@docupace/pipeline 1.0.127 → 1.0.130

package/src/tenable/scan.test.js

@@ -0,0 +1,355 @@
+import { describe, expect, jest, test } from '@jest/globals';
+import { scanOne, runTenableScan } from './scan.js';
+
+function makeFakeDocker(overrides = {}) {
+  return {
+    buildxAvailable: jest.fn().mockResolvedValue(true),
+    build: jest.fn().mockResolvedValue({ ok: true }),
+    save: jest.fn().mockResolvedValue({ ok: true }),
+    run: jest.fn().mockResolvedValue(0),
+    rmi: jest.fn().mockResolvedValue(undefined),
+    ...overrides,
+  };
+}
+
+function makeFakeFsops(overrides = {}) {
+  return {
+    mkdtemp: jest.fn().mockReturnValue('/work/.tenable-work.abc'),
+    mkdirp: jest.fn(),
+    exists: jest.fn().mockReturnValue(false),
+    listDir: jest.fn().mockReturnValue([]),
+    copyReports: jest.fn(),
+    readFile: jest.fn().mockReturnValue(''),
+    removeSync: jest.fn(),
+    ...overrides,
+  };
+}
+
+const baseCtx = (overrides = {}) => ({
+  reportDir: 'tenable-report',
+  scannerImage: 'tenable/cloud-security-scanner:latest',
+  scannerEntrypoint: 'tenable',
+  shortSha: 'abc1234',
+  imageNamePrefix: 'my-repo',
+  codeBranch: 'main',
+  commit: 'abc1234567',
+  codeUser: 'Matt Fields',
+  codeRepoUrl: 'https://bitbucket.org/dp-cloud/my-repo',
+  minSeverity: 'Medium',
+  runInfo: { includeInScanArgs: false },
+  failOnMinSeverity: '',
+  docker: makeFakeDocker(),
+  fsops: makeFakeFsops(),
+  log: jest.fn(),
+  ...overrides,
+});
+
+describe('scanOne', () => {
+  test('builds, saves, scans and cleans up a normal target', async () => {
+    const docker = makeFakeDocker({ run: jest.fn().mockResolvedValue(0) });
+    const fsops = makeFakeFsops({
+      exists: jest.fn((p) => p === 'services/web/Dockerfile'),
+      listDir: jest.fn().mockReturnValue(['web-tenable.json']),
+    });
+    const ctx = baseCtx({ docker, fsops });
+
+    const result = await scanOne(
+      {
+        label: 'web',
+        slug: 'web',
+        buildContext: 'services/web',
+        dockerfile: 'services/web/Dockerfile',
+      },
+      ctx,
+    );
+
+    expect(result).toEqual({ slug: 'web', exitCode: 0 });
+    expect(docker.build).toHaveBeenCalledWith(
+      expect.arrayContaining([
+        'services/web',
+        '--file',
+        'services/web/Dockerfile',
+        '--tag',
+        'my-repo-web:tenable-abc1234',
+      ]),
+    );
+    expect(docker.save).toHaveBeenCalledWith(
+      'my-repo-web:tenable-abc1234',
+      expect.stringContaining('image.tar'),
+    );
+    expect(docker.run).toHaveBeenCalled();
+    expect(fsops.copyReports).toHaveBeenCalled();
+    expect(docker.rmi).toHaveBeenCalledWith('my-repo-web:tenable-abc1234');
+    expect(fsops.removeSync).toHaveBeenCalledWith('/work/.tenable-work.abc');
+  });
+
+  test('drives the scanner through the tenable binary, not the image entrypoint', async () => {
+    const docker = makeFakeDocker();
+    const ctx = baseCtx({ docker });
+
+    await scanOne(
+      { label: 'image', slug: 'image', prebuiltImage: 'my-image:tag' },
+      ctx,
+    );
+
+    const call = docker.run.mock.calls[0][0];
+    expect(call.entrypoint).toBe('tenable');
+    // The binary reads its output destination from the environment; the action
+    // that ships with the scanner passes no --output-path flag at all.
+    expect(call.env).toEqual(
+      expect.arrayContaining([
+        'TENABLE_OUTPUT_PATH=/tmp/tenable/out',
+        'TENABLE_OUTPUT_FILE_NAME=image-tenable',
+      ]),
+    );
+  });
+
+  test('scans a pre-built image without building or removing anything', async () => {
+    const docker = makeFakeDocker();
+    const fsops = makeFakeFsops();
+    const ctx = baseCtx({ docker, fsops });
+
+    const result = await scanOne(
+      { label: 'image', slug: 'image', prebuiltImage: 'my-image:tag' },
+      ctx,
