@docupace/pipeline 1.0.123-xray.2 → 1.0.123

package/src/veracode/args.js

@@ -1,67 +0,0 @@
-// Pure parsing/formatting logic for the Veracode scan step, ported from the
-// veracode-scan step in bitbucket-pipelines.yml. No fs/process calls here so
-// it's unit-testable.
-
-// Mirrors `tr -c 'A-Za-z0-9._-' '-'`: every character outside that set is
-// replaced with '-' (no squeezing of consecutive replacements).
-export function slugify(label) {
-  return label.replace(/[^A-Za-z0-9._-]/g, '-');
-}
-
-// Mirrors `printf '%s' "${BITBUCKET_COMMIT:-local}" | cut -c1-7`.
-export function shortSha(commit = 'local') {
-  return (commit || 'local').slice(0, 7);
-}
-
-// One "label:appname:path1,path2,..." entry from VERACODE_TARGETS. Mirrors
-// `cut -d: -f1/-f2/-f3`: only the first three colon-delimited fields matter,
-// and a 4th+ field (e.g. a colon inside a path) is silently dropped rather
-// than folded into the paths field.
-export function parseVeracodeTargets(targetsStr) {
-  return (targetsStr || '')
-    .split(';')
-    .map((t) => t.trim())
-    .filter(Boolean)
-    .map((raw) => {
-      const [rawLabel = '', appname = '', pathsField = ''] = raw.split(':');
-      const label = rawLabel || 'app';
-      const slug = slugify(label);
-      const paths = pathsField.split(',').filter((p) => p.length > 0);
-
-      if (!appname || paths.length === 0) {
-        return { label, slug, appname, paths, skipped: true };
-      }
-      return { label, slug, appname, paths, skipped: false };
-    });
-}
-
-export function buildZipFilename(slug) {
-  return `veracode-${slug}.zip`;
-}
-
-export function buildVersion(sha, label) {
-  return `sha-${sha}-${label}`;
-}
-
-// -createprofile false — the app profile must already exist in the Veracode
-// portal. -autoscan true starts the scan once prescan passes.
-export function buildUploadArgs({ vid, vkey, appname, filepath, version }) {
-  return [
-    '-vid',
-    vid,
-    '-vkey',
-    vkey,
-    '-action',
-    'uploadandscan',
-    '-appname',
-    appname,
-    '-createprofile',
-    'false',
-    '-autoscan',
-    'true',
-    '-filepath',
-    filepath,
-    '-version',
-    version,
-  ];
-}

