@docupace/pipeline 1.0.123-xray.1 → 1.0.123-xray.3

package/bin/tenable-scan.sh

@@ -119,8 +119,8 @@ scan_one() {
     "--code-commit-hash" "${COMMIT}"
     "--code-commit-user" "${CODE_USER}"
     "--code-repository-url" "${CODE_REPO_URL}"
-    "--min-severity" "${MIN_SEVERITY}"
-    "--output-file-formats" "Json,Md,JUnit"
+    "--min-severity" "$(printf '%s' "${MIN_SEVERITY}" | tr 'A-Z' 'a-z')"
+    "--output-file-formats" "json,md,junit"
     "--output-path" "/tmp/tenable/out"
     "--output-file-name" "${slug}-tenable"
     "--no-color"
@@ -134,15 +134,24 @@ scan_one() {
     )
   fi
   if [[ -n "${TENABLE_FAIL_ON_MIN_SEVERITY:-}" ]]; then
-    scan_args+=("--fail-on-min-severity" "${TENABLE_FAIL_ON_MIN_SEVERITY}")
+    scan_args+=("--fail-on-min-severity" "$(printf '%s' "${TENABLE_FAIL_ON_MIN_SEVERITY}" | tr 'A-Z' 'a-z')")
   fi
 
   echo "Running Tenable scan for '${slug}' (min-severity=${MIN_SEVERITY}${TENABLE_FAIL_ON_MIN_SEVERITY:+, fail-on=${TENABLE_FAIL_ON_MIN_SEVERITY}})..."
+  # --entrypoint is not optional: Tenable's own GitHub action builds FROM this image
+  # solely to replace the entrypoint with a script that runs `tenable container-image
+  # scan "$@"`, so the image's own entrypoint is not that binary. Handing the
+  # subcommand to whatever it does start fails silently — exit 0, no output, no
+  # reports. The binary also takes its output destination from the environment (the
+  # action passes no --output-path flag at all), so it is set both ways.
   docker run --rm \
     --workdir /tmp/tenable \
     --volume "${work}:/tmp/tenable" \
     --env TENABLE_API_TOKEN \
     --env TENABLE_API_URL \
+    --env "TENABLE_OUTPUT_PATH=/tmp/tenable/out" \
+    --env "TENABLE_OUTPUT_FILE_NAME=${slug}-tenable" \
+    --entrypoint "${TENABLE_SCANNER_ENTRYPOINT:-tenable}" \
     --pull=always \
     "${SCANNER_IMAGE}" "${scan_args[@]}"
   local scan_exit=$?

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@docupace/pipeline",
-  "version": "1.0.123-xray.1",
+  "version": "1.0.123-xray.3",
   "description": "",
   "main": "index.js",
   "type": "module",

package/src/tenable/docker.js

@@ -24,11 +24,18 @@ export const docker = {
     return { ok: result.exitCode === 0 };
   },
 
-  async run({ image, args, volume, workdir, env }) {
+  // The entrypoint is overridden rather than trusted. Tenable's own GitHub action
+  // builds FROM this image purely to replace the entrypoint with a script whose
+  // first line is `tenable container-image scan "$@"`, which means the base image's
+  // own entrypoint is not that binary. Passing the subcommand as bare arguments
+  // hands them to whatever the image does start, and the failure is silent: exit 0,
+  // no output, no reports.
+  async run({ image, args, volume, workdir, env, entrypoint }) {
     const envFlags = env.flatMap((name) => ['--env', name]);
+    const entrypointFlags = entrypoint ? ['--entrypoint', entrypoint] : [];
     const result = await $({
       nothrow: true,
-    })`docker run --rm --workdir ${workdir} --volume ${volume} ${envFlags} --pull=always ${image} ${args}`;
+    })`docker run --rm --workdir ${workdir} --volume ${volume} ${envFlags} ${entrypointFlags} --pull=always ${image} ${args}`;
     return result.exitCode;
   },
 

package/src/tenable/scan.js

@@ -16,6 +16,7 @@ export async function scanOne(target, ctx) {
   const {
     reportDir,
     scannerImage,
+    scannerEntrypoint,
     shortSha,
     imageNamePrefix,
     codeBranch,
@@ -97,6 +98,7 @@ export async function scanOne(target, ctx) {
     args: scanArgs,
     volume: `${work}:/tmp/tenable`,
     workdir: '/tmp/tenable',
+    entrypoint: scannerEntrypoint,
     // The output destination goes over BOTH transports on purpose. Tenable's own
     // GitHub action passes output-path and output-file-name only as TENABLE_*
     // env vars, never as flags, so a build of the scanner that ignores the flags
@@ -157,6 +159,7 @@ export async function runTenableScan({
   reportDir = process.env.TENABLE_REPORT_DIR || 'tenable-report',
   scannerImage = process.env.TENABLE_SCANNER_IMAGE ||
     'tenable/cloud-security-scanner:latest',
+  scannerEntrypoint = process.env.TENABLE_SCANNER_ENTRYPOINT || 'tenable',
   minSeverity = process.env.TENABLE_MIN_SEVERITY || 'Medium',
   failOnMinSeverity = process.env.TENABLE_FAIL_ON_MIN_SEVERITY || '',
   tenableImage = process.env.TENABLE_IMAGE || '',
@@ -204,6 +207,7 @@ export async function runTenableScan({
   const scanCtx = {
     reportDir,
     scannerImage,
+    scannerEntrypoint,
     shortSha,
     imageNamePrefix: repoSlug,
     codeBranch,

