@docupace/pipeline 1.0.123-xray.3 → 1.0.124

package/bin/tenable-scan.sh

@@ -119,8 +119,8 @@ scan_one() {
     "--code-commit-hash" "${COMMIT}"
     "--code-commit-user" "${CODE_USER}"
     "--code-repository-url" "${CODE_REPO_URL}"
-    "--min-severity" "$(printf '%s' "${MIN_SEVERITY}" | tr 'A-Z' 'a-z')"
-    "--output-file-formats" "json,md,junit"
+    "--min-severity" "${MIN_SEVERITY}"
+    "--output-file-formats" "Json,Md,JUnit"
     "--output-path" "/tmp/tenable/out"
     "--output-file-name" "${slug}-tenable"
     "--no-color"
@@ -134,24 +134,15 @@ scan_one() {
     )
   fi
   if [[ -n "${TENABLE_FAIL_ON_MIN_SEVERITY:-}" ]]; then
-    scan_args+=("--fail-on-min-severity" "$(printf '%s' "${TENABLE_FAIL_ON_MIN_SEVERITY}" | tr 'A-Z' 'a-z')")
+    scan_args+=("--fail-on-min-severity" "${TENABLE_FAIL_ON_MIN_SEVERITY}")
   fi
 
   echo "Running Tenable scan for '${slug}' (min-severity=${MIN_SEVERITY}${TENABLE_FAIL_ON_MIN_SEVERITY:+, fail-on=${TENABLE_FAIL_ON_MIN_SEVERITY}})..."
-  # --entrypoint is not optional: Tenable's own GitHub action builds FROM this image
-  # solely to replace the entrypoint with a script that runs `tenable container-image
-  # scan "$@"`, so the image's own entrypoint is not that binary. Handing the
-  # subcommand to whatever it does start fails silently — exit 0, no output, no
-  # reports. The binary also takes its output destination from the environment (the
-  # action passes no --output-path flag at all), so it is set both ways.
   docker run --rm \
     --workdir /tmp/tenable \
     --volume "${work}:/tmp/tenable" \
     --env TENABLE_API_TOKEN \
     --env TENABLE_API_URL \
-    --env "TENABLE_OUTPUT_PATH=/tmp/tenable/out" \
-    --env "TENABLE_OUTPUT_FILE_NAME=${slug}-tenable" \
-    --entrypoint "${TENABLE_SCANNER_ENTRYPOINT:-tenable}" \
     --pull=always \
     "${SCANNER_IMAGE}" "${scan_args[@]}"
   local scan_exit=$?

package/bitbucket-pipelines.yml

@@ -8,11 +8,33 @@ definitions:
   caches:
     pnpm: ~/.pnpm-store
 
-  # Pipelines under `definitions.pipelines` are the ones other repos can pull in
-  # with `import: pipeline-shared-scripts:master:<name>`. Names under
-  # `pipelines.custom` below are local to this repo and are NOT importable.
+  steps:
+    - step: &version-step
+        runs-on:
+          - self.hosted
+          - linux.shell
+          - onprem
+        name: On Merge
+        script:
+          - npm config set //registry.npmjs.org/:_authToken $DOCUPACE_NPM_TOKEN
+          - pnpm install --frozen-lockfile
+          - export HOME=/tmp
+          - node src/changeset/cli.js version-commit-tag --install-latest
+
+  # Bitbucket's cross-repo `import: pipeline-shared-scripts:master:<name>`
+  # resolves against definitions.pipelines.<name> in the exporting repo, and
+  # extracts just that one target subtree — so each entry here must be fully
+  # self-contained: a YAML alias pointing at an anchor defined outside of it
+  # (in a sibling entry here, or anywhere else in this file) resolves to
+  # nothing once extracted in isolation, and the imported step comes back
+  # "empty, null, or missing" on the consumer side. Content needed in more
+  # than one of these (the Tenable step, the Sonar scan script) is therefore
+  # duplicated instead of shared via anchor/alias. pipelines.custom below
+  # aliases into these (safe: same-document, not crossing the export
+  # boundary) purely so this repo can also run each one manually from its
+  # own Pipelines UI.
   pipelines:
-    xray-scan: &xray-scan-pipeline
+    xray-scan: &def-xray-scan
       - step:
           name: JFrog Xray Scan (dependencies + Docker image)
           runs-on:
@@ -235,15 +257,15 @@ definitions:
           artifacts:
             - xray-report/**
 
