@docupace/pipeline 1.0.127 → 1.0.130

package/src/veracode/scan.js

@@ -0,0 +1,145 @@
+import path from 'path';
+import {
+  buildUploadArgs,
+  buildVersion,
+  buildZipFilename,
+  parseVeracodeTargets,
+  shortSha as computeShortSha,
+} from './args.js';
+import { veracode as defaultVeracode } from './veracode.js';
+import { fsOps as defaultFsOps } from './fsops.js';
+
+export const DEFAULT_WRAPPER_JAR = 'veracode-wrapper/VeracodeJavaAPI.jar';
+export const DEFAULT_WRAPPER_URL =
+  'https://repo1.maven.org/maven2/com/veracode/vosp/api/wrappers/vosp-api-wrappers-java/26.3.19.0/vosp-api-wrappers-java-26.3.19.0.jar';
+
+// Zips one target's paths and submits them as their own uploadandscan call,
+// so one repo with several apps (e.g. a frontend and a backend) gets separate
+// Veracode profiles instead of one scan covering everything.
+export async function scanOne(target, ctx) {
+  const { vid, vkey, shortSha, wrapperJar, veracode, fsops, log } = ctx;
+  const { label, appname, paths, slug, skipped } = target;
+
+  if (skipped) {
+    log(
+      `Target '${label}' is missing an appname or paths in VERACODE_TARGETS — skipping.`,
+    );
+    return { label, slug, exitCode: 1 };
+  }
+
+  const zipFile = buildZipFilename(slug);
+  fsops.removeSync(zipFile);
+
+  const zipped = await veracode.zip(zipFile, paths);
+  if (!zipped.ok) {
+    log(`Failed to zip paths for '${label}' — skipping its Veracode scan.`);
+    fsops.removeSync(zipFile);
+    return { label, slug, exitCode: 1 };
+  }
+
+  const version = buildVersion(shortSha, label);
+  const args = buildUploadArgs({
+    vid,
+    vkey,
+    appname,
+    filepath: zipFile,
+    version,
+  });
+
+  const uploaded = await veracode.uploadAndScan(wrapperJar, args);
+  fsops.removeSync(zipFile);
+
+  if (!uploaded.ok) {
+    log(`ERROR: Veracode scan submission failed for '${label}'.`);
+    return { label, slug, exitCode: 1 };
+  }
+
+  return { label, slug, exitCode: 0 };
+}
+
+// Commands the step shells out to on the host, rather than inside a container.
+export const REQUIRED_COMMANDS = ['java', 'zip'];
+
+export async function runVeracodeScan({
+  vid = process.env.VERACODE_API_ID || '',
+  vkey = process.env.VERACODE_API_KEY || '',
+  targetsEnv = process.env.VERACODE_TARGETS || '',
+  requireCredentials = process.env.VERACODE_REQUIRE_CREDENTIALS === 'true',
+  buildCmd = process.env.VERACODE_BUILD_CMD || '',
+  commit = process.env.BITBUCKET_COMMIT || 'local',
+  wrapperJar = process.env.VERACODE_WRAPPER_JAR || DEFAULT_WRAPPER_JAR,
+  wrapperUrl = process.env.VERACODE_WRAPPER_URL || DEFAULT_WRAPPER_URL,
+  veracode = defaultVeracode,
+  fsops = defaultFsOps,
+  log = console.log,
+} = {}) {
+  // Absent credentials mean the repo or runner was never set up for Veracode,
+  // which is not the same thing as a broken configuration: skip, the way the
+  // Tenable step does, so a consumer can add the step before the credentials
+  // exist. VERACODE_REQUIRE_CREDENTIALS=true turns it back into a hard failure
+  // once a repo expects the scan to run on every build.
