAULT_WRAPPER_JAR,
+    );
+  });
+
+  test('skips the download when the wrapper jar already exists', async () => {
+    const veracode = makeFakeVeracode();
+    const fsops = makeFakeFsops({ exists: jest.fn().mockReturnValue(true) });
+
+    await runVeracodeScan({
+      vid: 'vid-1',
+      vkey: 'vkey-1',
+      targetsEnv: 'web:my-app:src',
+      veracode,
+      fsops,
+      log: jest.fn(),
+    });
+
+    expect(veracode.download).not.toHaveBeenCalled();
+  });
+
+  test('scans every target and reports the worst outcome', async () => {
+    const veracode = makeFakeVeracode({
+      uploadAndScan: jest
+        .fn()
+        .mockResolvedValueOnce({ ok: true })
+        .mockResolvedValueOnce({ ok: false }),
+    });
+    const fsops = makeFakeFsops();
+
+    const result = await runVeracodeScan({
+      vid: 'vid-1',
+      vkey: 'vkey-1',
+      targetsEnv: 'web:my-app:apps/web;worker:my-worker:apps/worker',
+      veracode,
+      fsops,
+      log: jest.fn(),
+    });
+
+    expect(result.results.map((r) => r.label)).toEqual(['web', 'worker']);
+    expect(result.exitCode).toBe(1);
+  });
+
+  test('exits 0 when every target scans successfully', async () => {
+    const veracode = makeFakeVeracode();
+    const fsops = makeFakeFsops();
+
+    const result = await runVeracodeScan({
+      vid: 'vid-1',
+      vkey: 'vkey-1',
+      targetsEnv: 'web:my-app:apps/web',
+      veracode,
+      fsops,
+      log: jest.fn(),
+    });
+
+    expect(result.exitCode).toBe(0);
+  });
+});

package/src/veracode/veracode.js

@@ -0,0 +1,33 @@
+import { $ } from 'zx';
+
+// Thin wrappers around the external commands the Veracode step shells out to,
+// so scan.js can inject a fake in tests. Every call uses nothrow: a non-zero
+// exit is meaningful data here (a failed build/zip/upload), not an
+// exceptional case.
+export const veracode = {
+  async download(url, dest) {
+    const result = await $({
+      nothrow: true,
+      quiet: true,
+    })`curl -sSL ${url} -o ${dest}`;
+    return { ok: result.exitCode === 0 };
+  },
+
+  // Runs the consumer-supplied VERACODE_BUILD_CMD via `sh -c` so its own
+  // shell operators (&&, |, ...) are honored, mirroring the pipeline's
+  // `eval "${VERACODE_BUILD_CMD}"`.
+  async runBuildCmd(cmd) {
+    const result = await $({ nothrow: true })`sh -c ${cmd}`;
+    return { ok: result.exitCode === 0 };
+  },
+
+  async zip(zipFile, paths) {
+    const result = await $({ nothrow: true })`zip -r ${zipFile} ${paths}`;
+    return { ok: result.exitCode === 0 };
+  },
+
+  async uploadAndScan(jarPath, args) {
+    const result = await $({ nothrow: true })`java -jar ${jarPath} ${args}`;
+    return { ok: result.exitCode === 0 };
+  },
+};

package/src/xray/cli.js

@@ -0,0 +1,37 @@
+#!/usr/bin/env node
+
+import { Command } from 'commander';
+import { notify } from './notify.js';
+
+const program = new Command();
+
+program
+  .command('notify')
+  .description(
+    'Post Xray findings to Slack (parent summary + one thread reply per finding)',
+  )
+  .option(
+    '-f, --report-args-file <path>',
+    'Path to the "label:file" report-args file',
+  )
+  .option(
+    '-m, --min-severity <severity>',
+    'Lowest severity to thread (Critical|High|Medium|Low)',
+  )
+  .option('-c, --notify-clean', 'Post even when there are zero findings')
+  .action(async (options) => {
+    try {
+      await notify({
+        ...(options.reportArgsFile && {
+          reportArgsFile: options.reportArgsFile,
+        }),
+        ...(options.minSeverity && { minSeverity: options.minSeverity }),
+        ...(options.notifyClean && { notifyClean: true }),
+      });
+    } catch (error) {
+      console.error(error.message);
+      process.exit(1);
+    }
+  });
+
+program.parse(process.argv);

