@docupace/pipeline 1.0.123-xray.2 → 1.0.123

package/bin/tenable-scan.sh

@@ -119,8 +119,8 @@ scan_one() {
     "--code-commit-hash" "${COMMIT}"
     "--code-commit-user" "${CODE_USER}"
     "--code-repository-url" "${CODE_REPO_URL}"
-    "--min-severity" "$(printf '%s' "${MIN_SEVERITY}" | tr 'A-Z' 'a-z')"
-    "--output-file-formats" "json,md,junit"
+    "--min-severity" "${MIN_SEVERITY}"
+    "--output-file-formats" "Json,Md,JUnit"
     "--output-path" "/tmp/tenable/out"
     "--output-file-name" "${slug}-tenable"
     "--no-color"
@@ -134,24 +134,15 @@ scan_one() {
     )
   fi
   if [[ -n "${TENABLE_FAIL_ON_MIN_SEVERITY:-}" ]]; then
-    scan_args+=("--fail-on-min-severity" "$(printf '%s' "${TENABLE_FAIL_ON_MIN_SEVERITY}" | tr 'A-Z' 'a-z')")
+    scan_args+=("--fail-on-min-severity" "${TENABLE_FAIL_ON_MIN_SEVERITY}")
   fi
 
   echo "Running Tenable scan for '${slug}' (min-severity=${MIN_SEVERITY}${TENABLE_FAIL_ON_MIN_SEVERITY:+, fail-on=${TENABLE_FAIL_ON_MIN_SEVERITY}})..."
-  # --entrypoint is not optional: Tenable's own GitHub action builds FROM this image
-  # solely to replace the entrypoint with a script that runs `tenable container-image
-  # scan "$@"`, so the image's own entrypoint is not that binary. Handing the
-  # subcommand to whatever it does start fails silently — exit 0, no output, no
-  # reports. The binary also takes its output destination from the environment (the
-  # action passes no --output-path flag at all), so it is set both ways.
   docker run --rm \
     --workdir /tmp/tenable \
     --volume "${work}:/tmp/tenable" \
     --env TENABLE_API_TOKEN \
     --env TENABLE_API_URL \
-    --env "TENABLE_OUTPUT_PATH=/tmp/tenable/out" \
-    --env "TENABLE_OUTPUT_FILE_NAME=${slug}-tenable" \
-    --entrypoint "${TENABLE_SCANNER_ENTRYPOINT:-tenable}" \
     --pull=always \
     "${SCANNER_IMAGE}" "${scan_args[@]}"
   local scan_exit=$?

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@docupace/pipeline",
-  "version": "1.0.123-xray.2",
+  "version": "1.0.123",
   "description": "",
   "main": "index.js",
   "type": "module",
@@ -12,10 +12,7 @@
     "dp-next-cli": "src/next/cli.js",
     "dp-auth0-cli": "src/auth0/cli.js",
     "dp-merge-cli": "src/merge/cli.js",
-    "dp-micro-cli": "src/micro/cli.js",
-    "dp-xray-cli": "src/xray/cli.js",
-    "dp-tenable-cli": "src/tenable/cli.js",
-    "dp-veracode-cli": "src/veracode/cli.js"
+    "dp-micro-cli": "src/micro/cli.js"
   },
   "keywords": [
     "bash"

package/src/changeset/validate.js

@@ -1,24 +1,14 @@
 import fs from 'fs';
 import path from 'path';
-import { fileURLToPath } from 'url';
 import { $ } from 'zx';
 
 import { setGitInfo } from '../next/util.js';
 import { versionStatus } from './version.js';
 
-const PACKAGE_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
-const PACKAGE_VERSION = JSON.parse(
-  fs.readFileSync(path.join(PACKAGE_ROOT, 'package.json'), 'utf8'),
-).version;
-
 export async function validateChangesets() {
-  console.log(`validateChangesets: @docupace/pipeline version = ${PACKAGE_VERSION}`);
   await setGitInfo();
   const destBranch = process.env.BITBUCKET_PR_DESTINATION_BRANCH;
-  console.log(`validateChangesets: destBranch = ${destBranch}`);
-  console.log(`validateChangesets: fetching origin ${destBranch}:${destBranch}`);
   await $`git fetch origin ${destBranch}:${destBranch}`;
-  console.log('validateChangesets: fetch succeeded');
   let releases;
 
   try {

package/src/next/util.js

@@ -84,41 +84,12 @@ export async function getChangedAppPackages() {
   return appPackages;
 }
 