+  if (!vid || !vkey) {
+    if (requireCredentials) {
+      log(
+        'ERROR: VERACODE_API_ID / VERACODE_API_KEY not set and VERACODE_REQUIRE_CREDENTIALS=true — failing.',
+      );
+      return { exitCode: 1, skipped: false, results: [] };
+    }
+    log('VERACODE_API_ID / VERACODE_API_KEY not set — skipping Veracode scan.');
+    return { exitCode: 0, skipped: true, results: [] };
+  }
+
+  // Credentials present but no targets is a broken configuration, so this stays
+  // a hard failure however the credentials were supplied.
+  if (!targetsEnv) {
+    log('ERROR: VERACODE_TARGETS not set — cannot run Veracode scan.');
+    log(
+      '       Expected: label:appname:path1,path2,...[;label2:appname2:path1,...]',
+    );
+    return { exitCode: 1, skipped: false, results: [] };
+  }
+
+  for (const cmd of REQUIRED_COMMANDS) {
+    if (!(await veracode.commandExists(cmd))) {
+      log(
+        `ERROR: ${cmd} is not on PATH — the Veracode step packages and uploads with it.`,
+      );
+      return { exitCode: 1, skipped: false, results: [] };
+    }
+  }
+
+  // VERACODE_BUILD_CMD lets a consumer produce whatever build artifacts
+  // Veracode's SAST needs (compiled bundles, etc.) without a separate
+  // pre-build step in the consumer's own pipeline. Its exit code isn't
+  // gated on here, matching the pipeline step it's ported from — a failure
+  // will simply surface as a failed upload for every target below.
+  if (buildCmd) {
+    log('Running VERACODE_BUILD_CMD...');
+    await veracode.runBuildCmd(buildCmd);
+  }
+
+  // Cached across builds on self-hosted runners; downloaded once.
+  if (!fsops.exists(wrapperJar)) {
+    fsops.mkdirp(path.dirname(wrapperJar));
+    await veracode.download(wrapperUrl, wrapperJar);
+  }
+
+  const sha = computeShortSha(commit);
+  const results = [];
+  for (const target of parseVeracodeTargets(targetsEnv)) {
+    results.push(
+      await scanOne(target, {
+        vid,
+        vkey,
+        shortSha: sha,
+        wrapperJar,
+        veracode,
+        fsops,
+        log,
+      }),
+    );
+  }
+
+  const exitCode = results.some((r) => r.exitCode !== 0) ? 1 : 0;
+  return { exitCode, skipped: false, results };
+}

package/src/veracode/scan.test.js

@@ -0,0 +1,293 @@
+import { describe, expect, jest, test } from '@jest/globals';
+import { scanOne, runVeracodeScan, DEFAULT_WRAPPER_JAR } from './scan.js';
+
+function makeFakeVeracode(overrides = {}) {
+  return {
+    commandExists: jest.fn().mockResolvedValue(true),
+    download: jest.fn().mockResolvedValue({ ok: true }),
+    runBuildCmd: jest.fn().mockResolvedValue({ ok: true }),
+    zip: jest.fn().mockResolvedValue({ ok: true }),
+    uploadAndScan: jest.fn().mockResolvedValue({ ok: true }),
+    ...overrides,
+  };
+}
+
+function makeFakeFsops(overrides = {}) {
+  return {
+    exists: jest.fn().mockReturnValue(true),
+    mkdirp: jest.fn(),
+    removeSync: jest.fn(),
+    ...overrides,
+  };
+}
+
+const baseCtx = (overrides = {}) => ({
+  vid: 'vid-1',
+  vkey: 'vkey-1',
+  shortSha: 'abc1234',
+  wrapperJar: DEFAULT_WRAPPER_JAR,
+  veracode: makeFakeVeracode(),
+  fsops: makeFakeFsops(),
+  log: jest.fn(),
+  ...overrides,
+});
+
+describe('scanOne', () => {
+  test('zips, uploads and cleans up a normal target', async () => {
+    const veracode = makeFakeVeracode();
+    const fsops = makeFakeFsops();
+    const ctx = baseCtx({ veracode, fsops });
+
+    const result = await scanOne(
+      {
+        label: 'web',
+        slug: 'web',