-      - step: &tenable-scan-step
+      - step:
           name: Tenable Cloud Security Scan (container image)
           runs-on:
             - self.hosted
             - linux.shell
             - onprem
           script:
-            # bin/tenable-scan.sh lives in this shared repo; an import only brings
-            # the YAML across, so fetch it the same way the Xray step does.
+            # bin/tenable-scan.sh lives in this shared repo, but an import only
+            # brings the YAML across — so fetch it the same way the Xray step does.
             - |
               TENABLE_BIN=""
               if [ -f ./bin/tenable-scan.sh ]; then
@@ -289,8 +311,56 @@ definitions:
 
     # Runs the Tenable image scan on its own, for repos that want it separately
     # from the Xray scan: import: pipeline-shared-scripts:master:tenable-scan
-    tenable-scan:
-      - step: *tenable-scan-step
+    tenable-scan: &def-tenable-scan
+      - step:
+          name: Tenable Cloud Security Scan (container image)
+          runs-on:
+            - self.hosted
+            - linux.shell
+            - onprem
+          script:
+            - |
+              TENABLE_BIN=""
+              if [ -f ./bin/tenable-scan.sh ]; then
+                TENABLE_BIN=./bin
+              else
+                DEST=/tmp/pipeline-shared-scripts
+                rm -rf "${DEST}"
+                LABELS=""; URLS=""
+                add_src() { LABELS="${LABELS}${LABELS:+|}$1"; URLS="${URLS}${URLS:+|}$2"; }
+                [ -n "${SCRIPTS_REPO:-}" ] && add_src "SCRIPTS_REPO" "${SCRIPTS_REPO}"
+                if [ -n "${BITBUCKET_USERNAME:-}" ] && [ -n "${BITBUCKET_APP_PASSWORD:-}" ]; then
+                  add_src "BITBUCKET_USERNAME+APP_PASSWORD" "https://${BITBUCKET_USERNAME}:${BITBUCKET_APP_PASSWORD}@bitbucket.org/dp-cloud/pipeline-shared-scripts.git"
+                fi
+                [ -n "${BITBUCKET_STEP_OAUTH_TOKEN:-}" ] && add_src "step OAuth token" "https://x-token-auth:${BITBUCKET_STEP_OAUTH_TOKEN}@bitbucket.org/dp-cloud/pipeline-shared-scripts.git"
+                add_src "ssh" "git@bitbucket.org:dp-cloud/pipeline-shared-scripts.git"
+                i=1
+                while :; do
+                  label="$(printf '%s' "${LABELS}" | cut -d'|' -f${i})"
+                  url="$(printf '%s' "${URLS}" | cut -d'|' -f${i})"
+                  [ -z "${label}" ] && break
+                  echo "Fetching shared scripts via ${label}..."
+                  if GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="ssh -o StrictHostKeyChecking=accept-new -o BatchMode=yes" \
+                       git clone --depth 1 --quiet "${url}" "${DEST}" 2>/dev/null; then
+                    TENABLE_BIN="${DEST}/bin"
+                    echo "Fetched shared scripts via ${label}."
+                    break
+                  fi
+                  rm -rf "${DEST}"
+                  i=$((i + 1))
+                done
+              fi
+              if [ -z "${TENABLE_BIN}" ]; then
+                echo "Could not fetch shared scripts (tried: $(printf '%s' "${LABELS}" | tr '|' ' ')) — skipping Tenable scan."
+                exit 0
+              fi
+              if [ ! -f "${TENABLE_BIN}/tenable-scan.sh" ]; then
+                echo "tenable-scan.sh not present in ${TENABLE_BIN} — skipping Tenable scan."
+                exit 0
+              fi
+              bash "${TENABLE_BIN}/tenable-scan.sh"
+          artifacts:
+            - tenable-report/**
 