-function maskCreds(url) {
-  return url.replace(/:[^:@/]+@/, ':***@');
-}
-
 export async function setGitInfo() {
-  console.log(`setGitInfo: SET_GITOPS_USER=${process.env.SET_GITOPS_USER || '(unset)'}`);
   if (process.env.SET_GITOPS_USER) {
-    const before = (await $`git remote get-url origin`).stdout.trim();
-    console.log(`setGitInfo: origin before = ${maskCreds(before)}`);
-
     await $`git config --global user.email "gitops@docupace.com"`;
     await $`git config --global user.name "Gitops"`;
-
-    // Some self-hosted runners rewrite `git@bitbucket.org:` (SSH) to a bare,
-    // credential-less `https://bitbucket.org/` via a git `insteadOf` rule, so an
-    // SSH-form origin silently loses its identity at fetch/push time. Use an
-    // HTTPS URL with the token embedded instead — insteadOf doesn't touch it.
-    const token =
-      process.env.BITBUCKET_STEP_OAUTH_TOKEN || process.env.BITBUCKET_TOKEN;
-    if (!token) {
-      console.log(
-        'setGitInfo: no BITBUCKET_STEP_OAUTH_TOKEN/BITBUCKET_TOKEN available, leaving origin as-is',
-      );
-    } else {
-      const repoUrl = `https://x-token-auth:${token}@bitbucket.org/dp-cloud/${process.env.BITBUCKET_REPO_SLUG}.git`;
-      console.log(`Setting new origin: ${maskCreds(repoUrl)}`);
-      await $`git remote set-url origin ${repoUrl}`;
-    }
-
-    const after = (await $`git remote get-url origin`).stdout.trim();
-    console.log(`setGitInfo: origin after = ${maskCreds(after)}`);
-  } else {
-    const current = (await $`git remote get-url origin`).stdout.trim();
-    console.log(
-      `setGitInfo: SET_GITOPS_USER not set, leaving origin as-is = ${maskCreds(current)}`,
-    );
+    const repoUrl = `git@bitbucket.org:dp-cloud/${process.env.BITBUCKET_REPO_SLUG}.git`;
+    console.log(`Setting new origin: ${repoUrl}`);
+    await $`git remote set-url origin ${repoUrl}`;
   }
 }

package/.gitignore

@@ -1,103 +0,0 @@
-# See https://help.github.com/articles/ignoring-files/ for more about ignoring files.
-
-# IDE
-.idea
-*.iml
-# Dependencies
-/node_modules
-/.pnp
-.pnp.js
-
-# Testing
-/coverage
-
-# Next.js
-/.next/
-/out/
-
-# Production
-/build
-/dist
-
-# Misc
-.DS_Store
-*.pem
-cypress/screenshots/
-
-# Debug
-npm-debug.log*
-yarn-debug.log*
-yarn-error.log*
-
-# Local env files
-.env*.local
-
-# Vercel
-.vercel
-
-# Typescript
-*.tsbuildinfo
-next-env.d.ts
-
-
-# Logs
-logs
-*.log
-
-# Runtime data
-pids
-*.pid
-*.seed
-
-# Directory for instrumented libs generated by jscoverage/JSCover
-lib-cov
-
-# Coverage directory used by tools like istanbul
-coverage
-
-# nyc test coverage
-.nyc_output
-
-# Grunt intermediate storage (http://gruntjs.com/creating-plugins#storing-task-files)
-.grunt
-
-# node-waf configuration
-.lock-wscript
-
-# Compiled binary addons (http://nodejs.org/api/addons.html)
-build/Release
-
-# Dependency directories
-node_modules
-jspm_packages
-
-# Optional npm cache directory
-.npm
-
-# Optional REPL history
-.node_repl_history
-.next
-
-scratch
-
-# visual studio code
-.vscode/
-
-src/gql/graphql.js
-.yalc/
-yalc.lock
-
-.last-run.json
-
-test-results
-coverage-reports
-.sonar
-.v8-coverage
-/assets
-tests/lib/data/auth.json
-
-failed-tests.json
-
-/tmp
-
-.claude

