@docupace/pipeline 1.0.123-xray.3 → 1.0.123

package/src/tenable/fsops.js

@@ -1,15 +0,0 @@
-import fs from 'fs-extra';
-import path from 'path';
-
-// The work dir is created inside the current directory (not os.tmpdir())
-// deliberately: it must be bind-mountable for docker, and on some hosts the
-// system temp dir is a symlink docker won't follow.
-export const fsOps = {
-  mkdtemp: () => fs.mkdtempSync(path.join(process.cwd(), '.tenable-work.')),
-  mkdirp: (dir) => fs.mkdirpSync(dir),
-  exists: (p) => fs.existsSync(p),
-  listDir: (dir) => (fs.existsSync(dir) ? fs.readdirSync(dir) : []),
-  copyReports: (from, to) => fs.copySync(from, to),
-  readFile: (p) => fs.readFileSync(p, 'utf8'),
-  removeSync: (p) => fs.removeSync(p),
-};

package/src/tenable/scan.js

@@ -1,284 +0,0 @@
-import {
-  buildCodeMetadata,
-  buildPipelineRunInfo,
-  buildScanArgs,
-  defaultScanTargets,
-  parseScanTargets,
-  SEPARATOR,
-} from './args.js';
-import { docker as defaultDocker } from './docker.js';
-import { fsOps as defaultFsOps } from './fsops.js';
-
-// Scans one target: builds (or reuses a pre-built) image, exports it to a
-// tar, and runs it through the scanner container, which has no access to the
-// host docker daemon so it can't resolve an image by name alone.
-export async function scanOne(target, ctx) {
-  const {
-    reportDir,
-    scannerImage,
-    scannerEntrypoint,
-    shortSha,
-    imageNamePrefix,
-    codeBranch,
-    commit,
-    codeUser,
-    codeRepoUrl,
-    minSeverity,
-    runInfo,
-    failOnMinSeverity,
-    docker,
-    fsops,
-    log,
-  } = ctx;
-  const { label, slug, buildContext, dockerfile, prebuiltImage } = target;
-
-  let scanTarget;
-  let builtImage = '';
-
-  if (prebuiltImage) {
-    scanTarget = prebuiltImage;
-    log(`Scanning pre-existing image ${scanTarget}`);
-  } else if (fsops.exists(dockerfile)) {
-    scanTarget = `${imageNamePrefix}-${slug}:tenable-${shortSha}`;
-    log(
-      `Building ${scanTarget} from ${dockerfile} (context ${buildContext})...`,
-    );
-    const useLoad = await docker.buildxAvailable();
-    const built = await docker.build([
-      buildContext,
-      '--file',
-      dockerfile,
-      '--tag',
-      scanTarget,
-      ...(useLoad ? ['--load'] : []),
-    ]);
-    if (!built.ok) {
-      log(`Docker build failed for '${slug}' — skipping its Tenable scan.`);
-      return { slug, exitCode: 1 };
-    }
-    builtImage = scanTarget;
-  } else {
-    log(`No Dockerfile at ${dockerfile} — nothing to scan for '${label}'.`);
-    return { slug, exitCode: 0, skipped: true };
-  }
-
-  const work = fsops.mkdtemp();
-
-  log(`Exporting ${scanTarget} to an archive...`);
-  const saved = await docker.save(scanTarget, `${work}/image.tar`);
-  if (!saved.ok) {
-    log(`docker save failed for '${slug}' — skipping its Tenable scan.`);
-    fsops.removeSync(work);
-    if (builtImage) await docker.rmi(builtImage);
-    return { slug, exitCode: 1 };
-  }
-
-  // --output-path must already exist; the scanner validates it before scanning.