     # Uploads and scans one or more app targets with Veracode:
     # import: pipeline-shared-scripts:master:veracode-scan
@@ -300,7 +370,7 @@ definitions:
     #   (an app profile named <appname> must already exist in the Veracode portal)
     # Optional: VERACODE_BUILD_CMD — eval'd before packaging, so this step is
     #   self-contained and needs no separate build step in the consumer pipeline.
-    veracode-scan:
+    veracode-scan: &def-veracode-scan
       - step:
           name: Veracode Upload and Scan
           runs-on:
@@ -409,8 +479,8 @@ definitions:
     #
     # depth: full — Sonar reads git blame to attribute New Code; a shallow clone
     # only sees the tip commit and silently treats everything as new.
-    sonar-scan: &sonar-scan-pipeline
-      - step: &sonar-scan-step
+    sonar-scan: &def-sonar-scan
+      - step:
           name: SonarQube Scan
           runs-on:
             - self.hosted
@@ -424,7 +494,7 @@ definitions:
                 echo "Skipping SonarQube scan: SONAR_TOKEN not set"
                 exit 0
               fi
-            - &sonar-scan-script |
+            - |
               export DOCKER_HOST=""
               unset DOCKER_CONTEXT
               SONAR_HOST="${SONAR_HOST_URL:-https://sonarcloud.io}"
@@ -527,7 +597,7 @@ definitions:
     # Required: SONAR_TOKEN (hard-fails if unset and the gate applies to this PR)
     # Optional: same as sonar-scan, plus SONAR_GATE_BRANCH (default "main") and
     #   SONAR_QUALITYGATE_TIMEOUT (default 300 seconds).
-    sonar-pr-gate:
+    sonar-pr-gate: &def-sonar-pr-gate
       - step:
           name: SonarQube Quality Gate
           runs-on:
@@ -557,27 +627,106 @@ definitions:
               fi
 
               export SONAR_WAIT_FOR_GATE=true
-            - *sonar-scan-script
+            - |
+              export DOCKER_HOST=""
+              unset DOCKER_CONTEXT
+              SONAR_HOST="${SONAR_HOST_URL:-https://sonarcloud.io}"
+              DEFAULT_BRANCH="${SONAR_DEFAULT_BRANCH:-main}"
+              WORKDIR="$(pwd)"
 
