@docupace/pipeline 1.0.123-xray.2 → 1.0.123-xray.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@docupace/pipeline",
-  "version": "1.0.123-xray.2",
+  "version": "1.0.123-xray.3",
   "description": "",
   "main": "index.js",
   "type": "module",

package/src/veracode/scan.js

@@ -57,10 +57,14 @@ export async function scanOne(target, ctx) {
   return { label, slug, exitCode: 0 };
 }
 
+// Commands the step shells out to on the host, rather than inside a container.
+export const REQUIRED_COMMANDS = ['java', 'zip'];
+
 export async function runVeracodeScan({
   vid = process.env.VERACODE_API_ID || '',
   vkey = process.env.VERACODE_API_KEY || '',
   targetsEnv = process.env.VERACODE_TARGETS || '',
+  requireCredentials = process.env.VERACODE_REQUIRE_CREDENTIALS === 'true',
   buildCmd = process.env.VERACODE_BUILD_CMD || '',
   commit = process.env.BITBUCKET_COMMIT || 'local',
   wrapperJar = process.env.VERACODE_WRAPPER_JAR || DEFAULT_WRAPPER_JAR,
@@ -69,18 +73,41 @@ export async function runVeracodeScan({
   fsops = defaultFsOps,
   log = console.log,
 } = {}) {
+  // Absent credentials mean the repo or runner was never set up for Veracode,
+  // which is not the same thing as a broken configuration: skip, the way the
+  // Tenable step does, so a consumer can add the step before the credentials
+  // exist. VERACODE_REQUIRE_CREDENTIALS=true turns it back into a hard failure
+  // once a repo expects the scan to run on every build.
   if (!vid || !vkey) {
+    if (requireCredentials) {
+      log(
+        'ERROR: VERACODE_API_ID / VERACODE_API_KEY not set and VERACODE_REQUIRE_CREDENTIALS=true — failing.',
+      );
+      return { exitCode: 1, skipped: false, results: [] };
+    }
     log(
-      'ERROR: VERACODE_API_ID / VERACODE_API_KEY not set — cannot run Veracode scan.',
+      'VERACODE_API_ID / VERACODE_API_KEY not set — skipping Veracode scan.',
     );
-    return { exitCode: 1, results: [] };
+    return { exitCode: 0, skipped: true, results: [] };
   }
+
+  // Credentials present but no targets is a broken configuration, so this stays
+  // a hard failure however the credentials were supplied.
   if (!targetsEnv) {
     log('ERROR: VERACODE_TARGETS not set — cannot run Veracode scan.');
     log(
       '       Expected: label:appname:path1,path2,...[;label2:appname2:path1,...]',
     );
-    return { exitCode: 1, results: [] };
+    return { exitCode: 1, skipped: false, results: [] };
+  }
+
+  for (const cmd of REQUIRED_COMMANDS) {
+    if (!(await veracode.commandExists(cmd))) {
+      log(
+        `ERROR: ${cmd} is not on PATH — the Veracode step packages and uploads with it.`,
+      );
+      return { exitCode: 1, skipped: false, results: [] };
+    }
   }
 
   // VERACODE_BUILD_CMD lets a consumer produce whatever build artifacts
@@ -116,5 +143,5 @@ export async function runVeracodeScan({
   }
 
   const exitCode = results.some((r) => r.exitCode !== 0) ? 1 : 0;
-  return { exitCode, results };
+  return { exitCode, skipped: false, results };
 }

package/src/veracode/scan.test.js

@@ -3,6 +3,7 @@ import { scanOne, runVeracodeScan, DEFAULT_WRAPPER_JAR } from './scan.js';
 
 function makeFakeVeracode(overrides = {}) {
   return {
+    commandExists: jest.fn().mockResolvedValue(true),
     download: jest.fn().mockResolvedValue({ ok: true }),
     runBuildCmd: jest.fn().mockResolvedValue({ ok: true }),
     zip: jest.fn().mockResolvedValue({ ok: true }),
@@ -124,36 +125,82 @@ describe('scanOne', () => {
 });
 
 describe('runVeracodeScan', () => {
-  test('fails fast when credentials are missing', async () => {
+  test('skips without failing when credentials are missing', async () => {
     const log = jest.fn();
+    const veracode = makeFakeVeracode();
     const result = await runVeracodeScan({
       vid: '',
       vkey: '',
       targetsEnv: 'web:my-app:src',
+      veracode,
       log,
     });
 