+        appname: 'my-app',
+        paths: ['services/web'],
+        skipped: false,
+      },
+      ctx,
+    );
+
+    expect(result).toEqual({ label: 'web', slug: 'web', exitCode: 0 });
+    expect(veracode.zip).toHaveBeenCalledWith('veracode-web.zip', [
+      'services/web',
+    ]);
+    expect(veracode.uploadAndScan).toHaveBeenCalledWith(
+      DEFAULT_WRAPPER_JAR,
+      expect.arrayContaining([
+        '-appname',
+        'my-app',
+        '-version',
+        'sha-abc1234-web',
+      ]),
+    );
+    expect(fsops.removeSync).toHaveBeenCalledWith('veracode-web.zip');
+  });
+
+  test('skips a target missing an appname or paths', async () => {
+    const veracode = makeFakeVeracode();
+    const ctx = baseCtx({ veracode });
+
+    const result = await scanOne(
+      { label: 'web', slug: 'web', appname: '', paths: [], skipped: true },
+      ctx,
+    );
+
+    expect(result).toEqual({ label: 'web', slug: 'web', exitCode: 1 });
+    expect(veracode.zip).not.toHaveBeenCalled();
+  });
+
+  test('returns exitCode 1 and skips upload when zipping fails', async () => {
+    const veracode = makeFakeVeracode({
+      zip: jest.fn().mockResolvedValue({ ok: false }),
+    });
+    const fsops = makeFakeFsops();
+    const ctx = baseCtx({ veracode, fsops });
+
+    const result = await scanOne(
+      {
+        label: 'web',
+        slug: 'web',
+        appname: 'my-app',
+        paths: ['services/web'],
+        skipped: false,
+      },
+      ctx,
+    );
+
+    expect(result).toEqual({ label: 'web', slug: 'web', exitCode: 1 });
+    expect(veracode.uploadAndScan).not.toHaveBeenCalled();
+    expect(fsops.removeSync).toHaveBeenCalledWith('veracode-web.zip');
+  });
+
+  test('returns exitCode 1 when the upload fails, but still cleans up the zip', async () => {
+    const veracode = makeFakeVeracode({
+      uploadAndScan: jest.fn().mockResolvedValue({ ok: false }),
+    });
+    const fsops = makeFakeFsops();
+    const ctx = baseCtx({ veracode, fsops });
+
+    const result = await scanOne(
+      {
+        label: 'web',
+        slug: 'web',
+        appname: 'my-app',
+        paths: ['services/web'],
+        skipped: false,
+      },
+      ctx,
+    );
+
+    expect(result).toEqual({ label: 'web', slug: 'web', exitCode: 1 });
+    expect(fsops.removeSync).toHaveBeenCalledWith('veracode-web.zip');
+  });
+});
+
+describe('runVeracodeScan', () => {
+  test('skips without failing when credentials are missing', async () => {
+    const log = jest.fn();
+    const veracode = makeFakeVeracode();
+    const result = await runVeracodeScan({
+      vid: '',
+      vkey: '',
+      targetsEnv: 'web:my-app:src',
+      veracode,
+      log,
+    });
+
+    expect(result).toEqual({ exitCode: 0, skipped: true, results: [] });
+    expect(veracode.zip).not.toHaveBeenCalled();
+    expect(log).toHaveBeenCalledWith(
+      expect.stringContaining('VERACODE_API_ID / VERACODE_API_KEY not set'),
+    );
+  });
+
+  test('fails on missing credentials when VERACODE_REQUIRE_CREDENTIALS is set', async () => {
+    const log = jest.fn();
+    const result = await runVeracodeScan({
+      vid: '',
+      vkey: '',
+      targetsEnv: 'web:my-app:src',
+      requireCredentials: true,
+      veracode: makeFakeVeracode(),
+      log,
+    });
+
+    expect(result).toEqual({ exitCode: 1, skipped: false, results: [] });
+    expect(log).toHaveBeenCalledWith(
+      expect.stringContaining('VERACODE_REQUIRE_CREDENTIALS=true'),
+    );
+  });
+
+  test('fails fast when VERACODE_TARGETS is missing', async () => {