+    );
+
+    expect(result.exitCode).toBe(0);
+    expect(docker.build).not.toHaveBeenCalled();
+    expect(docker.save).toHaveBeenCalledWith(
+      'my-image:tag',
+      expect.any(String),
+    );
+    expect(docker.rmi).not.toHaveBeenCalled();
+  });
+
+  test('recovers reports the scanner wrote to the work root instead of out/', async () => {
+    const work = '/work/.tenable-work.abc';
+    const fsops = makeFakeFsops({
+      listDir: jest.fn((dir) =>
+        dir === `${work}/out`
+          ? []
+          : ['image.tar', 'out', 'results.json', 'results.md'],
+      ),
+    });
+    const ctx = baseCtx({ fsops });
+
+    await scanOne(
+      { label: 'image', slug: 'image', prebuiltImage: 'my-image:tag' },
+      ctx,
+    );
+
+    // The archive and the empty output dir are not reports; everything else is.
+    expect(fsops.copyReports).toHaveBeenCalledTimes(2);
+    expect(fsops.copyReports).toHaveBeenCalledWith(
+      `${work}/results.json`,
+      'tenable-report/results.json',
+    );
+    expect(fsops.copyReports).toHaveBeenCalledWith(
+      `${work}/results.md`,
+      'tenable-report/results.md',
+    );
+  });
+
+  test('reports the scanner exit code when nothing was written anywhere', async () => {
+    const docker = makeFakeDocker({ run: jest.fn().mockResolvedValue(2) });
+    const fsops = makeFakeFsops({
+      listDir: jest.fn((dir) =>
+        dir === '/work/.tenable-work.abc/out' ? [] : ['image.tar'],
+      ),
+    });
+    const log = jest.fn();
+    const ctx = baseCtx({ docker, fsops, log });
+
+    await scanOne(
+      { label: 'image', slug: 'image', prebuiltImage: 'my-image:tag' },
+      ctx,
+    );
+
+    expect(fsops.copyReports).not.toHaveBeenCalled();
+    expect(log.mock.calls.flat().join('\n')).toContain(
+      "no report files for 'image' (scanner exit 2)",
+    );
+  });
+
+  test('skips a target with no Dockerfile at the expected path', async () => {
+    const docker = makeFakeDocker();
+    const fsops = makeFakeFsops({ exists: jest.fn().mockReturnValue(false) });
+    const ctx = baseCtx({ docker, fsops });
+
+    const result = await scanOne(
+      {
+        label: 'web',
+        slug: 'web',
+        buildContext: 'services/web',
+        dockerfile: 'services/web/Dockerfile',
+      },
+      ctx,
+    );
+
+    expect(result).toEqual({ slug: 'web', exitCode: 0, skipped: true });
+    expect(docker.build).not.toHaveBeenCalled();
+  });
+
+  test('returns exitCode 1 and skips the scan when the docker build fails', async () => {
+    const docker = makeFakeDocker({
+      build: jest.fn().mockResolvedValue({ ok: false }),
+    });
+    const fsops = makeFakeFsops({ exists: jest.fn().mockReturnValue(true) });
+    const ctx = baseCtx({ docker, fsops });
+
+    const result = await scanOne(
+      {
+        label: 'web',
+        slug: 'web',
+        buildContext: 'services/web',
+        dockerfile: 'services/web/Dockerfile',
+      },
+      ctx,
+    );
+
+    expect(result).toEqual({ slug: 'web', exitCode: 1 });
+    expect(docker.save).not.toHaveBeenCalled();
+  });
+
+  test('cleans up and returns exitCode 1 when docker save fails', async () => {
+    const docker = makeFakeDocker({
+      save: jest.fn().mockResolvedValue({ ok: false }),
+    });
+    const fsops = makeFakeFsops({ exists: jest.fn().mockReturnValue(true) });
+    const ctx = baseCtx({ docker, fsops });
+
+    const result = await scanOne(
+      {
+        label: 'web',
+        slug: 'web',
+        buildContext: 'services/web',
+        dockerfile: 'services/web/Dockerfile',
+      },
+      ctx,
+    );
+
+    expect(result).toEqual({ slug: 'web', exitCode: 1 });
+    expect(docker.run).not.toHaveBeenCalled();
+    expect(fsops.removeSync).toHaveBeenCalledWith('/work/.tenable-work.abc');
+    expect(docker.rmi).toHaveBeenCalledWith('my-repo-web:tenable-abc1234');