package/src/tenable/scan.test.js

@@ -28,6 +28,7 @@ function makeFakeFsops(overrides = {}) {
 const baseCtx = (overrides = {}) => ({
   reportDir: 'tenable-report',
   scannerImage: 'tenable/cloud-security-scanner:latest',
+  scannerEntrypoint: 'tenable',
   shortSha: 'abc1234',
   imageNamePrefix: 'my-repo',
   codeBranch: 'main',
@@ -82,6 +83,27 @@ describe('scanOne', () => {
     expect(fsops.removeSync).toHaveBeenCalledWith('/work/.tenable-work.abc');
   });
 
+  test('drives the scanner through the tenable binary, not the image entrypoint', async () => {
+    const docker = makeFakeDocker();
+    const ctx = baseCtx({ docker });
+
+    await scanOne(
+      { label: 'image', slug: 'image', prebuiltImage: 'my-image:tag' },
+      ctx,
+    );
+
+    const call = docker.run.mock.calls[0][0];
+    expect(call.entrypoint).toBe('tenable');
+    // The binary reads its output destination from the environment; the action
+    // that ships with the scanner passes no --output-path flag at all.
+    expect(call.env).toEqual(
+      expect.arrayContaining([
+        'TENABLE_OUTPUT_PATH=/tmp/tenable/out',
+        'TENABLE_OUTPUT_FILE_NAME=image-tenable',
+      ]),
+    );
+  });
+
   test('scans a pre-built image without building or removing anything', async () => {
     const docker = makeFakeDocker();
     const fsops = makeFakeFsops();

package/src/veracode/scan.js

@@ -57,10 +57,14 @@ export async function scanOne(target, ctx) {
   return { label, slug, exitCode: 0 };
 }
 
+// Commands the step shells out to on the host, rather than inside a container.
+export const REQUIRED_COMMANDS = ['java', 'zip'];
+
 export async function runVeracodeScan({
   vid = process.env.VERACODE_API_ID || '',
   vkey = process.env.VERACODE_API_KEY || '',
   targetsEnv = process.env.VERACODE_TARGETS || '',
+  requireCredentials = process.env.VERACODE_REQUIRE_CREDENTIALS === 'true',
   buildCmd = process.env.VERACODE_BUILD_CMD || '',
   commit = process.env.BITBUCKET_COMMIT || 'local',
   wrapperJar = process.env.VERACODE_WRAPPER_JAR || DEFAULT_WRAPPER_JAR,
@@ -69,18 +73,41 @@ export async function runVeracodeScan({
   fsops = defaultFsOps,
   log = console.log,
 } = {}) {
+  // Absent credentials mean the repo or runner was never set up for Veracode,
+  // which is not the same thing as a broken configuration: skip, the way the
+  // Tenable step does, so a consumer can add the step before the credentials
+  // exist. VERACODE_REQUIRE_CREDENTIALS=true turns it back into a hard failure
+  // once a repo expects the scan to run on every build.
   if (!vid || !vkey) {
+    if (requireCredentials) {
+      log(
+        'ERROR: VERACODE_API_ID / VERACODE_API_KEY not set and VERACODE_REQUIRE_CREDENTIALS=true — failing.',
+      );
+      return { exitCode: 1, skipped: false, results: [] };
+    }
     log(
-      'ERROR: VERACODE_API_ID / VERACODE_API_KEY not set — cannot run Veracode scan.',
+      'VERACODE_API_ID / VERACODE_API_KEY not set — skipping Veracode scan.',
     );
-    return { exitCode: 1, results: [] };
+    return { exitCode: 0, skipped: true, results: [] };
   }
+
+  // Credentials present but no targets is a broken configuration, so this stays
+  // a hard failure however the credentials were supplied.
   if (!targetsEnv) {
     log('ERROR: VERACODE_TARGETS not set — cannot run Veracode scan.');
     log(
       '       Expected: label:appname:path1,path2,...[;label2:appname2:path1,...]',
     );
-    return { exitCode: 1, results: [] };
+    return { exitCode: 1, skipped: false, results: [] };
+  }
+
+  for (const cmd of REQUIRED_COMMANDS) {
+    if (!(await veracode.commandExists(cmd))) {
+      log(
+        `ERROR: ${cmd} is not on PATH — the Veracode step packages and uploads with it.`,
+      );
+      return { exitCode: 1, skipped: false, results: [] };
+    }
   }
 