package/src/veracode/args.test.js

@@ -1,137 +0,0 @@
-import { describe, expect, test } from '@jest/globals';
-import {
-  slugify,
-  shortSha,
-  parseVeracodeTargets,
-  buildZipFilename,
-  buildVersion,
-  buildUploadArgs,
-} from './args.js';
-
-describe('slugify', () => {
-  test('replaces every non [A-Za-z0-9._-] character with a dash', () => {
-    expect(slugify('my app!')).toBe('my-app-');
-    expect(slugify('my/app')).toBe('my-app');
-    expect(slugify('already-safe_v1.2')).toBe('already-safe_v1.2');
-  });
-});
-
-describe('shortSha', () => {
-  test('truncates a commit sha to 7 characters', () => {
-    expect(shortSha('abcdef1234567')).toBe('abcdef1');
-  });
-
-  test('defaults to "local" when no commit is given', () => {
-    expect(shortSha()).toBe('local');
-    expect(shortSha('')).toBe('local');
-  });
-});
-
-describe('parseVeracodeTargets', () => {
-  test('parses label:appname:path1,path2 entries', () => {
-    const targets = parseVeracodeTargets(
-      'frontend:my-app-fe:apps/fe,libs/shared;backend:my-app-be:apps/be',
-    );
-
-    expect(targets).toEqual([
-      {
-        label: 'frontend',
-        slug: 'frontend',
-        appname: 'my-app-fe',
-        paths: ['apps/fe', 'libs/shared'],
-        skipped: false,
-      },
-      {
-        label: 'backend',
-        slug: 'backend',
-        appname: 'my-app-be',
-        paths: ['apps/be'],
-        skipped: false,
-      },
-    ]);
-  });
-
-  test('defaults an empty label to "app" and slugifies it', () => {
-    const [target] = parseVeracodeTargets(':my-app:src');
-    expect(target.label).toBe('app');
-    expect(target.slug).toBe('app');
-  });
-
-  test('marks a target with no appname as skipped', () => {
-    const [target] = parseVeracodeTargets('web::src');
-    expect(target).toEqual({
-      label: 'web',
-      slug: 'web',
-      appname: '',
-      paths: ['src'],
-      skipped: true,
-    });
-  });
-
-  test('marks a target with no paths as skipped', () => {
-    const [target] = parseVeracodeTargets('web:my-app:');
-    expect(target).toEqual({
-      label: 'web',
-      slug: 'web',
-      appname: 'my-app',
-      paths: [],
-      skipped: true,
-    });
-  });
-
-  test('drops a 4th+ colon-delimited field rather than folding it into paths', () => {
-    const [target] = parseVeracodeTargets('web:my-app:src:extra');
-    expect(target.paths).toEqual(['src']);
-  });
-
-  test('ignores blank entries between semicolons', () => {
-    expect(parseVeracodeTargets('web:my-app:src;;')).toHaveLength(1);
-  });
-
-  test('empty string produces no targets', () => {
-    expect(parseVeracodeTargets('')).toEqual([]);
-  });
-});
-
-describe('buildZipFilename', () => {
-  test('builds a "veracode-<slug>.zip" filename', () => {
-    expect(buildZipFilename('web')).toBe('veracode-web.zip');
-  });
-});
-
-describe('buildVersion', () => {
-  test('builds "sha-<sha>-<label>", using the raw label rather than its slug', () => {
-    expect(buildVersion('abc1234', 'my app')).toBe('sha-abc1234-my app');
-  });
-});
-
-describe('buildUploadArgs', () => {
-  test('builds the Veracode wrapper CLI args', () => {
-    expect(
-      buildUploadArgs({
-        vid: 'vid-1',
-        vkey: 'vkey-1',
-        appname: 'my-app',
-        filepath: 'veracode-web.zip',
-        version: 'sha-abc1234-web',
-      }),
-    ).toEqual([
-      '-vid',
-      'vid-1',
-      '-vkey',
-      'vkey-1',
-      '-action',
-      'uploadandscan',
-      '-appname',
-      'my-app',
-      '-createprofile',
-      'false',
-      '-autoscan',
-      'true',
-      '-filepath',
-      'veracode-web.zip',
-      '-version',
-      'sha-abc1234-web',
-    ]);
-  });
-});

package/src/veracode/cli.js

@@ -1,16 +0,0 @@
-#!/usr/bin/env node
-
-import { Command } from 'commander';
-import { runVeracodeScan } from './scan.js';
-
-const program = new Command();
-
-program
-  .command('scan')
-  .description('Upload and scan one or more app targets with Veracode')
-  .action(async () => {
-    const { exitCode } = await runVeracodeScan();
-    process.exit(exitCode);
-  });
-
-program.parse(process.argv);

package/src/veracode/fsops.js

@@ -1,7 +0,0 @@
-import fs from 'fs-extra';
-
-export const fsOps = {
-  exists: (p) => fs.existsSync(p),
-  mkdirp: (dir) => fs.mkdirpSync(dir),
-  removeSync: (p) => fs.removeSync(p),
-};