+  });
+
+  test('propagates a non-zero scanner exit code (e.g. fail-on-min-severity threshold)', async () => {
+    const docker = makeFakeDocker({ run: jest.fn().mockResolvedValue(3) });
+    const fsops = makeFakeFsops({ exists: jest.fn().mockReturnValue(true) });
+    const ctx = baseCtx({ docker, fsops });
+
+    const result = await scanOne(
+      {
+        label: 'web',
+        slug: 'web',
+        buildContext: 'services/web',
+        dockerfile: 'services/web/Dockerfile',
+      },
+      ctx,
+    );
+
+    expect(result.exitCode).toBe(3);
+  });
+});
+
+describe('runTenableScan', () => {
+  test('skips entirely when credentials are missing', async () => {
+    const log = jest.fn();
+    const result = await runTenableScan({
+      tenableApiToken: '',
+      tenableApiUrl: '',
+      log,
+    });
+    expect(result).toEqual({ exitCode: 0, skipped: true, results: [] });
+    expect(log).toHaveBeenCalledWith(
+      expect.stringContaining('not set — skipping'),
+    );
+  });
+
+  test('scans TENABLE_IMAGE directly, ignoring SCAN_TARGETS', async () => {
+    const docker = makeFakeDocker();
+    const fsops = makeFakeFsops();
+    const result = await runTenableScan({
+      tenableApiToken: 'token',
+      tenableApiUrl: 'https://tenable.example',
+      tenableImage: 'prebuilt:tag',
+      scanTargetsEnv: 'web:deps:services/web:Dockerfile',
+      docker,
+      fsops,
+      log: jest.fn(),
+    });
+
+    expect(result.exitCode).toBe(0);
+    expect(result.results).toHaveLength(1);
+    expect(docker.save).toHaveBeenCalledWith(
+      'prebuilt:tag',
+      expect.any(String),
+    );
+  });
+
+  test('scans every target in SCAN_TARGETS and reports the worst exit code', async () => {
+    const fsops = makeFakeFsops({ exists: jest.fn().mockReturnValue(true) });
+    const docker = makeFakeDocker({
+      run: jest.fn().mockResolvedValueOnce(0).mockResolvedValueOnce(2),
+    });
+
+    const result = await runTenableScan({
+      tenableApiToken: 'token',
+      tenableApiUrl: 'https://tenable.example',
+      scanTargetsEnv:
+        'web:deps:services/web:Dockerfile;worker:deps:services/worker:Dockerfile',
+      docker,
+      fsops,
+      log: jest.fn(),
+    });
+
+    expect(result.results.map((r) => r.slug)).toEqual(['web', 'worker']);
+    expect(result.exitCode).toBe(2);
+  });
+
+  test('logs and skips a target with no build context, without failing the run', async () => {
+    const log = jest.fn();
+    const fsops = makeFakeFsops({ exists: jest.fn().mockReturnValue(true) });
+    const docker = makeFakeDocker();
+
+    const result = await runTenableScan({
+      tenableApiToken: 'token',
+      tenableApiUrl: 'https://tenable.example',
+      scanTargetsEnv: 'web:deps::Dockerfile',
+      docker,
+      fsops,
+      log,
+    });
+
+    expect(result.exitCode).toBe(0);
+    expect(result.results).toHaveLength(0);
+    expect(log).toHaveBeenCalledWith(
+      expect.stringContaining('no build context'),
+    );
+    expect(log).toHaveBeenCalledWith(expect.stringContaining('nothing to do'));
+  });
+
+  test('falls back to a single default target when SCAN_TARGETS is unset', async () => {
+    const log = jest.fn();
+    const fsops = makeFakeFsops({ exists: jest.fn().mockReturnValue(true) });
+    const docker = makeFakeDocker();
+
+    const result = await runTenableScan({
+      tenableApiToken: 'token',
+      tenableApiUrl: 'https://tenable.example',
+      scanTargetsEnv: '',
+      buildContextFallback: '.',
+      dockerfileFallback: './Dockerfile',
+      docker,
+      fsops,
+      log,
+    });
+
+    expect(result.results).toEqual([{ slug: 'app', exitCode: 0 }]);
+    expect(log).toHaveBeenCalledWith(
+      expect.stringContaining('SCAN_TARGETS not set'),
+    );
+  });
+});