package/src/xray/notify.js

@@ -0,0 +1,107 @@
+import fs from 'fs';
+import {
+  extractFindings,
+  countBySeverity,
+  buildBuildLink,
+  buildParentPayload,
+  buildThreadPayload,
+  parseReportArgs,
+  rankOf,
+  sortBySeverity,
+} from './report.js';
+import { postMessage } from './slack.js';
+
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+// Orchestrates the full bin/xray.sh flow: read the report-args file, collect
+// findings from each simple-json scan file, post a Slack summary, then thread
+// one message per finding at or above minSeverity. Dependencies are
+// injectable so this can be unit tested without touching fs or the network.
+export async function notify({
+  reportArgsFile = process.env.XRAY_REPORT_ARGS_FILE || '/tmp/xray-report-args',
+  minSeverity = process.env.XRAY_SLACK_MIN_SEVERITY || 'High',
+  notifyClean = process.env.XRAY_SLACK_NOTIFY_CLEAN === 'true',
+  channel = process.env.XRAY_SLACK_CHANNEL,
+  token = process.env.XRAY_SLACK_TOKEN,
+  project = process.env.BITBUCKET_REPO_SLUG || 'unknown',
+  branch = process.env.BITBUCKET_BRANCH || '',
+  buildLink = buildBuildLink({
+    workspace: process.env.BITBUCKET_WORKSPACE,
+    repoSlug: process.env.BITBUCKET_REPO_SLUG,
+    buildNumber: process.env.BITBUCKET_BUILD_NUMBER,
+  }),
+  readFile = (path) => fs.readFileSync(path, 'utf8'),
+  post = postMessage,
+  log = console.log,
+  delay = sleep,
+} = {}) {
+  const minRank = rankOf(minSeverity);
+
+  let reportArgsContent;
+  try {
+    reportArgsContent = readFile(reportArgsFile);
+  } catch {
+    log(
+      `No scan results file at ${reportArgsFile} — skipping Slack notification.`,
+    );
+    return { posted: 0, skipped: true };
+  }
+
+  const findings = [];
+  for (const { label, file } of parseReportArgs(reportArgsContent)) {
+    let raw;
+    try {
+      raw = readFile(file);
+    } catch {
+      log(`Skipping ${label} (${file}): not produced or empty.`);
+      continue;
+    }
+    let data;
+    try {
+      data = JSON.parse(raw);
+    } catch {
+      log(`Skipping ${label} (${file}): not produced or empty.`);
+      continue;
+    }
+    findings.push(...extractFindings(data, label));
+  }
+
+  const counts = countBySeverity(findings);
+  log(
+    `📊 Counts: Critical=${counts.Critical}, High=${counts.High}, Medium=${counts.Medium}, Low=${counts.Low}, Total=${counts.total}`,
+  );
+
+  if (counts.total === 0 && !notifyClean) {
+    log('✅ No vulnerabilities found, skipping Slack notification.');
+    return { posted: 0, skipped: true };
+  }
+
+  const parentPayload = buildParentPayload({
+    channel,
+    project,
+    branch,
+    buildLink,
+    counts,
+  });
+  const parentResponse = await post(parentPayload, token);
+  const threadTs = parentResponse?.ts;
+
+  if (!threadTs) {
+    log('❌ Failed to create parent Slack message:');
+    log(JSON.stringify(parentResponse));
+    throw new Error('Failed to create parent Slack message');
+  }
+
+  log(`✅ Parent message created. thread_ts=${threadTs}`);
+
+  let posted = 0;
+  for (const finding of sortBySeverity(findings)) {
+    if (finding.rank > minRank) continue;
+    await post(buildThreadPayload({ channel, threadTs, finding }), token);
+    posted += 1;
+    await delay(100);
+  }
+
+  log(`✅ Posted ${posted} finding(s) to thread.`);
+  return { posted, skipped: false, threadTs };
+}