+    const log = jest.fn();
+    const result = await runVeracodeScan({
+      vid: 'vid-1',
+      vkey: 'vkey-1',
+      targetsEnv: '',
+      veracode: makeFakeVeracode(),
+      log,
+    });
+
+    expect(result).toEqual({ exitCode: 1, skipped: false, results: [] });
+    expect(log).toHaveBeenCalledWith(
+      expect.stringContaining('VERACODE_TARGETS not set'),
+    );
+  });
+
+  test.each(['java', 'zip'])(
+    'fails before packaging when %s is not on PATH',
+    async (missing) => {
+      const log = jest.fn();
+      const veracode = makeFakeVeracode({
+        commandExists: jest.fn(async (cmd) => cmd !== missing),
+      });
+      const result = await runVeracodeScan({
+        vid: 'vid-1',
+        vkey: 'vkey-1',
+        targetsEnv: 'web:my-app:src',
+        veracode,
+        fsops: makeFakeFsops(),
+        log,
+      });
+
+      expect(result).toEqual({ exitCode: 1, skipped: false, results: [] });
+      expect(veracode.zip).not.toHaveBeenCalled();
+      expect(veracode.download).not.toHaveBeenCalled();
+      expect(log).toHaveBeenCalledWith(
+        expect.stringContaining(`${missing} is not on PATH`),
+      );
+    },
+  );
+
+  test('runs VERACODE_BUILD_CMD before packaging when set', async () => {
+    const veracode = makeFakeVeracode();
+    const fsops = makeFakeFsops();
+
+    await runVeracodeScan({
+      vid: 'vid-1',
+      vkey: 'vkey-1',
+      targetsEnv: 'web:my-app:src',
+      buildCmd: 'npm run build',
+      veracode,
+      fsops,
+      log: jest.fn(),
+    });
+
+    expect(veracode.runBuildCmd).toHaveBeenCalledWith('npm run build');
+  });
+
+  test('downloads the wrapper jar only when not already cached', async () => {
+    const veracode = makeFakeVeracode();
+    const fsops = makeFakeFsops({ exists: jest.fn().mockReturnValue(false) });
+
+    await runVeracodeScan({
+      vid: 'vid-1',
+      vkey: 'vkey-1',
+      targetsEnv: 'web:my-app:src',
+      veracode,
+      fsops,
+      log: jest.fn(),
+    });
+
+    expect(veracode.download).toHaveBeenCalledWith(
+      expect.stringContaining('vosp-api-wrappers-java'),
+      DEFAULT_WRAPPER_JAR,
+    );
+  });
+
+  test('skips the download when the wrapper jar already exists', async () => {
+    const veracode = makeFakeVeracode();
+    const fsops = makeFakeFsops({ exists: jest.fn().mockReturnValue(true) });
+
+    await runVeracodeScan({
+      vid: 'vid-1',
+      vkey: 'vkey-1',
+      targetsEnv: 'web:my-app:src',
+      veracode,
+      fsops,
+      log: jest.fn(),
+    });
+
+    expect(veracode.download).not.toHaveBeenCalled();
+  });
+
+  test('scans every target and reports the worst outcome', async () => {
+    const veracode = makeFakeVeracode({
+      uploadAndScan: jest
+        .fn()
+        .mockResolvedValueOnce({ ok: true })
+        .mockResolvedValueOnce({ ok: false }),
+    });
+    const fsops = makeFakeFsops();
+
+    const result = await runVeracodeScan({
+      vid: 'vid-1',
+      vkey: 'vkey-1',
+      targetsEnv: 'web:my-app:apps/web;worker:my-worker:apps/worker',
+      veracode,
+      fsops,
+      log: jest.fn(),
+    });
+
+    expect(result.results.map((r) => r.label)).toEqual(['web', 'worker']);
+    expect(result.exitCode).toBe(1);
+  });
+
+  test('exits 0 when every target scans successfully', async () => {
+    const veracode = makeFakeVeracode();
+    const fsops = makeFakeFsops();
+
+    const result = await runVeracodeScan({
+      vid: 'vid-1',
+      vkey: 'vkey-1',