-  steps:
-    - step: &version-step
-        runs-on:
-          - self.hosted
-          - linux.shell
-          - onprem
-        name: On Merge
-        script:
-          - npm config set //registry.npmjs.org/:_authToken $DOCUPACE_NPM_TOKEN
-          - pnpm install --frozen-lockfile
-          - export HOME=/tmp
-          - node src/changeset/cli.js version-commit-tag --install-latest
+              # Bitbucket's built-ins: BITBUCKET_BRANCH / BITBUCKET_PR_ID /
+              # BITBUCKET_PR_DESTINATION_BRANCH. An upload with no branch parameter
+              # is filed against the project's default branch, so scanning a
+              # feature branch without one would silently overwrite that branch's
+              # analysis and quality-gate status. Resolved once — every target in
+              # this run shares the same branch/PR context.
+              BRANCH="${BITBUCKET_BRANCH:-}"
+              PR_ID="${BITBUCKET_PR_ID:-}"
+              PR_BASE="${BITBUCKET_PR_DESTINATION_BRANCH:-}"
+              BRANCH_DOCKER_ARGS=""
+              BRANCH_SONAR_ARGS=""
+
+              if [ -n "${PR_ID}" ]; then
+                BRANCH_DOCKER_ARGS="-e PR_ID=${PR_ID}"
+                BRANCH_SONAR_ARGS="-Dsonar.pullrequest.key=${PR_ID}"
+                [ -n "${BRANCH}" ] && BRANCH_SONAR_ARGS="${BRANCH_SONAR_ARGS} -Dsonar.pullrequest.branch=${BRANCH}"
+                [ -n "${PR_BASE}" ] && BRANCH_SONAR_ARGS="${BRANCH_SONAR_ARGS} -Dsonar.pullrequest.base=${PR_BASE}"
+              elif [ -n "${BRANCH}" ] && [ "${BRANCH}" != "${DEFAULT_BRANCH}" ]; then
+                BRANCH_DOCKER_ARGS="-e BRANCH=${BRANCH}"
+                BRANCH_SONAR_ARGS="-Dsonar.branch.name=${BRANCH}"
+              elif [ -n "${BITBUCKET_TAG:-}" ] || [ "${BRANCH}" = "${DEFAULT_BRANCH}" ]; then
+                echo "Sonar: analysing as the default branch (${DEFAULT_BRANCH})"
+              else
+                echo "ERROR: cannot tell which branch this analysis belongs to — none of BITBUCKET_PR_ID, BITBUCKET_BRANCH or BITBUCKET_TAG is set." >&2
+                echo "       Refusing to upload: SonarCloud would file it against '${DEFAULT_BRANCH}' and overwrite that branch's analysis." >&2
+                exit 1
+              fi
+
+              if [ "${SONAR_WAIT_FOR_GATE:-false}" = "true" ]; then
+                BRANCH_SONAR_ARGS="${BRANCH_SONAR_ARGS} -Dsonar.qualitygate.wait=true -Dsonar.qualitygate.timeout=${SONAR_QUALITYGATE_TIMEOUT:-300}"
+              fi
+
+              # Looks up "${1}_<SLUG>" if set, else prints nothing — POSIX sh has no
+              # ${!indirect} expansion, so this shells out through eval instead.
+              target_var() {
+                eval "printf '%s' \"\${$1_${2}:-}\""
+              }
+
+              # Each target is its own SonarCloud project — like Veracode's per-app
+              # profiles, a repo with several components (frontend/backend) needs
+              # its own sonar.projectKey per component, not one shared analysis.
+              failed=0
+              OLD_IFS="${IFS}"
+              IFS=';'
+              set -- ${SONAR_TARGETS:-default:${SONAR_PROJECT_DIR:-.}}
+              IFS="${OLD_IFS}"
+
+              for target in "$@"; do
+                [ -z "${target}" ] && continue
+                label="$(printf '%s' "${target}" | cut -d: -f1)"
+                project_dir="$(printf '%s' "${target}" | cut -d: -f2)"
+                [ -z "${label}" ] && label="default"
+                [ -z "${project_dir}" ] && project_dir="."
+                slug="$(printf '%s' "${label}" | tr -c 'A-Za-z0-9' '_' | tr 'a-z' 'A-Z')"
+
+                coverage_cmd="$(target_var SONAR_COVERAGE_CMD "${slug}")"
+                [ -z "${coverage_cmd}" ] && coverage_cmd="${SONAR_COVERAGE_CMD:-}"
+                coverage_path="$(target_var SONAR_COVERAGE_REPORT_PATH "${slug}")"
+                [ -z "${coverage_path}" ] && coverage_path="${SONAR_COVERAGE_REPORT_PATH:-}"
+
+                if [ -n "${coverage_cmd}" ]; then
+                  echo "[${label}] Running coverage command..."
+                  eval "${coverage_cmd}" || echo "WARN: coverage command exited non-zero for '${label}'; checking for the report anyway."
+                fi
+                if [ -n "${coverage_path}" ] && [ ! -s "${coverage_path}" ]; then
+                  echo "ERROR: ${coverage_path} missing or empty for target '${label}' — Sonar would report 0% coverage." >&2
+                  failed=1
+                  continue
+                fi
+
+                DOCKER_ARGS="run --rm --platform linux/amd64 -e SONAR_HOST_URL=${SONAR_HOST} -e SONAR_TOKEN ${BRANCH_DOCKER_ARGS} -v ${WORKDIR}:/workspace -w /workspace/${project_dir}"
+                SONAR_ARGS="sonar-scanner -Dsonar.host.url=${SONAR_HOST} -Dproject.settings=/workspace/${project_dir}/sonar-project.properties ${BRANCH_SONAR_ARGS}"
+
+                echo "[${label}] Running: docker ${DOCKER_ARGS} sonarsource/sonar-scanner-cli:latest ${SONAR_ARGS}"
+                docker ${DOCKER_ARGS} sonarsource/sonar-scanner-cli:latest ${SONAR_ARGS} || {
+                  failed=1
+                  echo "ERROR: Sonar scan failed for target '${label}'." >&2
+                }
+              done
+
+              [ "${failed}" -ne 0 ] && exit 1
+              exit 0
 
