@docupace/pipeline 1.0.128 → 1.0.131

package/src/tenable/args.test.js

@@ -0,0 +1,226 @@
+import { describe, expect, test } from '@jest/globals';
+import {
+  slugify,
+  parseScanTargets,
+  defaultScanTargets,
+  buildCodeMetadata,
+  buildPipelineRunInfo,
+  buildScanArgs,
+} from './args.js';
+
+describe('slugify', () => {
+  test('replaces every non [A-Za-z0-9._-] character with a dash', () => {
+    expect(slugify('my app!')).toBe('my-app-');
+    expect(slugify('my/app')).toBe('my-app');
+    expect(slugify('already-safe_v1.2')).toBe('already-safe_v1.2');
+  });
+});
+
+describe('parseScanTargets', () => {
+  test('parses label:auditDir:context:dockerfile entries, ignoring auditDir', () => {
+    const targets = parseScanTargets(
+      'web:deps:services/web:services/web/Dockerfile.prod;worker::services/worker:',
+    );
+
+    expect(targets).toEqual([
+      {
+        label: 'web',
+        slug: 'web',
+        buildContext: 'services/web',
+        dockerfile: 'services/web/Dockerfile.prod',
+        skipped: false,
+      },
+      {
+        label: 'worker',
+        slug: 'worker',
+        buildContext: 'services/worker',
+        dockerfile: 'services/worker/Dockerfile',
+        skipped: false,
+      },
+    ]);
+  });
+
+  test('defaults an empty label to "app" and slugifies it', () => {
+    const [target] = parseScanTargets(':deps:ctx:Dockerfile');
+    expect(target.label).toBe('app');
+    expect(target.slug).toBe('app');
+  });
+
+  test('marks a target with no build context as skipped', () => {
+    const [target] = parseScanTargets('web:deps::Dockerfile');
+    expect(target).toEqual({
+      label: 'web',
+      slug: 'web',
+      buildContext: '',
+      dockerfile: '',
+      skipped: true,
+    });
+  });
+
+  test('ignores blank entries between semicolons', () => {
+    expect(parseScanTargets('web:deps:ctx:Dockerfile;;')).toHaveLength(1);
+  });
+
+  test('empty string produces no targets', () => {
+    expect(parseScanTargets('')).toEqual([]);
+  });
+});
+
+describe('defaultScanTargets', () => {
+  test('builds a single app target from context + dockerfile', () => {
+    expect(defaultScanTargets('.', './Dockerfile')).toBe('app::.:./Dockerfile');
+  });
+
+  test('defaults the dockerfile path to <context>/Dockerfile when unset', () => {
+    expect(defaultScanTargets('services/web', '')).toBe(
+      'app::services/web:services/web/Dockerfile',
+    );
+  });
+
+  test('defaults the context to "." when unset', () => {
+    expect(defaultScanTargets('', '')).toBe('app::.:./Dockerfile');
+  });
+});
+
+describe('buildCodeMetadata', () => {
+  test('derives a 7-char short SHA and falls back branch/user', () => {
+    const meta = buildCodeMetadata({
+      commit: 'abcdef1234567',
+      branch: '',
+      prDestinationBranch: 'main',
+      workspace: 'dp-cloud',
+      repoSlug: 'my-repo',
+      gitAuthorName: '',
+    });
+
+    expect(meta).toEqual({
+      shortSha: 'abcdef1',
+      codeBranch: 'main',
+      codeRepoUrl: 'https://bitbucket.org/dp-cloud/my-repo',
+      codeUser: 'bitbucket-pipelines',
+    });
+  });
+
+  test('prefers branch over PR destination branch, and a real author name', () => {
+    const meta = buildCodeMetadata({
+      commit: 'abcdef1234567',
+      branch: 'feature/x',
+      prDestinationBranch: 'main',
+      gitAuthorName: 'Matt Fields',
+    });
+    expect(meta.codeBranch).toBe('feature/x');
+    expect(meta.codeUser).toBe('Matt Fields');
+  });
+});
+
+describe('buildPipelineRunInfo', () => {
+  test('defaults trigger to push and builds a run URL from the build number', () => {
+    const info = buildPipelineRunInfo({
+      buildNumber: '42',
+      workspace: 'dp-cloud',
+      repoSlug: 'my-repo',
+    });
+
+    expect(info).toEqual({
+      runId: '42',
+      runTrigger: 'push',
+      runUrl: 'https://bitbucket.org/dp-cloud/my-repo/pipelines/results/42',
+      includeInScanArgs: true,
+    });
+  });
+
+  test('defaults trigger to pull_request when a PR id is present', () => {
+    const info = buildPipelineRunInfo({ buildNumber: '42', prId: '7' });
+    expect(info.runTrigger).toBe('pull_request');
+  });
+
+  test('explicit TENABLE_PIPELINE_RUN_* values win over the Bitbucket-derived ones', () => {
+    const info = buildPipelineRunInfo({
+      runId: 'custom-1',
+      runTrigger: 'manual',
+      runUrl: 'https://example.com/run/1',
+      buildNumber: '42',
+    });
+    expect(info).toEqual({
+      runId: 'custom-1',
+      runTrigger: 'manual',
+      runUrl: 'https://example.com/run/1',
+      includeInScanArgs: true,
+    });
+  });
+
+  test('does not include the trio in scan args when no build number/id is available', () => {
+    const info = buildPipelineRunInfo({});
+    expect(info.includeInScanArgs).toBe(false);
+  });
+});
+
+describe('buildScanArgs', () => {
+  const base = {
+    slug: 'web',
+    scanTarget: 'my-repo-web:tenable-abc1234',
+    codeBranch: 'main',
+    commit: 'abcdef1234567',
+    codeUser: 'Matt Fields',
+    codeRepoUrl: 'https://bitbucket.org/dp-cloud/my-repo',
+    minSeverity: 'Medium',
+    runInfo: { includeInScanArgs: false },
+  };
+
+  test('builds the base scanner CLI args', () => {
+    expect(buildScanArgs(base)).toEqual([
+      'container-image',
+      'scan',
+      '--archive-path',
+      '/tmp/tenable/image.tar',
+      '--name',
+      'my-repo-web:tenable-abc1234',
+      '--code-branch',
+      'main',
+      '--code-commit-hash',
+      'abcdef1234567',
+      '--code-commit-user',
+      'Matt Fields',
+      '--code-repository-url',
+      'https://bitbucket.org/dp-cloud/my-repo',
+      '--min-severity',
+      'medium',
+      '--output-file-formats',
+      'json,md,junit',
+      '--output-path',
+      '/tmp/tenable/out',
+      '--output-file-name',
+      'web-tenable',
+      '--no-color',
+    ]);
+  });
+
+  test('appends the pipeline-run trio only when includeInScanArgs is true', () => {
+    const args = buildScanArgs({
+      ...base,
+      runInfo: {
+        includeInScanArgs: true,
+        runId: '42',
+        runTrigger: 'push',
+        runUrl: 'https://bitbucket.org/dp-cloud/my-repo/pipelines/results/42',
+      },
+    });
+    expect(args).toEqual(
+      expect.arrayContaining([
+        '--pipeline-run-id',
+        '42',
+        '--pipeline-run-trigger',
+        'push',
+        '--pipeline-run-url',
+        'https://bitbucket.org/dp-cloud/my-repo/pipelines/results/42',
+      ]),
+    );
+  });
+
+  test('appends --fail-on-min-severity only when set', () => {
+    expect(buildScanArgs(base)).not.toContain('--fail-on-min-severity');
+    expect(buildScanArgs({ ...base, failOnMinSeverity: 'High' })).toEqual(
+      expect.arrayContaining(['--fail-on-min-severity', 'high']),
+    );
+  });
+});