   // VERACODE_BUILD_CMD lets a consumer produce whatever build artifacts
@@ -116,5 +143,5 @@ export async function runVeracodeScan({
   }
 
   const exitCode = results.some((r) => r.exitCode !== 0) ? 1 : 0;
-  return { exitCode, results };
+  return { exitCode, skipped: false, results };
 }

package/src/veracode/scan.test.js

@@ -3,6 +3,7 @@ import { scanOne, runVeracodeScan, DEFAULT_WRAPPER_JAR } from './scan.js';
 
 function makeFakeVeracode(overrides = {}) {
   return {
+    commandExists: jest.fn().mockResolvedValue(true),
     download: jest.fn().mockResolvedValue({ ok: true }),
     runBuildCmd: jest.fn().mockResolvedValue({ ok: true }),
     zip: jest.fn().mockResolvedValue({ ok: true }),
@@ -124,36 +125,82 @@ describe('scanOne', () => {
 });
 
 describe('runVeracodeScan', () => {
-  test('fails fast when credentials are missing', async () => {
+  test('skips without failing when credentials are missing', async () => {
     const log = jest.fn();
+    const veracode = makeFakeVeracode();
     const result = await runVeracodeScan({
       vid: '',
       vkey: '',
       targetsEnv: 'web:my-app:src',
+      veracode,
       log,
     });
 
-    expect(result).toEqual({ exitCode: 1, results: [] });
+    expect(result).toEqual({ exitCode: 0, skipped: true, results: [] });
+    expect(veracode.zip).not.toHaveBeenCalled();
     expect(log).toHaveBeenCalledWith(
       expect.stringContaining('VERACODE_API_ID / VERACODE_API_KEY not set'),
     );
   });
 
+  test('fails on missing credentials when VERACODE_REQUIRE_CREDENTIALS is set', async () => {
+    const log = jest.fn();
+    const result = await runVeracodeScan({
+      vid: '',
+      vkey: '',
+      targetsEnv: 'web:my-app:src',
+      requireCredentials: true,
+      veracode: makeFakeVeracode(),
+      log,
+    });
+
+    expect(result).toEqual({ exitCode: 1, skipped: false, results: [] });
+    expect(log).toHaveBeenCalledWith(
+      expect.stringContaining('VERACODE_REQUIRE_CREDENTIALS=true'),
+    );
+  });
+
   test('fails fast when VERACODE_TARGETS is missing', async () => {
     const log = jest.fn();
     const result = await runVeracodeScan({
       vid: 'vid-1',
       vkey: 'vkey-1',
       targetsEnv: '',
+      veracode: makeFakeVeracode(),
       log,
     });
 
-    expect(result).toEqual({ exitCode: 1, results: [] });
+    expect(result).toEqual({ exitCode: 1, skipped: false, results: [] });
     expect(log).toHaveBeenCalledWith(
       expect.stringContaining('VERACODE_TARGETS not set'),
     );
   });
 
+  test.each(['java', 'zip'])(
+    'fails before packaging when %s is not on PATH',
+    async (missing) => {
+      const log = jest.fn();
+      const veracode = makeFakeVeracode({
+        commandExists: jest.fn(async (cmd) => cmd !== missing),
+      });
+      const result = await runVeracodeScan({
+        vid: 'vid-1',
+        vkey: 'vkey-1',
+        targetsEnv: 'web:my-app:src',
+        veracode,
+        fsops: makeFakeFsops(),
+        log,
+      });
+
+      expect(result).toEqual({ exitCode: 1, skipped: false, results: [] });
+      expect(veracode.zip).not.toHaveBeenCalled();
+      expect(veracode.download).not.toHaveBeenCalled();
+      expect(log).toHaveBeenCalledWith(
+        expect.stringContaining(`${missing} is not on PATH`),
+      );
+    },
+  );
+
   test('runs VERACODE_BUILD_CMD before packaging when set', async () => {
     const veracode = makeFakeVeracode();
     const fsops = makeFakeFsops();

package/src/veracode/veracode.js

@@ -5,6 +5,18 @@ import { $ } from 'zx';
 // exit is meaningful data here (a failed build/zip/upload), not an
 // exceptional case.
 export const veracode = {
+  // The wrapper is a jar and packaging is done by `zip`, so this step — alone
+  // among the scan steps — depends on host tooling rather than a container
+  // image. Checked up front so a missing JRE reads as a missing JRE instead of
+  // surfacing as a failed upload several minutes later.
+  async commandExists(cmd) {
+    const result = await $({
+      nothrow: true,
+      quiet: true,
+    })`command -v ${cmd}`;
+    return result.exitCode === 0;
+  },
+
   async download(url, dest) {
     const result = await $({
       nothrow: true,