 pipelines:
-  # Lets this repo run the shared scans against itself from the Bitbucket UI.
+  # These simply alias the definitions.pipelines entries above (safe:
+  # same-document reuse, not a cross-repo import) so this repo can also run
+  # each shared pipeline manually from its own Pipelines UI.
   custom:
-    xray-scan: *xray-scan-pipeline
-    tenable-scan:
-      - step: *tenable-scan-step
+    xray-scan: *def-xray-scan
+    tenable-scan: *def-tenable-scan
+    veracode-scan: *def-veracode-scan
+    sonar-scan: *def-sonar-scan
+    sonar-pr-gate: *def-sonar-pr-gate
 
   pull-requests:
     '**':
@@ -618,4 +767,4 @@ pipelines:
             - pnpm install --frozen-lockfile
             - 'npx eslint . --rule "no-unused-vars: warn" --rule "no-useless-escape: warn" --color'
             - pnpm test
-            - pnpm publish --no-git-checks
+            - pnpm publish --no-git-checks

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@docupace/pipeline",
-  "version": "1.0.123-xray.3",
+  "version": "1.0.124",
   "description": "",
   "main": "index.js",
   "type": "module",
@@ -12,10 +12,7 @@
     "dp-next-cli": "src/next/cli.js",
     "dp-auth0-cli": "src/auth0/cli.js",
     "dp-merge-cli": "src/merge/cli.js",
-    "dp-micro-cli": "src/micro/cli.js",
-    "dp-xray-cli": "src/xray/cli.js",
-    "dp-tenable-cli": "src/tenable/cli.js",
-    "dp-veracode-cli": "src/veracode/cli.js"
+    "dp-micro-cli": "src/micro/cli.js"
   },
   "keywords": [
     "bash"

package/src/changeset/canny.js

@@ -94,6 +94,10 @@ export async function uploadToCanny(releaseNote, labelIDs) {
 
     const body = JSON.stringify(bodyPayload);
 
+    console.log(
+      `📤 Posting to Canny: ${JSON.stringify({ ...bodyPayload, apiKey: undefined }, null, 2)}`,
+    );
+
     // Create a new changelog entry in Canny
     const createResponse = await fetch(
       'https://canny.io/api/v1/entries/create',

package/src/changeset/validate.js

@@ -1,24 +1,14 @@
 import fs from 'fs';
 import path from 'path';
-import { fileURLToPath } from 'url';
 import { $ } from 'zx';
 
 import { setGitInfo } from '../next/util.js';
 import { versionStatus } from './version.js';
 
-const PACKAGE_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
-const PACKAGE_VERSION = JSON.parse(
-  fs.readFileSync(path.join(PACKAGE_ROOT, 'package.json'), 'utf8'),
-).version;
-
 export async function validateChangesets() {
-  console.log(`validateChangesets: @docupace/pipeline version = ${PACKAGE_VERSION}`);
   await setGitInfo();
   const destBranch = process.env.BITBUCKET_PR_DESTINATION_BRANCH;
-  console.log(`validateChangesets: destBranch = ${destBranch}`);
-  console.log(`validateChangesets: fetching origin ${destBranch}:${destBranch}`);
   await $`git fetch origin ${destBranch}:${destBranch}`;
-  console.log('validateChangesets: fetch succeeded');
   let releases;
 
   try {

package/src/next/util.js

@@ -84,41 +84,12 @@ export async function getChangedAppPackages() {
   return appPackages;
 }
 