-  fsops.mkdirp(`${work}/out`);
-
-  const scanArgs = buildScanArgs({
-    slug,
-    scanTarget,
-    codeBranch,
-    commit,
-    codeUser,
-    codeRepoUrl,
-    minSeverity,
-    runInfo,
-    failOnMinSeverity,
-  });
-
-  log(
-    `Running Tenable scan for '${slug}' (min-severity=${minSeverity}${
-      failOnMinSeverity ? `, fail-on=${failOnMinSeverity}` : ''
-    })...`,
-  );
-  const exitCode = await docker.run({
-    image: scannerImage,
-    args: scanArgs,
-    volume: `${work}:/tmp/tenable`,
-    workdir: '/tmp/tenable',
-    entrypoint: scannerEntrypoint,
-    // The output destination goes over BOTH transports on purpose. Tenable's own
-    // GitHub action passes output-path and output-file-name only as TENABLE_*
-    // env vars, never as flags, so a build of the scanner that ignores the flags
-    // would silently fall back to its default path (the working directory) and
-    // leave the reports where nothing looks for them.
-    env: [
-      'TENABLE_API_TOKEN',
-      'TENABLE_API_URL',
-      'TENABLE_OUTPUT_PATH=/tmp/tenable/out',
-      `TENABLE_OUTPUT_FILE_NAME=${slug}-tenable`,
-    ],
-  });
-
-  // Collect reports even on a non-zero exit — a threshold failure still produces them.
-  if (fsops.listDir(`${work}/out`).length > 0) {
-    fsops.mkdirp(reportDir);
-    fsops.copyReports(`${work}/out`, reportDir);
-  } else {
-    // Before declaring the scan reportless, look in the work root: that is the
-    // scanner's default output path, so anything it wrote while ignoring the
-    // requested one lands beside the archive — and the work dir is deleted a few
-    // lines below, taking the reports with it.
-    const stray = fsops
-      .listDir(work)
-      .filter((name) => name !== 'image.tar' && name !== 'out');
-    if (stray.length > 0) {
-      log(
-        `Tenable wrote to the work root rather than the requested output path: ${stray.join(', ')}`,
-      );
-      fsops.mkdirp(reportDir);
-      for (const name of stray) {
-        fsops.copyReports(`${work}/${name}`, `${reportDir}/${name}`);
-      }
-    } else {
-      // The scanner exits 0 and prints nothing when it rejects an output format,
-      // so an empty work dir is worth reporting with the exit code attached.
-      log(
-        `Tenable produced no report files for '${slug}' (scanner exit ${exitCode}).`,
-      );
-    }
-  }
-
-  const summaryPath = `${reportDir}/${slug}-tenable.md`;
-  if (fsops.exists(summaryPath)) {
-    log(`--- Tenable summary: ${slug} ---`);
-    log(fsops.readFile(summaryPath).split('\n').slice(0, 60).join('\n'));
-  }
-
-  fsops.removeSync(work);
-  if (builtImage) await docker.rmi(builtImage);
-
-  return { slug, exitCode };
-}
-
-export async function runTenableScan({
-  tenableApiToken = process.env.TENABLE_API_TOKEN,
-  tenableApiUrl = process.env.TENABLE_API_URL,
-  reportDir = process.env.TENABLE_REPORT_DIR || 'tenable-report',
-  scannerImage = process.env.TENABLE_SCANNER_IMAGE ||
-    'tenable/cloud-security-scanner:latest',
-  scannerEntrypoint = process.env.TENABLE_SCANNER_ENTRYPOINT || 'tenable',
-  minSeverity = process.env.TENABLE_MIN_SEVERITY || 'Medium',
-  failOnMinSeverity = process.env.TENABLE_FAIL_ON_MIN_SEVERITY || '',
-  tenableImage = process.env.TENABLE_IMAGE || '',
-  scanTargetsEnv = process.env.SCAN_TARGETS || '',
-  buildContextFallback = process.env.XRAY_BUILD_CONTEXT || '.',
-  dockerfileFallback = process.env.XRAY_DOCKERFILE_PATH || '',
-  commit = process.env.BITBUCKET_COMMIT || 'local',
-  branch = process.env.BITBUCKET_BRANCH || '',
-  prDestinationBranch = process.env.BITBUCKET_PR_DESTINATION_BRANCH || '',
-  workspace = process.env.BITBUCKET_WORKSPACE || 'unknown',
-  repoSlug = process.env.BITBUCKET_REPO_SLUG || 'unknown',