package/src/xray/notify.test.js

@@ -0,0 +1,161 @@
+import { describe, expect, jest, test } from '@jest/globals';
+import { notify } from './notify.js';
+
+function makeReadFile(files) {
+  return (path) => {
+    if (!(path in files)) {
+      const err = new Error(`ENOENT: ${path}`);
+      err.code = 'ENOENT';
+      throw err;
+    }
+    return files[path];
+  };
+}
+
+describe('notify', () => {
+  test('skips Slack entirely when the report-args file is missing', async () => {
+    const log = jest.fn();
+    const post = jest.fn();
+    const result = await notify({
+      reportArgsFile: '/tmp/does-not-exist',
+      readFile: makeReadFile({}),
+      post,
+      log,
+      delay: jest.fn(),
+    });
+
+    expect(result).toEqual({ posted: 0, skipped: true });
+    expect(post).not.toHaveBeenCalled();
+    expect(log).toHaveBeenCalledWith(
+      expect.stringContaining('No scan results file'),
+    );
+  });
+
+  test('skips a scan file that is missing or invalid JSON, continues with the rest', async () => {
+    const files = {
+      '/tmp/report-args':
+        'bad:xray-report/bad.json\ngood:xray-report/good.json\n',
+      'xray-report/bad.json': 'not json',
+      'xray-report/good.json': JSON.stringify({
+        vulnerabilities: [{ severity: 'Critical', issueId: 'X-1' }],
+      }),
+    };
+    const post = jest.fn().mockResolvedValue({ ts: '111.222' });
+    const log = jest.fn();
+
+    const result = await notify({
+      reportArgsFile: '/tmp/report-args',
+      readFile: makeReadFile(files),
+      post,
+      log,
+      delay: jest.fn(),
+      channel: '#c',
+      token: 'xoxb-x',
+    });
+
+    expect(log).toHaveBeenCalledWith(expect.stringContaining('Skipping bad'));
+    expect(result.posted).toBe(1);
+  });
+
+  test('does not notify Slack when there are zero findings and notifyClean is false', async () => {
+    const files = {
+      '/tmp/report-args': 'clean:xray-report/clean.json\n',
+      'xray-report/clean.json': JSON.stringify({}),
+    };
+    const post = jest.fn();
+
+    const result = await notify({
+      reportArgsFile: '/tmp/report-args',
+      readFile: makeReadFile(files),
+      post,
+      log: jest.fn(),
+      delay: jest.fn(),
+      notifyClean: false,
+    });
+
+    expect(result).toEqual({ posted: 0, skipped: true });
+    expect(post).not.toHaveBeenCalled();
+  });
+
+  test('posts a clean parent message when notifyClean is true even with zero findings', async () => {
+    const files = {
+      '/tmp/report-args': 'clean:xray-report/clean.json\n',
+      'xray-report/clean.json': JSON.stringify({}),
+    };
+    const post = jest.fn().mockResolvedValue({ ts: '111.222' });
+
+    const result = await notify({
+      reportArgsFile: '/tmp/report-args',
+      readFile: makeReadFile(files),
+      post,
+      log: jest.fn(),
+      delay: jest.fn(),
+      notifyClean: true,
+      channel: '#c',
+      token: 'xoxb-x',
+    });
+
+    expect(post).toHaveBeenCalledTimes(1);
+    expect(result).toEqual({ posted: 0, skipped: false, threadTs: '111.222' });
+  });
+
+  test('throws when Slack fails to create the parent message', async () => {
+    const files = {
+      '/tmp/report-args': 'scan:xray-report/x.json\n',
+      'xray-report/x.json': JSON.stringify({
+        vulnerabilities: [{ severity: 'Critical' }],
+      }),
+    };
+    const post = jest
+      .fn()
+      .mockResolvedValue({ ok: false, error: 'invalid_auth' });
+
+    await expect(
+      notify({
+        reportArgsFile: '/tmp/report-args',
+        readFile: makeReadFile(files),
+        post,
+        log: jest.fn(),
+        delay: jest.fn(),
+      }),
+    ).rejects.toThrow('Failed to create parent Slack message');
+  });
+
+  test('only threads findings at or above minSeverity, sorted Critical -> Low', async () => {
+    const files = {
+      '/tmp/report-args': 'scan:xray-report/x.json\n',
+      'xray-report/x.json': JSON.stringify({
+        vulnerabilities: [
+          { severity: 'Low', issueId: 'L-1' },
+          { severity: 'Critical', issueId: 'C-1' },
+          { severity: 'Medium', issueId: 'M-1' },
+        ],
+      }),
+    };
+    const post = jest
+      .fn()
+      .mockResolvedValueOnce({ ts: '111.222' }) // parent
+      .mockResolvedValue({ ts: '111.222' }); // thread replies
+    const delay = jest.fn().mockResolvedValue();
+
+    const result = await notify({
+      reportArgsFile: '/tmp/report-args',
+      readFile: makeReadFile(files),
+      post,
+      log: jest.fn(),
+      delay,
+      minSeverity: 'Medium',
+      channel: '#c',
+      token: 'xoxb-x',
+    });
+
+    // parent + Critical + Medium, Low excluded
+    expect(post).toHaveBeenCalledTimes(3);
+    expect(result.posted).toBe(2);
+    const threadedIds = post.mock.calls
+      .slice(1)
+      .map(([payload]) => payload.blocks[0].text.text);
+    expect(threadedIds[0]).toContain('*Critical*');
+    expect(threadedIds[1]).toContain('*Medium*');
+  });
+});