package/src/veracode/scan.js

@@ -1,120 +0,0 @@
-import path from 'path';
-import {
-  buildUploadArgs,
-  buildVersion,
-  buildZipFilename,
-  parseVeracodeTargets,
-  shortSha as computeShortSha,
-} from './args.js';
-import { veracode as defaultVeracode } from './veracode.js';
-import { fsOps as defaultFsOps } from './fsops.js';
-
-export const DEFAULT_WRAPPER_JAR = 'veracode-wrapper/VeracodeJavaAPI.jar';
-export const DEFAULT_WRAPPER_URL =
-  'https://repo1.maven.org/maven2/com/veracode/vosp/api/wrappers/vosp-api-wrappers-java/26.3.19.0/vosp-api-wrappers-java-26.3.19.0.jar';
-
-// Zips one target's paths and submits them as their own uploadandscan call,
-// so one repo with several apps (e.g. a frontend and a backend) gets separate
-// Veracode profiles instead of one scan covering everything.
-export async function scanOne(target, ctx) {
-  const { vid, vkey, shortSha, wrapperJar, veracode, fsops, log } = ctx;
-  const { label, appname, paths, slug, skipped } = target;
-
-  if (skipped) {
-    log(
-      `Target '${label}' is missing an appname or paths in VERACODE_TARGETS — skipping.`,
-    );
-    return { label, slug, exitCode: 1 };
-  }
-
-  const zipFile = buildZipFilename(slug);
-  fsops.removeSync(zipFile);
-
-  const zipped = await veracode.zip(zipFile, paths);
-  if (!zipped.ok) {
-    log(`Failed to zip paths for '${label}' — skipping its Veracode scan.`);
-    fsops.removeSync(zipFile);
-    return { label, slug, exitCode: 1 };
-  }
-
-  const version = buildVersion(shortSha, label);
-  const args = buildUploadArgs({
-    vid,
-    vkey,
-    appname,
-    filepath: zipFile,
-    version,
-  });
-
-  const uploaded = await veracode.uploadAndScan(wrapperJar, args);
-  fsops.removeSync(zipFile);
-
-  if (!uploaded.ok) {
-    log(`ERROR: Veracode scan submission failed for '${label}'.`);
-    return { label, slug, exitCode: 1 };
-  }
-
-  return { label, slug, exitCode: 0 };
-}
-
-export async function runVeracodeScan({
-  vid = process.env.VERACODE_API_ID || '',
-  vkey = process.env.VERACODE_API_KEY || '',
-  targetsEnv = process.env.VERACODE_TARGETS || '',
-  buildCmd = process.env.VERACODE_BUILD_CMD || '',
-  commit = process.env.BITBUCKET_COMMIT || 'local',
-  wrapperJar = process.env.VERACODE_WRAPPER_JAR || DEFAULT_WRAPPER_JAR,
-  wrapperUrl = process.env.VERACODE_WRAPPER_URL || DEFAULT_WRAPPER_URL,
-  veracode = defaultVeracode,
-  fsops = defaultFsOps,
-  log = console.log,
-} = {}) {
-  if (!vid || !vkey) {
-    log(
-      'ERROR: VERACODE_API_ID / VERACODE_API_KEY not set — cannot run Veracode scan.',
-    );
-    return { exitCode: 1, results: [] };
-  }
-  if (!targetsEnv) {
-    log('ERROR: VERACODE_TARGETS not set — cannot run Veracode scan.');
-    log(
-      '       Expected: label:appname:path1,path2,...[;label2:appname2:path1,...]',
-    );
-    return { exitCode: 1, results: [] };
-  }
-
-  // VERACODE_BUILD_CMD lets a consumer produce whatever build artifacts
-  // Veracode's SAST needs (compiled bundles, etc.) without a separate
-  // pre-build step in the consumer's own pipeline. Its exit code isn't
-  // gated on here, matching the pipeline step it's ported from — a failure
-  // will simply surface as a failed upload for every target below.
-  if (buildCmd) {
-    log('Running VERACODE_BUILD_CMD...');
-    await veracode.runBuildCmd(buildCmd);
-  }
-
-  // Cached across builds on self-hosted runners; downloaded once.
-  if (!fsops.exists(wrapperJar)) {
-    fsops.mkdirp(path.dirname(wrapperJar));
-    await veracode.download(wrapperUrl, wrapperJar);
-  }
-
-  const sha = computeShortSha(commit);
-  const results = [];
-  for (const target of parseVeracodeTargets(targetsEnv)) {
-    results.push(
-      await scanOne(target, {
-        vid,
-        vkey,
-        shortSha: sha,
-        wrapperJar,
-        veracode,
-        fsops,
-        log,
-      }),
-    );
-  }
-
-  const exitCode = results.some((r) => r.exitCode !== 0) ? 1 : 0;
-  return { exitCode, results };
-}