package/src/veracode/args.js

@@ -0,0 +1,67 @@
+// Pure parsing/formatting logic for the Veracode scan step, ported from the
+// veracode-scan step in bitbucket-pipelines.yml. No fs/process calls here so
+// it's unit-testable.
+
+// Mirrors `tr -c 'A-Za-z0-9._-' '-'`: every character outside that set is
+// replaced with '-' (no squeezing of consecutive replacements).
+export function slugify(label) {
+  return label.replace(/[^A-Za-z0-9._-]/g, '-');
+}
+
+// Mirrors `printf '%s' "${BITBUCKET_COMMIT:-local}" | cut -c1-7`.
+export function shortSha(commit = 'local') {
+  return (commit || 'local').slice(0, 7);
+}
+
+// One "label:appname:path1,path2,..." entry from VERACODE_TARGETS. Mirrors
+// `cut -d: -f1/-f2/-f3`: only the first three colon-delimited fields matter,
+// and a 4th+ field (e.g. a colon inside a path) is silently dropped rather
+// than folded into the paths field.
+export function parseVeracodeTargets(targetsStr) {
+  return (targetsStr || '')
+    .split(';')
+    .map((t) => t.trim())
+    .filter(Boolean)
+    .map((raw) => {
+      const [rawLabel = '', appname = '', pathsField = ''] = raw.split(':');
+      const label = rawLabel || 'app';
+      const slug = slugify(label);
+      const paths = pathsField.split(',').filter((p) => p.length > 0);
+
+      if (!appname || paths.length === 0) {
+        return { label, slug, appname, paths, skipped: true };
+      }
+      return { label, slug, appname, paths, skipped: false };
+    });
+}
+
+export function buildZipFilename(slug) {
+  return `veracode-${slug}.zip`;
+}
+
+export function buildVersion(sha, label) {
+  return `sha-${sha}-${label}`;
+}
+
+// -createprofile false — the app profile must already exist in the Veracode
+// portal. -autoscan true starts the scan once prescan passes.
+export function buildUploadArgs({ vid, vkey, appname, filepath, version }) {
+  return [
+    '-vid',
+    vid,
+    '-vkey',
+    vkey,
+    '-action',
+    'uploadandscan',
+    '-appname',
+    appname,
+    '-createprofile',
+    'false',
+    '-autoscan',
+    'true',
+    '-filepath',
+    filepath,
+    '-version',
+    version,
+  ];
+}