+      targetsEnv: 'web:my-app:apps/web',
+      veracode,
+      fsops,
+      log: jest.fn(),
+    });
+
+    expect(result.exitCode).toBe(0);
+  });
+});

package/src/veracode/veracode.js

@@ -0,0 +1,45 @@
+import { $ } from 'zx';
+
+// Thin wrappers around the external commands the Veracode step shells out to,
+// so scan.js can inject a fake in tests. Every call uses nothrow: a non-zero
+// exit is meaningful data here (a failed build/zip/upload), not an
+// exceptional case.
+export const veracode = {
+  // The wrapper is a jar and packaging is done by `zip`, so this step — alone
+  // among the scan steps — depends on host tooling rather than a container
+  // image. Checked up front so a missing JRE reads as a missing JRE instead of
+  // surfacing as a failed upload several minutes later.
+  async commandExists(cmd) {
+    const result = await $({
+      nothrow: true,
+      quiet: true,
+    })`command -v ${cmd}`;
+    return result.exitCode === 0;
+  },
+
+  async download(url, dest) {
+    const result = await $({
+      nothrow: true,
+      quiet: true,
+    })`curl -sSL ${url} -o ${dest}`;
+    return { ok: result.exitCode === 0 };
+  },
+
+  // Runs the consumer-supplied VERACODE_BUILD_CMD via `sh -c` so its own
+  // shell operators (&&, |, ...) are honored, mirroring the pipeline's
+  // `eval "${VERACODE_BUILD_CMD}"`.
+  async runBuildCmd(cmd) {
+    const result = await $({ nothrow: true })`sh -c ${cmd}`;
+    return { ok: result.exitCode === 0 };
+  },
+
+  async zip(zipFile, paths) {
+    const result = await $({ nothrow: true })`zip -r ${zipFile} ${paths}`;
+    return { ok: result.exitCode === 0 };
+  },
+
+  async uploadAndScan(jarPath, args) {
+    const result = await $({ nothrow: true })`java -jar ${jarPath} ${args}`;
+    return { ok: result.exitCode === 0 };
+  },
+};

package/src/xray/cli.js

@@ -0,0 +1,37 @@
+#!/usr/bin/env node
+
+import { Command } from 'commander';
+import { notify } from './notify.js';
+
+const program = new Command();
+
+program
+  .command('notify')
+  .description(
+    'Post Xray findings to Slack (parent summary + one thread reply per finding)',
+  )
+  .option(
+    '-f, --report-args-file <path>',
+    'Path to the "label:file" report-args file',
+  )
+  .option(
+    '-m, --min-severity <severity>',
+    'Lowest severity to thread (Critical|High|Medium|Low)',
+  )
+  .option('-c, --notify-clean', 'Post even when there are zero findings')
+  .action(async (options) => {
+    try {
+      await notify({
+        ...(options.reportArgsFile && {
+          reportArgsFile: options.reportArgsFile,
+        }),
+        ...(options.minSeverity && { minSeverity: options.minSeverity }),
+        ...(options.notifyClean && { notifyClean: true }),
+      });
+    } catch (error) {
+      console.error(error.message);
+      process.exit(1);
+    }
+  });
+
+program.parse(process.argv);

package/src/xray/notify.js

@@ -0,0 +1,107 @@
+import fs from 'fs';
+import {
+  extractFindings,
+  countBySeverity,
+  buildBuildLink,
+  buildParentPayload,
+  buildThreadPayload,
+  parseReportArgs,
+  rankOf,
+  sortBySeverity,
+} from './report.js';
+import { postMessage } from './slack.js';
+
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+// Orchestrates the full bin/xray.sh flow: read the report-args file, collect
+// findings from each simple-json scan file, post a Slack summary, then thread
+// one message per finding at or above minSeverity. Dependencies are
+// injectable so this can be unit tested without touching fs or the network.