package/src/veracode/scan.test.js

@@ -1,246 +0,0 @@
-import { describe, expect, jest, test } from '@jest/globals';
-import { scanOne, runVeracodeScan, DEFAULT_WRAPPER_JAR } from './scan.js';
-
-function makeFakeVeracode(overrides = {}) {
-  return {
-    download: jest.fn().mockResolvedValue({ ok: true }),
-    runBuildCmd: jest.fn().mockResolvedValue({ ok: true }),
-    zip: jest.fn().mockResolvedValue({ ok: true }),
-    uploadAndScan: jest.fn().mockResolvedValue({ ok: true }),
-    ...overrides,
-  };
-}
-
-function makeFakeFsops(overrides = {}) {
-  return {
-    exists: jest.fn().mockReturnValue(true),
-    mkdirp: jest.fn(),
-    removeSync: jest.fn(),
-    ...overrides,
-  };
-}
-
-const baseCtx = (overrides = {}) => ({
-  vid: 'vid-1',
-  vkey: 'vkey-1',
-  shortSha: 'abc1234',
-  wrapperJar: DEFAULT_WRAPPER_JAR,
-  veracode: makeFakeVeracode(),
-  fsops: makeFakeFsops(),
-  log: jest.fn(),
-  ...overrides,
-});
-
-describe('scanOne', () => {
-  test('zips, uploads and cleans up a normal target', async () => {
-    const veracode = makeFakeVeracode();
-    const fsops = makeFakeFsops();
-    const ctx = baseCtx({ veracode, fsops });
-
-    const result = await scanOne(
-      {
-        label: 'web',
-        slug: 'web',
-        appname: 'my-app',
-        paths: ['services/web'],
-        skipped: false,
-      },
-      ctx,
-    );
-
-    expect(result).toEqual({ label: 'web', slug: 'web', exitCode: 0 });
-    expect(veracode.zip).toHaveBeenCalledWith('veracode-web.zip', [
-      'services/web',
-    ]);
-    expect(veracode.uploadAndScan).toHaveBeenCalledWith(
-      DEFAULT_WRAPPER_JAR,
-      expect.arrayContaining([
-        '-appname',
-        'my-app',
-        '-version',
-        'sha-abc1234-web',
-      ]),
-    );
-    expect(fsops.removeSync).toHaveBeenCalledWith('veracode-web.zip');
-  });
-
-  test('skips a target missing an appname or paths', async () => {
-    const veracode = makeFakeVeracode();
-    const ctx = baseCtx({ veracode });
-
-    const result = await scanOne(
-      { label: 'web', slug: 'web', appname: '', paths: [], skipped: true },
-      ctx,
-    );
-
-    expect(result).toEqual({ label: 'web', slug: 'web', exitCode: 1 });
-    expect(veracode.zip).not.toHaveBeenCalled();
-  });
-
-  test('returns exitCode 1 and skips upload when zipping fails', async () => {
-    const veracode = makeFakeVeracode({
-      zip: jest.fn().mockResolvedValue({ ok: false }),
-    });
-    const fsops = makeFakeFsops();
-    const ctx = baseCtx({ veracode, fsops });
-
-    const result = await scanOne(
-      {
-        label: 'web',
-        slug: 'web',
-        appname: 'my-app',
-        paths: ['services/web'],
-        skipped: false,
-      },
-      ctx,
-    );
-
-    expect(result).toEqual({ label: 'web', slug: 'web', exitCode: 1 });
-    expect(veracode.uploadAndScan).not.toHaveBeenCalled();
-    expect(fsops.removeSync).toHaveBeenCalledWith('veracode-web.zip');
-  });
-
-  test('returns exitCode 1 when the upload fails, but still cleans up the zip', async () => {
-    const veracode = makeFakeVeracode({
-      uploadAndScan: jest.fn().mockResolvedValue({ ok: false }),
-    });
-    const fsops = makeFakeFsops();
-    const ctx = baseCtx({ veracode, fsops });
-
-    const result = await scanOne(
-      {
-        label: 'web',
-        slug: 'web',
-        appname: 'my-app',
-        paths: ['services/web'],
-        skipped: false,
-      },
-      ctx,
-    );
-
