@docupace/pipeline 1.0.123-xray.3 → 1.0.123

package/src/veracode/veracode.js

@@ -1,45 +0,0 @@
-import { $ } from 'zx';
-
-// Thin wrappers around the external commands the Veracode step shells out to,
-// so scan.js can inject a fake in tests. Every call uses nothrow: a non-zero
-// exit is meaningful data here (a failed build/zip/upload), not an
-// exceptional case.
-export const veracode = {
-  // The wrapper is a jar and packaging is done by `zip`, so this step — alone
-  // among the scan steps — depends on host tooling rather than a container
-  // image. Checked up front so a missing JRE reads as a missing JRE instead of
-  // surfacing as a failed upload several minutes later.
-  async commandExists(cmd) {
-    const result = await $({
-      nothrow: true,
-      quiet: true,
-    })`command -v ${cmd}`;
-    return result.exitCode === 0;
-  },
-
-  async download(url, dest) {
-    const result = await $({
-      nothrow: true,
-      quiet: true,
-    })`curl -sSL ${url} -o ${dest}`;
-    return { ok: result.exitCode === 0 };
-  },
-
-  // Runs the consumer-supplied VERACODE_BUILD_CMD via `sh -c` so its own
-  // shell operators (&&, |, ...) are honored, mirroring the pipeline's
-  // `eval "${VERACODE_BUILD_CMD}"`.
-  async runBuildCmd(cmd) {
-    const result = await $({ nothrow: true })`sh -c ${cmd}`;
-    return { ok: result.exitCode === 0 };
-  },
-
-  async zip(zipFile, paths) {
-    const result = await $({ nothrow: true })`zip -r ${zipFile} ${paths}`;
-    return { ok: result.exitCode === 0 };
-  },
-
-  async uploadAndScan(jarPath, args) {
-    const result = await $({ nothrow: true })`java -jar ${jarPath} ${args}`;
-    return { ok: result.exitCode === 0 };
-  },
-};

package/src/xray/cli.js

@@ -1,37 +0,0 @@
-#!/usr/bin/env node
-
-import { Command } from 'commander';
-import { notify } from './notify.js';
-
-const program = new Command();
-
-program
-  .command('notify')
-  .description(
-    'Post Xray findings to Slack (parent summary + one thread reply per finding)',
-  )
-  .option(
-    '-f, --report-args-file <path>',
-    'Path to the "label:file" report-args file',
-  )
-  .option(
-    '-m, --min-severity <severity>',
-    'Lowest severity to thread (Critical|High|Medium|Low)',
-  )
-  .option('-c, --notify-clean', 'Post even when there are zero findings')
-  .action(async (options) => {
-    try {
-      await notify({
-        ...(options.reportArgsFile && {
-          reportArgsFile: options.reportArgsFile,
-        }),
-        ...(options.minSeverity && { minSeverity: options.minSeverity }),
-        ...(options.notifyClean && { notifyClean: true }),
-      });
-    } catch (error) {
-      console.error(error.message);
-      process.exit(1);
-    }
-  });
-
-program.parse(process.argv);