-  gitAuthorName = '',
-  prId = process.env.BITBUCKET_PR_ID || '',
-  buildNumber = process.env.BITBUCKET_BUILD_NUMBER || '',
-  runId = process.env.TENABLE_PIPELINE_RUN_ID || '',
-  runTrigger = process.env.TENABLE_PIPELINE_RUN_TRIGGER || '',
-  runUrl = process.env.TENABLE_PIPELINE_RUN_URL || '',
-  docker = defaultDocker,
-  fsops = defaultFsOps,
-  log = console.log,
-} = {}) {
-  if (!tenableApiToken || !tenableApiUrl) {
-    log('TENABLE_API_TOKEN / TENABLE_API_URL not set — skipping Tenable scan.');
-    return { exitCode: 0, skipped: true, results: [] };
-  }
-
-  const { shortSha, codeBranch, codeRepoUrl, codeUser } = buildCodeMetadata({
-    commit,
-    branch,
-    prDestinationBranch,
-    workspace,
-    repoSlug,
-    gitAuthorName,
-  });
-  const runInfo = buildPipelineRunInfo({
-    runId,
-    runTrigger,
-    runUrl,
-    prId,
-    buildNumber,
-    workspace,
-    repoSlug,
-  });
-
-  const scanCtx = {
-    reportDir,
-    scannerImage,
-    scannerEntrypoint,
-    shortSha,
-    imageNamePrefix: repoSlug,
-    codeBranch,
-    commit,
-    codeUser,
-    codeRepoUrl,
-    minSeverity,
-    runInfo,
-    failOnMinSeverity,
-    docker,
-    fsops,
-    log,
-  };
-
-  const results = [];
-
-  // TENABLE_IMAGE names an already-built image, which is inherently single-target.
-  if (tenableImage) {
-    results.push(
-      await scanOne(
-        { label: 'image', slug: 'image', prebuiltImage: tenableImage },
-        scanCtx,
-      ),
-    );
-  } else {
-    const targetsStr =
-      scanTargetsEnv ||
-      defaultScanTargets(buildContextFallback, dockerfileFallback);
-    if (!scanTargetsEnv) {
-      log(`SCAN_TARGETS not set — scanning a single target: ${targetsStr}`);
-    }
-
-    let scanned = 0;
-    for (const target of parseScanTargets(targetsStr)) {
-      if (target.skipped) {
-        log(
-          `Target '${target.label}' has no build context — skipping its image scan.`,
-        );
-        continue;
-      }
-      log(SEPARATOR);
-      log(`Tenable target '${target.label}'`);
-      log(SEPARATOR);
-      results.push(await scanOne(target, scanCtx));
-      scanned += 1;
-    }
-
-    if (scanned === 0) {
-      log('No scannable targets in SCAN_TARGETS — nothing to do.');
-    }
-  }
-
-  // Report the worst outcome across targets, so one clean app can't mask
-  // another's failure.
-  const exitCode = results.reduce(
-    (worst, r) => (r.exitCode !== 0 ? r.exitCode : worst),
-    0,
-  );
-
-  if (fsops.listDir(reportDir).length > 0) {
-    log(`Reports written to ${reportDir}/:`);
-    log(fsops.listDir(reportDir).join('\n'));
-  }
-
-  if (exitCode !== 0) {
-    log(
-      failOnMinSeverity
-        ? `Tenable scan exited ${exitCode} — findings at or above ${failOnMinSeverity}, or a scan itself failed.`
-        : `Tenable scan exited ${exitCode}.`,
-    );
-  }
-
-  return { exitCode, skipped: false, results };
-}

package/src/tenable/scan.test.js

@@ -1,355 +0,0 @@
-import { describe, expect, jest, test } from '@jest/globals';
-import { scanOne, runTenableScan } from './scan.js';
-
-function makeFakeDocker(overrides = {}) {
-  return {
-    buildxAvailable: jest.fn().mockResolvedValue(true),
-    build: jest.fn().mockResolvedValue({ ok: true }),
-    save: jest.fn().mockResolvedValue({ ok: true }),
-    run: jest.fn().mockResolvedValue(0),
-    rmi: jest.fn().mockResolvedValue(undefined),
-    ...overrides,
-  };
-}
-
-function makeFakeFsops(overrides = {}) {
-  return {
-    mkdtemp: jest.fn().mockReturnValue('/work/.tenable-work.abc'),
-    mkdirp: jest.fn(),
-    exists: jest.fn().mockReturnValue(false),
-    listDir: jest.fn().mockReturnValue([]),
-    copyReports: jest.fn(),
-    readFile: jest.fn().mockReturnValue(''),
-    removeSync: jest.fn(),