-    expect(result).toEqual({ label: 'web', slug: 'web', exitCode: 1 });
-    expect(fsops.removeSync).toHaveBeenCalledWith('veracode-web.zip');
-  });
-});
-
-describe('runVeracodeScan', () => {
-  test('fails fast when credentials are missing', async () => {
-    const log = jest.fn();
-    const result = await runVeracodeScan({
-      vid: '',
-      vkey: '',
-      targetsEnv: 'web:my-app:src',
-      log,
-    });
-
-    expect(result).toEqual({ exitCode: 1, results: [] });
-    expect(log).toHaveBeenCalledWith(
-      expect.stringContaining('VERACODE_API_ID / VERACODE_API_KEY not set'),
-    );
-  });
-
-  test('fails fast when VERACODE_TARGETS is missing', async () => {
-    const log = jest.fn();
-    const result = await runVeracodeScan({
-      vid: 'vid-1',
-      vkey: 'vkey-1',
-      targetsEnv: '',
-      log,
-    });
-
-    expect(result).toEqual({ exitCode: 1, results: [] });
-    expect(log).toHaveBeenCalledWith(
-      expect.stringContaining('VERACODE_TARGETS not set'),
-    );
-  });
-
-  test('runs VERACODE_BUILD_CMD before packaging when set', async () => {
-    const veracode = makeFakeVeracode();
-    const fsops = makeFakeFsops();
-
-    await runVeracodeScan({
-      vid: 'vid-1',
-      vkey: 'vkey-1',
-      targetsEnv: 'web:my-app:src',
-      buildCmd: 'npm run build',
-      veracode,
-      fsops,
-      log: jest.fn(),
-    });
-
-    expect(veracode.runBuildCmd).toHaveBeenCalledWith('npm run build');
-  });
-
-  test('downloads the wrapper jar only when not already cached', async () => {
-    const veracode = makeFakeVeracode();
-    const fsops = makeFakeFsops({ exists: jest.fn().mockReturnValue(false) });
-
-    await runVeracodeScan({
-      vid: 'vid-1',
-      vkey: 'vkey-1',
-      targetsEnv: 'web:my-app:src',
-      veracode,
-      fsops,
-      log: jest.fn(),
-    });
-
-    expect(veracode.download).toHaveBeenCalledWith(
-      expect.stringContaining('vosp-api-wrappers-java'),
-      DEFAULT_WRAPPER_JAR,
-    );
-  });
-
-  test('skips the download when the wrapper jar already exists', async () => {
-    const veracode = makeFakeVeracode();
-    const fsops = makeFakeFsops({ exists: jest.fn().mockReturnValue(true) });
-
-    await runVeracodeScan({
-      vid: 'vid-1',
-      vkey: 'vkey-1',
-      targetsEnv: 'web:my-app:src',
-      veracode,
-      fsops,
-      log: jest.fn(),
-    });
-
-    expect(veracode.download).not.toHaveBeenCalled();
-  });
-
-  test('scans every target and reports the worst outcome', async () => {
-    const veracode = makeFakeVeracode({
-      uploadAndScan: jest
-        .fn()
-        .mockResolvedValueOnce({ ok: true })
-        .mockResolvedValueOnce({ ok: false }),
-    });
-    const fsops = makeFakeFsops();
-
-    const result = await runVeracodeScan({
-      vid: 'vid-1',
-      vkey: 'vkey-1',
-      targetsEnv: 'web:my-app:apps/web;worker:my-worker:apps/worker',
-      veracode,
-      fsops,
-      log: jest.fn(),
-    });
-
-    expect(result.results.map((r) => r.label)).toEqual(['web', 'worker']);
-    expect(result.exitCode).toBe(1);
-  });
-
-  test('exits 0 when every target scans successfully', async () => {
-    const veracode = makeFakeVeracode();
-    const fsops = makeFakeFsops();
-
-    const result = await runVeracodeScan({
-      vid: 'vid-1',
-      vkey: 'vkey-1',
-      targetsEnv: 'web:my-app:apps/web',
-      veracode,
-      fsops,
-      log: jest.fn(),
-    });
-
-    expect(result.exitCode).toBe(0);
-  });
-});