+export async function notify({
+  reportArgsFile = process.env.XRAY_REPORT_ARGS_FILE || '/tmp/xray-report-args',
+  minSeverity = process.env.XRAY_SLACK_MIN_SEVERITY || 'High',
+  notifyClean = process.env.XRAY_SLACK_NOTIFY_CLEAN === 'true',
+  channel = process.env.XRAY_SLACK_CHANNEL,
+  token = process.env.XRAY_SLACK_TOKEN,
+  project = process.env.BITBUCKET_REPO_SLUG || 'unknown',
+  branch = process.env.BITBUCKET_BRANCH || '',
+  buildLink = buildBuildLink({
+    workspace: process.env.BITBUCKET_WORKSPACE,
+    repoSlug: process.env.BITBUCKET_REPO_SLUG,
+    buildNumber: process.env.BITBUCKET_BUILD_NUMBER,
+  }),
+  readFile = (path) => fs.readFileSync(path, 'utf8'),
+  post = postMessage,
+  log = console.log,
+  delay = sleep,
+} = {}) {
+  const minRank = rankOf(minSeverity);
+
+  let reportArgsContent;
+  try {
+    reportArgsContent = readFile(reportArgsFile);
+  } catch {
+    log(
+      `No scan results file at ${reportArgsFile} — skipping Slack notification.`,
+    );
+    return { posted: 0, skipped: true };
+  }
+
+  const findings = [];
+  for (const { label, file } of parseReportArgs(reportArgsContent)) {
+    let raw;
+    try {
+      raw = readFile(file);
+    } catch {
+      log(`Skipping ${label} (${file}): not produced or empty.`);
+      continue;
+    }
+    let data;
+    try {
+      data = JSON.parse(raw);
+    } catch {
+      log(`Skipping ${label} (${file}): not produced or empty.`);
+      continue;
+    }
+    findings.push(...extractFindings(data, label));
+  }
+
+  const counts = countBySeverity(findings);
+  log(
+    `📊 Counts: Critical=${counts.Critical}, High=${counts.High}, Medium=${counts.Medium}, Low=${counts.Low}, Total=${counts.total}`,
+  );
+
+  if (counts.total === 0 && !notifyClean) {
+    log('✅ No vulnerabilities found, skipping Slack notification.');
+    return { posted: 0, skipped: true };
+  }
+
+  const parentPayload = buildParentPayload({
+    channel,
+    project,
+    branch,
+    buildLink,
+    counts,
+  });
+  const parentResponse = await post(parentPayload, token);
+  const threadTs = parentResponse?.ts;
+
+  if (!threadTs) {
+    log('❌ Failed to create parent Slack message:');
+    log(JSON.stringify(parentResponse));
+    throw new Error('Failed to create parent Slack message');
+  }
+
+  log(`✅ Parent message created. thread_ts=${threadTs}`);
+
+  let posted = 0;
+  for (const finding of sortBySeverity(findings)) {
+    if (finding.rank > minRank) continue;
+    await post(buildThreadPayload({ channel, threadTs, finding }), token);
+    posted += 1;
+    await delay(100);
+  }
+
+  log(`✅ Posted ${posted} finding(s) to thread.`);
+  return { posted, skipped: false, threadTs };
+}