-    ...overrides,
-  };
-}
-
-const baseCtx = (overrides = {}) => ({
-  reportDir: 'tenable-report',
-  scannerImage: 'tenable/cloud-security-scanner:latest',
-  scannerEntrypoint: 'tenable',
-  shortSha: 'abc1234',
-  imageNamePrefix: 'my-repo',
-  codeBranch: 'main',
-  commit: 'abc1234567',
-  codeUser: 'Matt Fields',
-  codeRepoUrl: 'https://bitbucket.org/dp-cloud/my-repo',
-  minSeverity: 'Medium',
-  runInfo: { includeInScanArgs: false },
-  failOnMinSeverity: '',
-  docker: makeFakeDocker(),
-  fsops: makeFakeFsops(),
-  log: jest.fn(),
-  ...overrides,
-});
-
-describe('scanOne', () => {
-  test('builds, saves, scans and cleans up a normal target', async () => {
-    const docker = makeFakeDocker({ run: jest.fn().mockResolvedValue(0) });
-    const fsops = makeFakeFsops({
-      exists: jest.fn((p) => p === 'services/web/Dockerfile'),
-      listDir: jest.fn().mockReturnValue(['web-tenable.json']),
-    });
-    const ctx = baseCtx({ docker, fsops });
-
-    const result = await scanOne(
-      {
-        label: 'web',
-        slug: 'web',
-        buildContext: 'services/web',
-        dockerfile: 'services/web/Dockerfile',
-      },
-      ctx,
-    );
-
-    expect(result).toEqual({ slug: 'web', exitCode: 0 });
-    expect(docker.build).toHaveBeenCalledWith(
-      expect.arrayContaining([
-        'services/web',
-        '--file',
-        'services/web/Dockerfile',
-        '--tag',
-        'my-repo-web:tenable-abc1234',
-      ]),
-    );
-    expect(docker.save).toHaveBeenCalledWith(
-      'my-repo-web:tenable-abc1234',
-      expect.stringContaining('image.tar'),
-    );
-    expect(docker.run).toHaveBeenCalled();
-    expect(fsops.copyReports).toHaveBeenCalled();
-    expect(docker.rmi).toHaveBeenCalledWith('my-repo-web:tenable-abc1234');
-    expect(fsops.removeSync).toHaveBeenCalledWith('/work/.tenable-work.abc');
-  });
-
-  test('drives the scanner through the tenable binary, not the image entrypoint', async () => {
-    const docker = makeFakeDocker();
-    const ctx = baseCtx({ docker });
-
-    await scanOne(
-      { label: 'image', slug: 'image', prebuiltImage: 'my-image:tag' },
-      ctx,
-    );
-
-    const call = docker.run.mock.calls[0][0];
-    expect(call.entrypoint).toBe('tenable');
-    // The binary reads its output destination from the environment; the action
-    // that ships with the scanner passes no --output-path flag at all.
-    expect(call.env).toEqual(
-      expect.arrayContaining([
-        'TENABLE_OUTPUT_PATH=/tmp/tenable/out',
-        'TENABLE_OUTPUT_FILE_NAME=image-tenable',
-      ]),
-    );
-  });
-
-  test('scans a pre-built image without building or removing anything', async () => {
-    const docker = makeFakeDocker();
-    const fsops = makeFakeFsops();
-    const ctx = baseCtx({ docker, fsops });
-
-    const result = await scanOne(
-      { label: 'image', slug: 'image', prebuiltImage: 'my-image:tag' },
-      ctx,
-    );
-
-    expect(result.exitCode).toBe(0);
-    expect(docker.build).not.toHaveBeenCalled();
-    expect(docker.save).toHaveBeenCalledWith(
-      'my-image:tag',
-      expect.any(String),
-    );
-    expect(docker.rmi).not.toHaveBeenCalled();
-  });
-
-  test('recovers reports the scanner wrote to the work root instead of out/', async () => {
-    const work = '/work/.tenable-work.abc';
-    const fsops = makeFakeFsops({
-      listDir: jest.fn((dir) =>
-        dir === `${work}/out`
-          ? []
-          : ['image.tar', 'out', 'results.json', 'results.md'],
-      ),
-    });
-    const ctx = baseCtx({ fsops });
-
-    await scanOne(
-      { label: 'image', slug: 'image', prebuiltImage: 'my-image:tag' },
-      ctx,
-    );
-
-    // The archive and the empty output dir are not reports; everything else is.