package/src/veracode/veracode.js

@@ -1,33 +0,0 @@
-import { $ } from 'zx';
-
-// Thin wrappers around the external commands the Veracode step shells out to,
-// so scan.js can inject a fake in tests. Every call uses nothrow: a non-zero
-// exit is meaningful data here (a failed build/zip/upload), not an
-// exceptional case.
-export const veracode = {
-  async download(url, dest) {
-    const result = await $({
-      nothrow: true,
-      quiet: true,
-    })`curl -sSL ${url} -o ${dest}`;
-    return { ok: result.exitCode === 0 };
-  },
-
-  // Runs the consumer-supplied VERACODE_BUILD_CMD via `sh -c` so its own
-  // shell operators (&&, |, ...) are honored, mirroring the pipeline's
-  // `eval "${VERACODE_BUILD_CMD}"`.
-  async runBuildCmd(cmd) {
-    const result = await $({ nothrow: true })`sh -c ${cmd}`;
-    return { ok: result.exitCode === 0 };
-  },
-
-  async zip(zipFile, paths) {
-    const result = await $({ nothrow: true })`zip -r ${zipFile} ${paths}`;
-    return { ok: result.exitCode === 0 };
-  },
-
-  async uploadAndScan(jarPath, args) {
-    const result = await $({ nothrow: true })`java -jar ${jarPath} ${args}`;
-    return { ok: result.exitCode === 0 };
-  },
-};

package/src/xray/cli.js

@@ -1,37 +0,0 @@
-#!/usr/bin/env node
-
-import { Command } from 'commander';
-import { notify } from './notify.js';
-
-const program = new Command();
-
-program
-  .command('notify')
-  .description(
-    'Post Xray findings to Slack (parent summary + one thread reply per finding)',
-  )
-  .option(
-    '-f, --report-args-file <path>',
-    'Path to the "label:file" report-args file',
-  )
-  .option(
-    '-m, --min-severity <severity>',
-    'Lowest severity to thread (Critical|High|Medium|Low)',
-  )
-  .option('-c, --notify-clean', 'Post even when there are zero findings')
-  .action(async (options) => {
-    try {
-      await notify({
-        ...(options.reportArgsFile && {
-          reportArgsFile: options.reportArgsFile,
-        }),
-        ...(options.minSeverity && { minSeverity: options.minSeverity }),
-        ...(options.notifyClean && { notifyClean: true }),
-      });
-    } catch (error) {
-      console.error(error.message);
-      process.exit(1);
-    }
-  });
-
-program.parse(process.argv);