package/src/veracode/args.test.js

@@ -0,0 +1,137 @@
+import { describe, expect, test } from '@jest/globals';
+import {
+  slugify,
+  shortSha,
+  parseVeracodeTargets,
+  buildZipFilename,
+  buildVersion,
+  buildUploadArgs,
+} from './args.js';
+
+describe('slugify', () => {
+  test('replaces every non [A-Za-z0-9._-] character with a dash', () => {
+    expect(slugify('my app!')).toBe('my-app-');
+    expect(slugify('my/app')).toBe('my-app');
+    expect(slugify('already-safe_v1.2')).toBe('already-safe_v1.2');
+  });
+});
+
+describe('shortSha', () => {
+  test('truncates a commit sha to 7 characters', () => {
+    expect(shortSha('abcdef1234567')).toBe('abcdef1');
+  });
+
+  test('defaults to "local" when no commit is given', () => {
+    expect(shortSha()).toBe('local');
+    expect(shortSha('')).toBe('local');
+  });
+});
+
+describe('parseVeracodeTargets', () => {
+  test('parses label:appname:path1,path2 entries', () => {
+    const targets = parseVeracodeTargets(
+      'frontend:my-app-fe:apps/fe,libs/shared;backend:my-app-be:apps/be',
+    );
+
+    expect(targets).toEqual([
+      {
+        label: 'frontend',
+        slug: 'frontend',
+        appname: 'my-app-fe',
+        paths: ['apps/fe', 'libs/shared'],
+        skipped: false,
+      },
+      {
+        label: 'backend',
+        slug: 'backend',
+        appname: 'my-app-be',
+        paths: ['apps/be'],
+        skipped: false,
+      },
+    ]);
+  });
+
+  test('defaults an empty label to "app" and slugifies it', () => {
+    const [target] = parseVeracodeTargets(':my-app:src');
+    expect(target.label).toBe('app');
+    expect(target.slug).toBe('app');
+  });
+
+  test('marks a target with no appname as skipped', () => {
+    const [target] = parseVeracodeTargets('web::src');
+    expect(target).toEqual({
+      label: 'web',
+      slug: 'web',
+      appname: '',
+      paths: ['src'],
+      skipped: true,
+    });
+  });
+
+  test('marks a target with no paths as skipped', () => {
+    const [target] = parseVeracodeTargets('web:my-app:');
+    expect(target).toEqual({
+      label: 'web',
+      slug: 'web',
+      appname: 'my-app',
+      paths: [],
+      skipped: true,
+    });
+  });
+
+  test('drops a 4th+ colon-delimited field rather than folding it into paths', () => {
+    const [target] = parseVeracodeTargets('web:my-app:src:extra');
+    expect(target.paths).toEqual(['src']);
+  });
+
+  test('ignores blank entries between semicolons', () => {
+    expect(parseVeracodeTargets('web:my-app:src;;')).toHaveLength(1);
+  });
+
+  test('empty string produces no targets', () => {
+    expect(parseVeracodeTargets('')).toEqual([]);
+  });
+});
+
+describe('buildZipFilename', () => {
+  test('builds a "veracode-<slug>.zip" filename', () => {
+    expect(buildZipFilename('web')).toBe('veracode-web.zip');
+  });
+});
+
+describe('buildVersion', () => {
+  test('builds "sha-<sha>-<label>", using the raw label rather than its slug', () => {
+    expect(buildVersion('abc1234', 'my app')).toBe('sha-abc1234-my app');
+  });
+});
+
+describe('buildUploadArgs', () => {
+  test('builds the Veracode wrapper CLI args', () => {
+    expect(
+      buildUploadArgs({
+        vid: 'vid-1',
+        vkey: 'vkey-1',
+        appname: 'my-app',
+        filepath: 'veracode-web.zip',
+        version: 'sha-abc1234-web',
+      }),
+    ).toEqual([
+      '-vid',
+      'vid-1',
+      '-vkey',
+      'vkey-1',
+      '-action',
+      'uploadandscan',
+      '-appname',
+      'my-app',
+      '-createprofile',
+      'false',
+      '-autoscan',
+      'true',
+      '-filepath',
+      'veracode-web.zip',
+      '-version',
+      'sha-abc1234-web',
+    ]);
+  });
+});

package/src/veracode/cli.js

@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+
+import { Command } from 'commander';
+import { runVeracodeScan } from './scan.js';
+
+const program = new Command();
+
+program
+  .command('scan')
+  .description('Upload and scan one or more app targets with Veracode')
+  .action(async () => {
+    const { exitCode } = await runVeracodeScan();
+    process.exit(exitCode);
+  });
+
+program.parse(process.argv);

package/src/veracode/fsops.js

@@ -0,0 +1,7 @@
+import fs from 'fs-extra';
+
+export const fsOps = {
+  exists: (p) => fs.existsSync(p),
+  mkdirp: (dir) => fs.mkdirpSync(dir),
+  removeSync: (p) => fs.removeSync(p),
+};