package/pnpm-workspace.yaml

@@ -1,3 +0,0 @@
-allowBuilds:
-  esbuild: true
-  unrs-resolver: true

package/src/tenable/args.js

@@ -1,157 +0,0 @@
-// Pure parsing/formatting logic for the Tenable scan step, ported from
-// bin/tenable-scan.sh. No fs/docker calls here so it's unit-testable.
-
-// Mirrors `tr -c 'A-Za-z0-9._-' '-'`: every character outside that set is
-// replaced with '-' (no squeezing of consecutive replacements).
-export function slugify(label) {
-  return label.replace(/[^A-Za-z0-9._-]/g, '-');
-}
-
-// Splits `str` on `sep` into exactly `n` fields, folding any extra fields
-// into the last one — matching `read a b c d <<< "$str"` semantics, where a
-// trailing variable absorbs everything left over.
-function splitFixed(str, sep, n) {
-  const parts = str.split(sep);
-  if (parts.length <= n) {
-    return [...parts, ...Array(n - parts.length).fill('')];
-  }
-  return [...parts.slice(0, n - 1), parts.slice(n - 1).join(sep)];
-}
-
-// One "label:auditDir:buildContext:dockerfile" entry from SCAN_TARGETS.
-// auditDir belongs to the Xray step and is ignored here. A target with no
-// build context is returned with skipped: true rather than dropped, so the
-// caller can log why it was skipped (matching the bash script's behavior).
-export function parseScanTargets(scanTargetsStr) {
-  return (scanTargetsStr || '')
-    .split(';')
-    .map((t) => t.trim())
-    .filter(Boolean)
-    .map((raw) => {
-      const [rawLabel, , rawContext, rawDockerfile] = splitFixed(raw, ':', 4);
-      const label = rawLabel || 'app';
-      const slug = slugify(label);
-      if (!rawContext) {
-        return { label, slug, buildContext: '', dockerfile: '', skipped: true };
-      }
-      return {
-        label,
-        slug,
-        buildContext: rawContext,
-        dockerfile: rawDockerfile || `${rawContext}/Dockerfile`,
-        skipped: false,
-      };
-    });
-}
-
-export function defaultScanTargets(buildContext, dockerfilePath) {
-  const ctx = buildContext || '.';
-  return `app::${ctx}:${dockerfilePath || `${ctx}/Dockerfile`}`;
-}
-
-export function buildCodeMetadata({
-  commit = 'local',
-  branch = '',
-  prDestinationBranch = '',
-  workspace = 'unknown',
-  repoSlug = 'unknown',
-  gitAuthorName = '',
-} = {}) {
-  return {
-    shortSha: commit.slice(0, 7),
-    codeBranch: branch || prDestinationBranch || 'unknown',
-    codeRepoUrl: `https://bitbucket.org/${workspace}/${repoSlug}`,
-    codeUser: gitAuthorName || 'bitbucket-pipelines',
-  };
-}
-
-// The scanner requires --pipeline-run-url as soon as any pipeline flag is
-// supplied, so the trio (id/trigger/url) travels together or not at all —
-// includeInScanArgs tells the caller which case applies.
-export function buildPipelineRunInfo({
-  runId = '',
-  runTrigger = '',
-  runUrl = '',
-  prId = '',
-  buildNumber = '',
-  workspace = 'unknown',
-  repoSlug = 'unknown',
-} = {}) {
-  const resolvedRunId = runId || buildNumber || '';
-  const resolvedTrigger = runTrigger || (prId ? 'pull_request' : '') || 'push';
-  const resolvedUrl =
-    runUrl ||
-    (buildNumber
-      ? `https://bitbucket.org/${workspace}/${repoSlug}/pipelines/results/${buildNumber}`
-      : '');
-
-  return {
-    runId: resolvedRunId,
-    runTrigger: resolvedTrigger,
-    runUrl: resolvedUrl,
-    includeInScanArgs: Boolean(resolvedRunId) && Boolean(resolvedUrl),
-  };
-}
-
-// The scanner's documented vocabularies are lowercase — severities
-// information|low|medium|high|critical, formats cyclonedx|json|junit|md — and it
-// does not correct a case mismatch or complain about one: it just exports nothing.
-// Callers set these from env vars that read naturally capitalised ("Medium"), so
-// normalise here rather than making every caller remember.
-export function buildScanArgs({
-  slug,
-  scanTarget,
-  codeBranch,
-  commit,
-  codeUser,
-  codeRepoUrl,
-  minSeverity,
-  runInfo,
-  failOnMinSeverity = '',
-}) {
-  const args = [
-    'container-image',
-    'scan',
-    '--archive-path',
-    '/tmp/tenable/image.tar',
-    '--name',
-    scanTarget,
-    '--code-branch',
-    codeBranch,
-    '--code-commit-hash',
-    commit,
-    '--code-commit-user',
-    codeUser,
-    '--code-repository-url',
-    codeRepoUrl,
-    '--min-severity',
-    String(minSeverity).toLowerCase(),
-    '--output-file-formats',
-    'json,md,junit',
-    '--output-path',
-    '/tmp/tenable/out',
-    '--output-file-name',
-    `${slug}-tenable`,
-    '--no-color',
-  ];
-
-  if (runInfo?.includeInScanArgs) {
-    args.push(
-      '--pipeline-run-id',
-      runInfo.runId,
-      '--pipeline-run-trigger',
-      runInfo.runTrigger,
-      '--pipeline-run-url',
-      runInfo.runUrl,
-    );
-  }
-
-  if (failOnMinSeverity) {
-    args.push('--fail-on-min-severity', failOnMinSeverity.toLowerCase());
-  }
-
-  return args;
-}
-
-export const SEPARATOR =
-  '==============================================================';