package/src/xray/notify.js

@@ -1,107 +0,0 @@
-import fs from 'fs';
-import {
-  extractFindings,
-  countBySeverity,
-  buildBuildLink,
-  buildParentPayload,
-  buildThreadPayload,
-  parseReportArgs,
-  rankOf,
-  sortBySeverity,
-} from './report.js';
-import { postMessage } from './slack.js';
-
-const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-
-// Orchestrates the full bin/xray.sh flow: read the report-args file, collect
-// findings from each simple-json scan file, post a Slack summary, then thread
-// one message per finding at or above minSeverity. Dependencies are
-// injectable so this can be unit tested without touching fs or the network.
-export async function notify({
-  reportArgsFile = process.env.XRAY_REPORT_ARGS_FILE || '/tmp/xray-report-args',
-  minSeverity = process.env.XRAY_SLACK_MIN_SEVERITY || 'High',
-  notifyClean = process.env.XRAY_SLACK_NOTIFY_CLEAN === 'true',
-  channel = process.env.XRAY_SLACK_CHANNEL,
-  token = process.env.XRAY_SLACK_TOKEN,
-  project = process.env.BITBUCKET_REPO_SLUG || 'unknown',
-  branch = process.env.BITBUCKET_BRANCH || '',
-  buildLink = buildBuildLink({
-    workspace: process.env.BITBUCKET_WORKSPACE,
-    repoSlug: process.env.BITBUCKET_REPO_SLUG,
-    buildNumber: process.env.BITBUCKET_BUILD_NUMBER,
-  }),
-  readFile = (path) => fs.readFileSync(path, 'utf8'),
-  post = postMessage,
-  log = console.log,
-  delay = sleep,
-} = {}) {
-  const minRank = rankOf(minSeverity);
-
-  let reportArgsContent;
-  try {
-    reportArgsContent = readFile(reportArgsFile);
-  } catch {
-    log(
-      `No scan results file at ${reportArgsFile} — skipping Slack notification.`,
-    );
-    return { posted: 0, skipped: true };
-  }
-
-  const findings = [];
-  for (const { label, file } of parseReportArgs(reportArgsContent)) {
-    let raw;
-    try {
-      raw = readFile(file);
-    } catch {
-      log(`Skipping ${label} (${file}): not produced or empty.`);
-      continue;
-    }
-    let data;
-    try {
-      data = JSON.parse(raw);
-    } catch {
-      log(`Skipping ${label} (${file}): not produced or empty.`);
-      continue;
-    }
-    findings.push(...extractFindings(data, label));
-  }
-
-  const counts = countBySeverity(findings);
-  log(
-    `📊 Counts: Critical=${counts.Critical}, High=${counts.High}, Medium=${counts.Medium}, Low=${counts.Low}, Total=${counts.total}`,
-  );
-
-  if (counts.total === 0 && !notifyClean) {
-    log('✅ No vulnerabilities found, skipping Slack notification.');
-    return { posted: 0, skipped: true };
-  }
-
-  const parentPayload = buildParentPayload({
-    channel,
-    project,
-    branch,
-    buildLink,
-    counts,
-  });
-  const parentResponse = await post(parentPayload, token);
-  const threadTs = parentResponse?.ts;
-
-  if (!threadTs) {
-    log('❌ Failed to create parent Slack message:');
-    log(JSON.stringify(parentResponse));
-    throw new Error('Failed to create parent Slack message');
-  }
-
-  log(`✅ Parent message created. thread_ts=${threadTs}`);
-
-  let posted = 0;
-  for (const finding of sortBySeverity(findings)) {
-    if (finding.rank > minRank) continue;
-    await post(buildThreadPayload({ channel, threadTs, finding }), token);
-    posted += 1;
-    await delay(100);
-  }
-
-  log(`✅ Posted ${posted} finding(s) to thread.`);
-  return { posted, skipped: false, threadTs };
-}