-    expect(fsops.copyReports).toHaveBeenCalledTimes(2);
-    expect(fsops.copyReports).toHaveBeenCalledWith(
-      `${work}/results.json`,
-      'tenable-report/results.json',
-    );
-    expect(fsops.copyReports).toHaveBeenCalledWith(
-      `${work}/results.md`,
-      'tenable-report/results.md',
-    );
-  });
-
-  test('reports the scanner exit code when nothing was written anywhere', async () => {
-    const docker = makeFakeDocker({ run: jest.fn().mockResolvedValue(2) });
-    const fsops = makeFakeFsops({
-      listDir: jest.fn((dir) =>
-        dir === '/work/.tenable-work.abc/out' ? [] : ['image.tar'],
-      ),
-    });
-    const log = jest.fn();
-    const ctx = baseCtx({ docker, fsops, log });
-
-    await scanOne(
-      { label: 'image', slug: 'image', prebuiltImage: 'my-image:tag' },
-      ctx,
-    );
-
-    expect(fsops.copyReports).not.toHaveBeenCalled();
-    expect(log.mock.calls.flat().join('\n')).toContain(
-      "no report files for 'image' (scanner exit 2)",
-    );
-  });
-
-  test('skips a target with no Dockerfile at the expected path', async () => {
-    const docker = makeFakeDocker();
-    const fsops = makeFakeFsops({ exists: jest.fn().mockReturnValue(false) });
-    const ctx = baseCtx({ docker, fsops });
-
-    const result = await scanOne(
-      {
-        label: 'web',
-        slug: 'web',
-        buildContext: 'services/web',
-        dockerfile: 'services/web/Dockerfile',
-      },
-      ctx,
-    );
-
-    expect(result).toEqual({ slug: 'web', exitCode: 0, skipped: true });
-    expect(docker.build).not.toHaveBeenCalled();
-  });
-
-  test('returns exitCode 1 and skips the scan when the docker build fails', async () => {
-    const docker = makeFakeDocker({
-      build: jest.fn().mockResolvedValue({ ok: false }),
-    });
-    const fsops = makeFakeFsops({ exists: jest.fn().mockReturnValue(true) });
-    const ctx = baseCtx({ docker, fsops });
-
-    const result = await scanOne(
-      {
-        label: 'web',
-        slug: 'web',
-        buildContext: 'services/web',
-        dockerfile: 'services/web/Dockerfile',
-      },
-      ctx,
-    );
-
-    expect(result).toEqual({ slug: 'web', exitCode: 1 });
-    expect(docker.save).not.toHaveBeenCalled();
-  });
-
-  test('cleans up and returns exitCode 1 when docker save fails', async () => {
-    const docker = makeFakeDocker({
-      save: jest.fn().mockResolvedValue({ ok: false }),
-    });
-    const fsops = makeFakeFsops({ exists: jest.fn().mockReturnValue(true) });
-    const ctx = baseCtx({ docker, fsops });
-
-    const result = await scanOne(
-      {
-        label: 'web',
-        slug: 'web',
-        buildContext: 'services/web',
-        dockerfile: 'services/web/Dockerfile',
-      },
-      ctx,
-    );
-
-    expect(result).toEqual({ slug: 'web', exitCode: 1 });
-    expect(docker.run).not.toHaveBeenCalled();
-    expect(fsops.removeSync).toHaveBeenCalledWith('/work/.tenable-work.abc');
-    expect(docker.rmi).toHaveBeenCalledWith('my-repo-web:tenable-abc1234');
-  });
-
-  test('propagates a non-zero scanner exit code (e.g. fail-on-min-severity threshold)', async () => {
-    const docker = makeFakeDocker({ run: jest.fn().mockResolvedValue(3) });
-    const fsops = makeFakeFsops({ exists: jest.fn().mockReturnValue(true) });
-    const ctx = baseCtx({ docker, fsops });
-
-    const result = await scanOne(
-      {
-        label: 'web',