package/src/tenable/args.test.js

@@ -1,226 +0,0 @@
-import { describe, expect, test } from '@jest/globals';
-import {
-  slugify,
-  parseScanTargets,
-  defaultScanTargets,
-  buildCodeMetadata,
-  buildPipelineRunInfo,
-  buildScanArgs,
-} from './args.js';
-
-describe('slugify', () => {
-  test('replaces every non [A-Za-z0-9._-] character with a dash', () => {
-    expect(slugify('my app!')).toBe('my-app-');
-    expect(slugify('my/app')).toBe('my-app');
-    expect(slugify('already-safe_v1.2')).toBe('already-safe_v1.2');
-  });
-});
-
-describe('parseScanTargets', () => {
-  test('parses label:auditDir:context:dockerfile entries, ignoring auditDir', () => {
-    const targets = parseScanTargets(
-      'web:deps:services/web:services/web/Dockerfile.prod;worker::services/worker:',
-    );
-
-    expect(targets).toEqual([
-      {
-        label: 'web',
-        slug: 'web',
-        buildContext: 'services/web',
-        dockerfile: 'services/web/Dockerfile.prod',
-        skipped: false,
-      },
-      {
-        label: 'worker',
-        slug: 'worker',
-        buildContext: 'services/worker',
-        dockerfile: 'services/worker/Dockerfile',
-        skipped: false,
-      },
-    ]);
-  });
-
-  test('defaults an empty label to "app" and slugifies it', () => {
-    const [target] = parseScanTargets(':deps:ctx:Dockerfile');
-    expect(target.label).toBe('app');
-    expect(target.slug).toBe('app');
-  });
-
-  test('marks a target with no build context as skipped', () => {
-    const [target] = parseScanTargets('web:deps::Dockerfile');
-    expect(target).toEqual({
-      label: 'web',
-      slug: 'web',
-      buildContext: '',
-      dockerfile: '',
-      skipped: true,
-    });
-  });
-
-  test('ignores blank entries between semicolons', () => {
-    expect(parseScanTargets('web:deps:ctx:Dockerfile;;')).toHaveLength(1);
-  });
-
-  test('empty string produces no targets', () => {
-    expect(parseScanTargets('')).toEqual([]);
-  });
-});
-
-describe('defaultScanTargets', () => {
-  test('builds a single app target from context + dockerfile', () => {
-    expect(defaultScanTargets('.', './Dockerfile')).toBe('app::.:./Dockerfile');
-  });
-
-  test('defaults the dockerfile path to <context>/Dockerfile when unset', () => {
-    expect(defaultScanTargets('services/web', '')).toBe(
-      'app::services/web:services/web/Dockerfile',
-    );
-  });
-
-  test('defaults the context to "." when unset', () => {
-    expect(defaultScanTargets('', '')).toBe('app::.:./Dockerfile');
-  });
-});
-
-describe('buildCodeMetadata', () => {
-  test('derives a 7-char short SHA and falls back branch/user', () => {
-    const meta = buildCodeMetadata({
-      commit: 'abcdef1234567',
-      branch: '',
-      prDestinationBranch: 'main',
-      workspace: 'dp-cloud',
-      repoSlug: 'my-repo',
-      gitAuthorName: '',
-    });
-
-    expect(meta).toEqual({
-      shortSha: 'abcdef1',
-      codeBranch: 'main',
-      codeRepoUrl: 'https://bitbucket.org/dp-cloud/my-repo',
-      codeUser: 'bitbucket-pipelines',
-    });
-  });
-
-  test('prefers branch over PR destination branch, and a real author name', () => {
-    const meta = buildCodeMetadata({
-      commit: 'abcdef1234567',
-      branch: 'feature/x',
-      prDestinationBranch: 'main',
-      gitAuthorName: 'Matt Fields',
-    });
-    expect(meta.codeBranch).toBe('feature/x');