-function maskCreds(url) {
-  return url.replace(/:[^:@/]+@/, ':***@');
-}
-
 export async function setGitInfo() {
-  console.log(`setGitInfo: SET_GITOPS_USER=${process.env.SET_GITOPS_USER || '(unset)'}`);
   if (process.env.SET_GITOPS_USER) {
-    const before = (await $`git remote get-url origin`).stdout.trim();
-    console.log(`setGitInfo: origin before = ${maskCreds(before)}`);
-
     await $`git config --global user.email "gitops@docupace.com"`;
     await $`git config --global user.name "Gitops"`;
-
-    // Some self-hosted runners rewrite `git@bitbucket.org:` (SSH) to a bare,
-    // credential-less `https://bitbucket.org/` via a git `insteadOf` rule, so an
-    // SSH-form origin silently loses its identity at fetch/push time. Use an
-    // HTTPS URL with the token embedded instead — insteadOf doesn't touch it.
-    const token =
-      process.env.BITBUCKET_STEP_OAUTH_TOKEN || process.env.BITBUCKET_TOKEN;
-    if (!token) {
-      console.log(
-        'setGitInfo: no BITBUCKET_STEP_OAUTH_TOKEN/BITBUCKET_TOKEN available, leaving origin as-is',
-      );
-    } else {
-      const repoUrl = `https://x-token-auth:${token}@bitbucket.org/dp-cloud/${process.env.BITBUCKET_REPO_SLUG}.git`;
-      console.log(`Setting new origin: ${maskCreds(repoUrl)}`);
-      await $`git remote set-url origin ${repoUrl}`;
-    }
-
-    const after = (await $`git remote get-url origin`).stdout.trim();
-    console.log(`setGitInfo: origin after = ${maskCreds(after)}`);
-  } else {
-    const current = (await $`git remote get-url origin`).stdout.trim();
-    console.log(
-      `setGitInfo: SET_GITOPS_USER not set, leaving origin as-is = ${maskCreds(current)}`,
-    );
+    const repoUrl = `git@bitbucket.org:dp-cloud/${process.env.BITBUCKET_REPO_SLUG}.git`;
+    console.log(`Setting new origin: ${repoUrl}`);
+    await $`git remote set-url origin ${repoUrl}`;
   }
 }