-        slug: 'web',
-        buildContext: 'services/web',
-        dockerfile: 'services/web/Dockerfile',
-      },
-      ctx,
-    );
-
-    expect(result.exitCode).toBe(3);
-  });
-});
-
-describe('runTenableScan', () => {
-  test('skips entirely when credentials are missing', async () => {
-    const log = jest.fn();
-    const result = await runTenableScan({
-      tenableApiToken: '',
-      tenableApiUrl: '',
-      log,
-    });
-    expect(result).toEqual({ exitCode: 0, skipped: true, results: [] });
-    expect(log).toHaveBeenCalledWith(
-      expect.stringContaining('not set — skipping'),
-    );
-  });
-
-  test('scans TENABLE_IMAGE directly, ignoring SCAN_TARGETS', async () => {
-    const docker = makeFakeDocker();
-    const fsops = makeFakeFsops();
-    const result = await runTenableScan({
-      tenableApiToken: 'token',
-      tenableApiUrl: 'https://tenable.example',
-      tenableImage: 'prebuilt:tag',
-      scanTargetsEnv: 'web:deps:services/web:Dockerfile',
-      docker,
-      fsops,
-      log: jest.fn(),
-    });
-
-    expect(result.exitCode).toBe(0);
-    expect(result.results).toHaveLength(1);
-    expect(docker.save).toHaveBeenCalledWith(
-      'prebuilt:tag',
-      expect.any(String),
-    );
-  });
-
-  test('scans every target in SCAN_TARGETS and reports the worst exit code', async () => {
-    const fsops = makeFakeFsops({ exists: jest.fn().mockReturnValue(true) });
-    const docker = makeFakeDocker({
-      run: jest.fn().mockResolvedValueOnce(0).mockResolvedValueOnce(2),
-    });
-
-    const result = await runTenableScan({
-      tenableApiToken: 'token',
-      tenableApiUrl: 'https://tenable.example',
-      scanTargetsEnv:
-        'web:deps:services/web:Dockerfile;worker:deps:services/worker:Dockerfile',
-      docker,
-      fsops,
-      log: jest.fn(),
-    });
-
-    expect(result.results.map((r) => r.slug)).toEqual(['web', 'worker']);
-    expect(result.exitCode).toBe(2);
-  });
-
-  test('logs and skips a target with no build context, without failing the run', async () => {
-    const log = jest.fn();
-    const fsops = makeFakeFsops({ exists: jest.fn().mockReturnValue(true) });
-    const docker = makeFakeDocker();
-
-    const result = await runTenableScan({
-      tenableApiToken: 'token',
-      tenableApiUrl: 'https://tenable.example',
-      scanTargetsEnv: 'web:deps::Dockerfile',
-      docker,
-      fsops,
-      log,
-    });
-
-    expect(result.exitCode).toBe(0);
-    expect(result.results).toHaveLength(0);
-    expect(log).toHaveBeenCalledWith(
-      expect.stringContaining('no build context'),
-    );
-    expect(log).toHaveBeenCalledWith(expect.stringContaining('nothing to do'));
-  });
-
-  test('falls back to a single default target when SCAN_TARGETS is unset', async () => {
-    const log = jest.fn();
-    const fsops = makeFakeFsops({ exists: jest.fn().mockReturnValue(true) });
-    const docker = makeFakeDocker();
-
-    const result = await runTenableScan({
-      tenableApiToken: 'token',
-      tenableApiUrl: 'https://tenable.example',
-      scanTargetsEnv: '',
-      buildContextFallback: '.',
-      dockerfileFallback: './Dockerfile',
-      docker,
-      fsops,
-      log,
-    });
-
-    expect(result.results).toEqual([{ slug: 'app', exitCode: 0 }]);
-    expect(log).toHaveBeenCalledWith(
-      expect.stringContaining('SCAN_TARGETS not set'),
-    );
-  });
-});