-    expect(result).toEqual({ exitCode: 1, results: [] });
+    expect(result).toEqual({ exitCode: 0, skipped: true, results: [] });
+    expect(veracode.zip).not.toHaveBeenCalled();
     expect(log).toHaveBeenCalledWith(
       expect.stringContaining('VERACODE_API_ID / VERACODE_API_KEY not set'),
     );
   });
 
+  test('fails on missing credentials when VERACODE_REQUIRE_CREDENTIALS is set', async () => {
+    const log = jest.fn();
+    const result = await runVeracodeScan({
+      vid: '',
+      vkey: '',
+      targetsEnv: 'web:my-app:src',
+      requireCredentials: true,
+      veracode: makeFakeVeracode(),
+      log,
+    });
+
+    expect(result).toEqual({ exitCode: 1, skipped: false, results: [] });
+    expect(log).toHaveBeenCalledWith(
+      expect.stringContaining('VERACODE_REQUIRE_CREDENTIALS=true'),
+    );
+  });
+
   test('fails fast when VERACODE_TARGETS is missing', async () => {
     const log = jest.fn();
     const result = await runVeracodeScan({
       vid: 'vid-1',
       vkey: 'vkey-1',
       targetsEnv: '',
+      veracode: makeFakeVeracode(),
       log,
     });
 
-    expect(result).toEqual({ exitCode: 1, results: [] });
+    expect(result).toEqual({ exitCode: 1, skipped: false, results: [] });
     expect(log).toHaveBeenCalledWith(
       expect.stringContaining('VERACODE_TARGETS not set'),
     );
   });
 
+  test.each(['java', 'zip'])(
+    'fails before packaging when %s is not on PATH',
+    async (missing) => {
+      const log = jest.fn();
+      const veracode = makeFakeVeracode({
+        commandExists: jest.fn(async (cmd) => cmd !== missing),
+      });
+      const result = await runVeracodeScan({
+        vid: 'vid-1',
+        vkey: 'vkey-1',
+        targetsEnv: 'web:my-app:src',
+        veracode,
+        fsops: makeFakeFsops(),
+        log,
+      });
+
+      expect(result).toEqual({ exitCode: 1, skipped: false, results: [] });
+      expect(veracode.zip).not.toHaveBeenCalled();
+      expect(veracode.download).not.toHaveBeenCalled();
+      expect(log).toHaveBeenCalledWith(
+        expect.stringContaining(`${missing} is not on PATH`),
+      );
+    },
+  );
+
   test('runs VERACODE_BUILD_CMD before packaging when set', async () => {
     const veracode = makeFakeVeracode();
     const fsops = makeFakeFsops();

package/src/veracode/veracode.js

@@ -5,6 +5,18 @@ import { $ } from 'zx';
 // exit is meaningful data here (a failed build/zip/upload), not an
 // exceptional case.
 export const veracode = {
+  // The wrapper is a jar and packaging is done by `zip`, so this step — alone
+  // among the scan steps — depends on host tooling rather than a container
+  // image. Checked up front so a missing JRE reads as a missing JRE instead of
+  // surfacing as a failed upload several minutes later.
+  async commandExists(cmd) {
+    const result = await $({
+      nothrow: true,
+      quiet: true,
+    })`command -v ${cmd}`;
+    return result.exitCode === 0;
+  },
+
   async download(url, dest) {
     const result = await $({
       nothrow: true,