package/src/xray/notify.test.js

@@ -1,161 +0,0 @@
-import { describe, expect, jest, test } from '@jest/globals';
-import { notify } from './notify.js';
-
-function makeReadFile(files) {
-  return (path) => {
-    if (!(path in files)) {
-      const err = new Error(`ENOENT: ${path}`);
-      err.code = 'ENOENT';
-      throw err;
-    }
-    return files[path];
-  };
-}
-
-describe('notify', () => {
-  test('skips Slack entirely when the report-args file is missing', async () => {
-    const log = jest.fn();
-    const post = jest.fn();
-    const result = await notify({
-      reportArgsFile: '/tmp/does-not-exist',
-      readFile: makeReadFile({}),
-      post,
-      log,
-      delay: jest.fn(),
-    });
-
-    expect(result).toEqual({ posted: 0, skipped: true });
-    expect(post).not.toHaveBeenCalled();
-    expect(log).toHaveBeenCalledWith(
-      expect.stringContaining('No scan results file'),
-    );
-  });
-
-  test('skips a scan file that is missing or invalid JSON, continues with the rest', async () => {
-    const files = {
-      '/tmp/report-args':
-        'bad:xray-report/bad.json\ngood:xray-report/good.json\n',
-      'xray-report/bad.json': 'not json',
-      'xray-report/good.json': JSON.stringify({
-        vulnerabilities: [{ severity: 'Critical', issueId: 'X-1' }],
-      }),
-    };
-    const post = jest.fn().mockResolvedValue({ ts: '111.222' });
-    const log = jest.fn();
-
-    const result = await notify({
-      reportArgsFile: '/tmp/report-args',
-      readFile: makeReadFile(files),
-      post,
-      log,
-      delay: jest.fn(),
-      channel: '#c',
-      token: 'xoxb-x',
-    });
-
-    expect(log).toHaveBeenCalledWith(expect.stringContaining('Skipping bad'));
-    expect(result.posted).toBe(1);
-  });
-
-  test('does not notify Slack when there are zero findings and notifyClean is false', async () => {
-    const files = {
-      '/tmp/report-args': 'clean:xray-report/clean.json\n',
-      'xray-report/clean.json': JSON.stringify({}),
-    };
-    const post = jest.fn();
-
-    const result = await notify({
-      reportArgsFile: '/tmp/report-args',
-      readFile: makeReadFile(files),
-      post,
-      log: jest.fn(),
-      delay: jest.fn(),
-      notifyClean: false,
-    });
-
-    expect(result).toEqual({ posted: 0, skipped: true });
-    expect(post).not.toHaveBeenCalled();
-  });
-
-  test('posts a clean parent message when notifyClean is true even with zero findings', async () => {
-    const files = {
-      '/tmp/report-args': 'clean:xray-report/clean.json\n',
-      'xray-report/clean.json': JSON.stringify({}),
-    };
-    const post = jest.fn().mockResolvedValue({ ts: '111.222' });
-
-    const result = await notify({
-      reportArgsFile: '/tmp/report-args',
-      readFile: makeReadFile(files),
-      post,
-      log: jest.fn(),
-      delay: jest.fn(),
-      notifyClean: true,
-      channel: '#c',
-      token: 'xoxb-x',
-    });
-
-    expect(post).toHaveBeenCalledTimes(1);
-    expect(result).toEqual({ posted: 0, skipped: false, threadTs: '111.222' });
-  });
-
-  test('throws when Slack fails to create the parent message', async () => {
-    const files = {
-      '/tmp/report-args': 'scan:xray-report/x.json\n',
-      'xray-report/x.json': JSON.stringify({
-        vulnerabilities: [{ severity: 'Critical' }],
-      }),
-    };
-    const post = jest
-      .fn()
-      .mockResolvedValue({ ok: false, error: 'invalid_auth' });
-
-    await expect(
-      notify({
-        reportArgsFile: '/tmp/report-args',
-        readFile: makeReadFile(files),
-        post,
-        log: jest.fn(),
-        delay: jest.fn(),
-      }),
-    ).rejects.toThrow('Failed to create parent Slack message');
-  });
-
-  test('only threads findings at or above minSeverity, sorted Critical -> Low', async () => {
-    const files = {
-      '/tmp/report-args': 'scan:xray-report/x.json\n',
-      'xray-report/x.json': JSON.stringify({
-        vulnerabilities: [
-          { severity: 'Low', issueId: 'L-1' },
-          { severity: 'Critical', issueId: 'C-1' },
-          { severity: 'Medium', issueId: 'M-1' },
-        ],
-      }),
-    };
-    const post = jest
-      .fn()
-      .mockResolvedValueOnce({ ts: '111.222' }) // parent
-      .mockResolvedValue({ ts: '111.222' }); // thread replies
-    const delay = jest.fn().mockResolvedValue();
-
-    const result = await notify({
-      reportArgsFile: '/tmp/report-args',
-      readFile: makeReadFile(files),
-      post,
-      log: jest.fn(),
-      delay,
-      minSeverity: 'Medium',
-      channel: '#c',
-      token: 'xoxb-x',
-    });
-
-    // parent + Critical + Medium, Low excluded
-    expect(post).toHaveBeenCalledTimes(3);
-    expect(result.posted).toBe(2);
-    const threadedIds = post.mock.calls
-      .slice(1)
-      .map(([payload]) => payload.blocks[0].text.text);
-    expect(threadedIds[0]).toContain('*Critical*');
-    expect(threadedIds[1]).toContain('*Medium*');
-  });
-});