-    expect(meta.codeUser).toBe('Matt Fields');
-  });
-});
-
-describe('buildPipelineRunInfo', () => {
-  test('defaults trigger to push and builds a run URL from the build number', () => {
-    const info = buildPipelineRunInfo({
-      buildNumber: '42',
-      workspace: 'dp-cloud',
-      repoSlug: 'my-repo',
-    });
-
-    expect(info).toEqual({
-      runId: '42',
-      runTrigger: 'push',
-      runUrl: 'https://bitbucket.org/dp-cloud/my-repo/pipelines/results/42',
-      includeInScanArgs: true,
-    });
-  });
-
-  test('defaults trigger to pull_request when a PR id is present', () => {
-    const info = buildPipelineRunInfo({ buildNumber: '42', prId: '7' });
-    expect(info.runTrigger).toBe('pull_request');
-  });
-
-  test('explicit TENABLE_PIPELINE_RUN_* values win over the Bitbucket-derived ones', () => {
-    const info = buildPipelineRunInfo({
-      runId: 'custom-1',
-      runTrigger: 'manual',
-      runUrl: 'https://example.com/run/1',
-      buildNumber: '42',
-    });
-    expect(info).toEqual({
-      runId: 'custom-1',
-      runTrigger: 'manual',
-      runUrl: 'https://example.com/run/1',
-      includeInScanArgs: true,
-    });
-  });
-
-  test('does not include the trio in scan args when no build number/id is available', () => {
-    const info = buildPipelineRunInfo({});
-    expect(info.includeInScanArgs).toBe(false);
-  });
-});
-
-describe('buildScanArgs', () => {
-  const base = {
-    slug: 'web',
-    scanTarget: 'my-repo-web:tenable-abc1234',
-    codeBranch: 'main',
-    commit: 'abcdef1234567',
-    codeUser: 'Matt Fields',
-    codeRepoUrl: 'https://bitbucket.org/dp-cloud/my-repo',
-    minSeverity: 'Medium',
-    runInfo: { includeInScanArgs: false },
-  };
-
-  test('builds the base scanner CLI args', () => {
-    expect(buildScanArgs(base)).toEqual([
-      'container-image',
-      'scan',
-      '--archive-path',
-      '/tmp/tenable/image.tar',
-      '--name',
-      'my-repo-web:tenable-abc1234',
-      '--code-branch',
-      'main',
-      '--code-commit-hash',
-      'abcdef1234567',
-      '--code-commit-user',
-      'Matt Fields',
-      '--code-repository-url',
-      'https://bitbucket.org/dp-cloud/my-repo',
-      '--min-severity',
-      'medium',
-      '--output-file-formats',
-      'json,md,junit',
-      '--output-path',
-      '/tmp/tenable/out',
-      '--output-file-name',
-      'web-tenable',
-      '--no-color',
-    ]);
-  });
-
-  test('appends the pipeline-run trio only when includeInScanArgs is true', () => {
-    const args = buildScanArgs({
-      ...base,
-      runInfo: {
-        includeInScanArgs: true,
-        runId: '42',
-        runTrigger: 'push',
-        runUrl: 'https://bitbucket.org/dp-cloud/my-repo/pipelines/results/42',
-      },
-    });
-    expect(args).toEqual(
-      expect.arrayContaining([
-        '--pipeline-run-id',
-        '42',
-        '--pipeline-run-trigger',
-        'push',
-        '--pipeline-run-url',
-        'https://bitbucket.org/dp-cloud/my-repo/pipelines/results/42',
-      ]),
-    );
-  });
-
-  test('appends --fail-on-min-severity only when set', () => {
-    expect(buildScanArgs(base)).not.toContain('--fail-on-min-severity');
-    expect(buildScanArgs({ ...base, failOnMinSeverity: 'High' })).toEqual(
-      expect.arrayContaining(['--fail-on-min-severity', 'high']),
-    );
-  });
-});