package/pnpm-workspace.yaml

@@ -1,3 +0,0 @@
-allowBuilds:
-  esbuild: true
-  unrs-resolver: true

package/src/tenable/args.js

@@ -1,157 +0,0 @@
-// Pure parsing/formatting logic for the Tenable scan step, ported from
-// bin/tenable-scan.sh. No fs/docker calls here so it's unit-testable.
-
-// Mirrors `tr -c 'A-Za-z0-9._-' '-'`: every character outside that set is
-// replaced with '-' (no squeezing of consecutive replacements).
-export function slugify(label) {
-  return label.replace(/[^A-Za-z0-9._-]/g, '-');
-}
-
-// Splits `str` on `sep` into exactly `n` fields, folding any extra fields
-// into the last one — matching `read a b c d <<< "$str"` semantics, where a
-// trailing variable absorbs everything left over.
-function splitFixed(str, sep, n) {
-  const parts = str.split(sep);
-  if (parts.length <= n) {
-    return [...parts, ...Array(n - parts.length).fill('')];
-  }
-  return [...parts.slice(0, n - 1), parts.slice(n - 1).join(sep)];
-}
-
-// One "label:auditDir:buildContext:dockerfile" entry from SCAN_TARGETS.
-// auditDir belongs to the Xray step and is ignored here. A target with no
-// build context is returned with skipped: true rather than dropped, so the
-// caller can log why it was skipped (matching the bash script's behavior).
-export function parseScanTargets(scanTargetsStr) {
-  return (scanTargetsStr || '')
-    .split(';')
-    .map((t) => t.trim())
-    .filter(Boolean)
-    .map((raw) => {
-      const [rawLabel, , rawContext, rawDockerfile] = splitFixed(raw, ':', 4);
-      const label = rawLabel || 'app';
-      const slug = slugify(label);
-      if (!rawContext) {
-        return { label, slug, buildContext: '', dockerfile: '', skipped: true };
-      }
-      return {
-        label,
-        slug,
-        buildContext: rawContext,
-        dockerfile: rawDockerfile || `${rawContext}/Dockerfile`,
-        skipped: false,
-      };
-    });
-}
-
-export function defaultScanTargets(buildContext, dockerfilePath) {
-  const ctx = buildContext || '.';
-  return `app::${ctx}:${dockerfilePath || `${ctx}/Dockerfile`}`;
-}
-
-export function buildCodeMetadata({
-  commit = 'local',
-  branch = '',
-  prDestinationBranch = '',
-  workspace = 'unknown',
-  repoSlug = 'unknown',
-  gitAuthorName = '',
-} = {}) {
-  return {
-    shortSha: commit.slice(0, 7),
-    codeBranch: branch || prDestinationBranch || 'unknown',
-    codeRepoUrl: `https://bitbucket.org/${workspace}/${repoSlug}`,
-    codeUser: gitAuthorName || 'bitbucket-pipelines',
-  };
-}
-
-// The scanner requires --pipeline-run-url as soon as any pipeline flag is
-// supplied, so the trio (id/trigger/url) travels together or not at all —
-// includeInScanArgs tells the caller which case applies.
-export function buildPipelineRunInfo({
-  runId = '',
-  runTrigger = '',
-  runUrl = '',
-  prId = '',
-  buildNumber = '',
-  workspace = 'unknown',
-  repoSlug = 'unknown',
-} = {}) {
-  const resolvedRunId = runId || buildNumber || '';
-  const resolvedTrigger = runTrigger || (prId ? 'pull_request' : '') || 'push';
-  const resolvedUrl =
-    runUrl ||
-    (buildNumber
-      ? `https://bitbucket.org/${workspace}/${repoSlug}/pipelines/results/${buildNumber}`
-      : '');
-
-  return {
-    runId: resolvedRunId,
-    runTrigger: resolvedTrigger,
-    runUrl: resolvedUrl,
-    includeInScanArgs: Boolean(resolvedRunId) && Boolean(resolvedUrl),
-  };
-}
-
-// The scanner's documented vocabularies are lowercase — severities
-// information|low|medium|high|critical, formats cyclonedx|json|junit|md — and it
-// does not correct a case mismatch or complain about one: it just exports nothing.
-// Callers set these from env vars that read naturally capitalised ("Medium"), so
-// normalise here rather than making every caller remember.
-export function buildScanArgs({
-  slug,
-  scanTarget,
-  codeBranch,
-  commit,
-  codeUser,
-  codeRepoUrl,
-  minSeverity,
-  runInfo,
-  failOnMinSeverity = '',
-}) {
-  const args = [
-    'container-image',
-    'scan',
-    '--archive-path',
-    '/tmp/tenable/image.tar',
-    '--name',
-    scanTarget,
-    '--code-branch',
-    codeBranch,
-    '--code-commit-hash',
-    commit,
-    '--code-commit-user',
-    codeUser,
-    '--code-repository-url',
-    codeRepoUrl,
-    '--min-severity',
-    String(minSeverity).toLowerCase(),
-    '--output-file-formats',
-    'json,md,junit',
-    '--output-path',
-    '/tmp/tenable/out',
-    '--output-file-name',
-    `${slug}-tenable`,
-    '--no-color',
-  ];
-
-  if (runInfo?.includeInScanArgs) {
-    args.push(
-      '--pipeline-run-id',
-      runInfo.runId,
-      '--pipeline-run-trigger',
-      runInfo.runTrigger,
-      '--pipeline-run-url',
-      runInfo.runUrl,
-    );
-  }
-
-  if (failOnMinSeverity) {
-    args.push('--fail-on-min-severity', failOnMinSeverity.toLowerCase());
-  }
-
-  return args;
-}
-
-export const SEPARATOR =
-  '==============================================================';