package/src/xray/report.js

@@ -1,194 +0,0 @@
-// Pure parsing/formatting logic for Xray findings, ported from bin/xray.sh's
-// jq pipeline. Kept dependency-free (no fs/network) so it's unit-testable.
-
-const SEVERITY_RANK = { Critical: 0, High: 1, Medium: 2, Low: 3 };
-
-export function rankOf(severity) {
-  return SEVERITY_RANK[severity] ?? 9;
-}
-
-const SCA_SECTIONS = [
-  ['vulnerabilities', 'Vulnerability'],
-  ['securityViolations', 'Security violation'],
-  ['licensesViolations', 'License violation'],
-  ['operationalRiskViolations', 'Operational risk'],
-];
-
-const CODE_SECTIONS = [
-  ['secrets', 'Secret'],
-  ['secretsViolations', 'Secret violation'],
-  ['sast', 'SAST'],
-  ['sastViolations', 'SAST violation'],
-  ['iac', 'IaC'],
-  ['iacViolations', 'IaC violation'],
-  ['maliciousCode', 'Malicious code'],
-];
-
-function scaRow(row, scan, kind) {
-  const severity = row.severity ?? 'Unknown';
-  const cvesAll = (row.cves ?? []).map((c) => c.cve).filter(Boolean);
-  return {
-    scan,
-    kind,
-    severity,
-    rank: rankOf(severity),
-    cve: cvesAll[0] ?? row.issueId ?? 'N/A',
-    cvesAll,
-    pkg: `${row.impactedPackageName ?? 'N/A'} ${row.impactedPackageVersion ?? ''}`,
-    fixed: (row.fixedVersions ?? []).join(', '),
-    directs: [
-      ...new Set((row.components ?? []).map((c) => c.name).filter(Boolean)),
-    ].join(', '),
-    path: '',
-    line: 0,
-  };
-}
-
-function codeRow(row, scan, kind) {
-  const severity = row.severity ?? 'Unknown';
-  return {
-    scan,
-    kind,
-    severity,
-    rank: rankOf(severity),
-    cve: row.ruleId ?? 'N/A',
-    cvesAll: [],
-    pkg: row.finding ?? row.scannerShortDescription ?? 'N/A',
-    fixed: '',
-    directs: '',
-    path: row.file ?? '',
-    line: row.startLine ?? 0,
-  };
-}
-
-// Flattens one simple-json scan report into the same per-finding record shape
-// bin/xray.sh's jq filter produced (one row per vulnerability/secret/etc).
-export function extractFindings(data, scanLabel) {
-  const findings = [];
-  for (const [key, kind] of SCA_SECTIONS) {
-    for (const row of data[key] ?? []) {
-      findings.push(scaRow(row, scanLabel, kind));
-    }
-  }
-  for (const [key, kind] of CODE_SECTIONS) {
-    for (const row of data[key] ?? []) {
-      findings.push(codeRow(row, scanLabel, kind));
-    }
-  }
-  return findings;
-}
-
-// Only Critical/High/Medium/Low are counted, matching the bash script's
-// count_sev — an "Unknown" severity finding is neither counted nor totaled.
-export function countBySeverity(findings) {
-  const counts = { Critical: 0, High: 0, Medium: 0, Low: 0 };
-  for (const f of findings) {
-    if (f.severity in counts) counts[f.severity] += 1;
-  }
-  const total = counts.Critical + counts.High + counts.Medium + counts.Low;
-  return { ...counts, total };
-}
-
-export function buildBuildLink({ workspace, repoSlug, buildNumber }) {
-  if (!workspace || !repoSlug || !buildNumber) return '';