package/src/tenable/cli.js

@@ -1,24 +0,0 @@
-#!/usr/bin/env node
-
-import { Command } from 'commander';
-import { $ } from 'zx';
-import { runTenableScan } from './scan.js';
-
-const program = new Command();
-
-program
-  .command('scan')
-  .description('Run the Tenable Cloud Security container image scan')
-  .action(async () => {
-    let gitAuthorName = '';
-    const result = await $({
-      nothrow: true,
-      quiet: true,
-    })`git log -1 --pretty=format:%an`;
-    if (result.exitCode === 0) gitAuthorName = result.stdout.trim();
-
-    const { exitCode } = await runTenableScan({ gitAuthorName });
-    process.exit(exitCode);
-  });
-
-program.parse(process.argv);

package/src/tenable/docker.js

@@ -1,45 +0,0 @@
-import { $ } from 'zx';
-
-// Thin wrappers around the docker CLI so scan.js can inject a fake in tests.
-// Every call uses nothrow: a non-zero exit is meaningful data here (a failed
-// build, or the scanner itself reporting findings), not an exceptional case.
-export const docker = {
-  async buildxAvailable() {
-    const result = await $({
-      nothrow: true,
-      quiet: true,
-    })`docker buildx version`;
-    return result.exitCode === 0;
-  },
-
-  async build(args) {
-    const result = await $({ nothrow: true })`docker build ${args}`;
-    return { ok: result.exitCode === 0 };
-  },
-
-  async save(image, tarPath) {
-    const result = await $({
-      nothrow: true,
-    })`docker save ${image} -o ${tarPath}`;
-    return { ok: result.exitCode === 0 };
-  },
-
-  // The entrypoint is overridden rather than trusted. Tenable's own GitHub action
-  // builds FROM this image purely to replace the entrypoint with a script whose
-  // first line is `tenable container-image scan "$@"`, which means the base image's
-  // own entrypoint is not that binary. Passing the subcommand as bare arguments
-  // hands them to whatever the image does start, and the failure is silent: exit 0,
-  // no output, no reports.
-  async run({ image, args, volume, workdir, env, entrypoint }) {
-    const envFlags = env.flatMap((name) => ['--env', name]);
-    const entrypointFlags = entrypoint ? ['--entrypoint', entrypoint] : [];
-    const result = await $({
-      nothrow: true,
-    })`docker run --rm --workdir ${workdir} --volume ${volume} ${envFlags} ${entrypointFlags} --pull=always ${image} ${args}`;
-    return result.exitCode;
-  },
-
-  async rmi(image) {
-    await $({ nothrow: true, quiet: true })`docker rmi -f ${image}`;
-  },
-};