@docupace/pipeline 1.0.123-xray.1 → 1.0.123-xray.2

package/bin/tenable-scan.sh

@@ -119,8 +119,8 @@ scan_one() {
     "--code-commit-hash" "${COMMIT}"
     "--code-commit-user" "${CODE_USER}"
     "--code-repository-url" "${CODE_REPO_URL}"
-    "--min-severity" "${MIN_SEVERITY}"
-    "--output-file-formats" "Json,Md,JUnit"
+    "--min-severity" "$(printf '%s' "${MIN_SEVERITY}" | tr 'A-Z' 'a-z')"
+    "--output-file-formats" "json,md,junit"
     "--output-path" "/tmp/tenable/out"
     "--output-file-name" "${slug}-tenable"
     "--no-color"
@@ -134,15 +134,24 @@ scan_one() {
     )
   fi
   if [[ -n "${TENABLE_FAIL_ON_MIN_SEVERITY:-}" ]]; then
-    scan_args+=("--fail-on-min-severity" "${TENABLE_FAIL_ON_MIN_SEVERITY}")
+    scan_args+=("--fail-on-min-severity" "$(printf '%s' "${TENABLE_FAIL_ON_MIN_SEVERITY}" | tr 'A-Z' 'a-z')")
   fi
 
   echo "Running Tenable scan for '${slug}' (min-severity=${MIN_SEVERITY}${TENABLE_FAIL_ON_MIN_SEVERITY:+, fail-on=${TENABLE_FAIL_ON_MIN_SEVERITY}})..."
+  # --entrypoint is not optional: Tenable's own GitHub action builds FROM this image
+  # solely to replace the entrypoint with a script that runs `tenable container-image
+  # scan "$@"`, so the image's own entrypoint is not that binary. Handing the
+  # subcommand to whatever it does start fails silently — exit 0, no output, no
+  # reports. The binary also takes its output destination from the environment (the
+  # action passes no --output-path flag at all), so it is set both ways.
   docker run --rm \
     --workdir /tmp/tenable \
     --volume "${work}:/tmp/tenable" \
     --env TENABLE_API_TOKEN \
     --env TENABLE_API_URL \
+    --env "TENABLE_OUTPUT_PATH=/tmp/tenable/out" \
+    --env "TENABLE_OUTPUT_FILE_NAME=${slug}-tenable" \
+    --entrypoint "${TENABLE_SCANNER_ENTRYPOINT:-tenable}" \
     --pull=always \
     "${SCANNER_IMAGE}" "${scan_args[@]}"
   local scan_exit=$?

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@docupace/pipeline",
-  "version": "1.0.123-xray.1",
+  "version": "1.0.123-xray.2",
   "description": "",
   "main": "index.js",
   "type": "module",

package/src/tenable/docker.js

@@ -24,11 +24,18 @@ export const docker = {
     return { ok: result.exitCode === 0 };
   },
 
-  async run({ image, args, volume, workdir, env }) {
+  // The entrypoint is overridden rather than trusted. Tenable's own GitHub action
+  // builds FROM this image purely to replace the entrypoint with a script whose
+  // first line is `tenable container-image scan "$@"`, which means the base image's
+  // own entrypoint is not that binary. Passing the subcommand as bare arguments
+  // hands them to whatever the image does start, and the failure is silent: exit 0,
+  // no output, no reports.
+  async run({ image, args, volume, workdir, env, entrypoint }) {
     const envFlags = env.flatMap((name) => ['--env', name]);
+    const entrypointFlags = entrypoint ? ['--entrypoint', entrypoint] : [];
     const result = await $({
       nothrow: true,
-    })`docker run --rm --workdir ${workdir} --volume ${volume} ${envFlags} --pull=always ${image} ${args}`;
+    })`docker run --rm --workdir ${workdir} --volume ${volume} ${envFlags} ${entrypointFlags} --pull=always ${image} ${args}`;
     return result.exitCode;
   },
 

package/src/tenable/scan.js

@@ -16,6 +16,7 @@ export async function scanOne(target, ctx) {
   const {
     reportDir,
     scannerImage,
+    scannerEntrypoint,
     shortSha,
     imageNamePrefix,
     codeBranch,
@@ -97,6 +98,7 @@ export async function scanOne(target, ctx) {
     args: scanArgs,
     volume: `${work}:/tmp/tenable`,
     workdir: '/tmp/tenable',
+    entrypoint: scannerEntrypoint,
     // The output destination goes over BOTH transports on purpose. Tenable's own
     // GitHub action passes output-path and output-file-name only as TENABLE_*
     // env vars, never as flags, so a build of the scanner that ignores the flags
@@ -157,6 +159,7 @@ export async function runTenableScan({
   reportDir = process.env.TENABLE_REPORT_DIR || 'tenable-report',
   scannerImage = process.env.TENABLE_SCANNER_IMAGE ||
     'tenable/cloud-security-scanner:latest',
+  scannerEntrypoint = process.env.TENABLE_SCANNER_ENTRYPOINT || 'tenable',
   minSeverity = process.env.TENABLE_MIN_SEVERITY || 'Medium',
   failOnMinSeverity = process.env.TENABLE_FAIL_ON_MIN_SEVERITY || '',
   tenableImage = process.env.TENABLE_IMAGE || '',
@@ -204,6 +207,7 @@ export async function runTenableScan({
   const scanCtx = {
     reportDir,
     scannerImage,
+    scannerEntrypoint,
     shortSha,
     imageNamePrefix: repoSlug,
     codeBranch,

package/src/tenable/scan.test.js

@@ -28,6 +28,7 @@ function makeFakeFsops(overrides = {}) {
 const baseCtx = (overrides = {}) => ({
   reportDir: 'tenable-report',
   scannerImage: 'tenable/cloud-security-scanner:latest',
+  scannerEntrypoint: 'tenable',
   shortSha: 'abc1234',
   imageNamePrefix: 'my-repo',
   codeBranch: 'main',
@@ -82,6 +83,27 @@ describe('scanOne', () => {
     expect(fsops.removeSync).toHaveBeenCalledWith('/work/.tenable-work.abc');
   });
 
+  test('drives the scanner through the tenable binary, not the image entrypoint', async () => {
+    const docker = makeFakeDocker();
+    const ctx = baseCtx({ docker });
+
+    await scanOne(
+      { label: 'image', slug: 'image', prebuiltImage: 'my-image:tag' },
+      ctx,
+    );
+
+    const call = docker.run.mock.calls[0][0];
+    expect(call.entrypoint).toBe('tenable');
+    // The binary reads its output destination from the environment; the action
+    // that ships with the scanner passes no --output-path flag at all.
+    expect(call.env).toEqual(
+      expect.arrayContaining([
+        'TENABLE_OUTPUT_PATH=/tmp/tenable/out',
+        'TENABLE_OUTPUT_FILE_NAME=image-tenable',
+      ]),
+    );
+  });
+
   test('scans a pre-built image without building or removing anything', async () => {
     const docker = makeFakeDocker();
     const fsops = makeFakeFsops();