-  return `https://bitbucket.org/${workspace}/${repoSlug}/pipelines/results/${buildNumber}`;
-}
-
-export function buildParentPayload({
-  channel,
-  project,
-  branch,
-  buildLink,
-  counts,
-}) {
-  const contextText = buildLink
-    ? `Detailed findings are in the thread below 👇  •  <${buildLink}|Pipeline run>`
-    : 'Detailed findings are in the thread below 👇';
-
-  return {
-    channel,
-    blocks: [
-      {
-        type: 'header',
-        text: { type: 'plain_text', text: '🚨 Xray Security Report' },
-      },
-      {
-        type: 'section',
-        text: {
-          type: 'mrkdwn',
-          text: `*Project:* ${project}${branch ? `  |  *Branch:* ${branch}` : ''}`,
-        },
-      },
-      {
-        type: 'section',
-        text: {
-          type: 'mrkdwn',
-          text: `🔴 *Critical:* ${counts.Critical}    🔥 *High:* ${counts.High}    🎃 *Medium:* ${counts.Medium}    👻 *Low:* ${counts.Low}`,
-        },
-      },
-      { type: 'context', elements: [{ type: 'mrkdwn', text: contextText }] },
-      { type: 'divider' },
-    ],
-  };
-}
-
-const SEVERITY_EMOJI = { Critical: '🔴', High: '🔥', Medium: '🎃' };
-const DEFAULT_EMOJI = '👻';
-const CVE_PATTERN = /^CVE-/;
-
-function nvdLink(id) {
-  return `<https://nvd.nist.gov/vuln/detail/${id}|${id}>`;
-}
-
-function idText(finding) {
-  if (finding.cvesAll.length > 0) {
-    return finding.cvesAll.map(nvdLink).join(', ');
-  }
-  return CVE_PATTERN.test(finding.cve) ? nvdLink(finding.cve) : finding.cve;
-}
-
-export function buildFindingText(finding) {
-  const emoji = SEVERITY_EMOJI[finding.severity] ?? DEFAULT_EMOJI;
-  let text =
-    `${emoji} *${finding.severity}* — ${finding.scan} (${finding.kind})` +
-    `\n*ID:* ${idText(finding)}` +
-    `\n*Component:* \`${finding.pkg}\``;
-  if (finding.fixed) text += `\n*Fixed in:* ${finding.fixed}`;
-  if (finding.directs) text += `\n*Via:* ${finding.directs}`;
-  if (finding.path) {
-    text += `\n*File:* \`${finding.path}${finding.line > 0 ? `:${finding.line}` : ''}\``;
-  }
-  return text;
-}
-
-export function buildThreadPayload({ channel, threadTs, finding }) {
-  return {
-    channel,
-    thread_ts: threadTs,
-    blocks: [
-      {
-        type: 'section',
-        text: { type: 'mrkdwn', text: buildFindingText(finding) },
-      },
-    ],
-  };
-}
-
-// Parses the "label:file" lines written by the scan step (one per completed
-// scan) into { label, file } pairs. Blank lines are skipped.
-export function parseReportArgs(content) {
-  return content
-    .split('\n')
-    .map((line) => line.trim())
-    .filter(Boolean)
-    .map((line) => {
-      const idx = line.indexOf(':');
-      return idx === -1
-        ? { label: line, file: '' }
-        : { label: line.slice(0, idx), file: line.slice(idx + 1) };
-    });
-}
-
-export function sortBySeverity(findings) {
-  return [...findings].sort((a, b) => a.rank - b.rank);
-}