package/src/tenable/cli.js

@@ -0,0 +1,24 @@
+#!/usr/bin/env node
+
+import { Command } from 'commander';
+import { $ } from 'zx';
+import { runTenableScan } from './scan.js';
+
+const program = new Command();
+
+program
+  .command('scan')
+  .description('Run the Tenable Cloud Security container image scan')
+  .action(async () => {
+    let gitAuthorName = '';
+    const result = await $({
+      nothrow: true,
+      quiet: true,
+    })`git log -1 --pretty=format:%an`;
+    if (result.exitCode === 0) gitAuthorName = result.stdout.trim();
+
+    const { exitCode } = await runTenableScan({ gitAuthorName });
+    process.exit(exitCode);
+  });
+
+program.parse(process.argv);

package/src/tenable/docker.js

@@ -0,0 +1,45 @@
+import { $ } from 'zx';
+
+// Thin wrappers around the docker CLI so scan.js can inject a fake in tests.
+// Every call uses nothrow: a non-zero exit is meaningful data here (a failed
+// build, or the scanner itself reporting findings), not an exceptional case.
+export const docker = {
+  async buildxAvailable() {
+    const result = await $({
+      nothrow: true,
+      quiet: true,
+    })`docker buildx version`;
+    return result.exitCode === 0;
+  },
+
+  async build(args) {
+    const result = await $({ nothrow: true })`docker build ${args}`;
+    return { ok: result.exitCode === 0 };
+  },
+
+  async save(image, tarPath) {
+    const result = await $({
+      nothrow: true,
+    })`docker save ${image} -o ${tarPath}`;
+    return { ok: result.exitCode === 0 };
+  },
+
+  // The entrypoint is overridden rather than trusted. Tenable's own GitHub action
+  // builds FROM this image purely to replace the entrypoint with a script whose
+  // first line is `tenable container-image scan "$@"`, which means the base image's
+  // own entrypoint is not that binary. Passing the subcommand as bare arguments
+  // hands them to whatever the image does start, and the failure is silent: exit 0,
+  // no output, no reports.
+  async run({ image, args, volume, workdir, env, entrypoint }) {
+    const envFlags = env.flatMap((name) => ['--env', name]);
+    const entrypointFlags = entrypoint ? ['--entrypoint', entrypoint] : [];
+    const result = await $({
+      nothrow: true,
+    })`docker run --rm --workdir ${workdir} --volume ${volume} ${envFlags} ${entrypointFlags} --pull=always ${image} ${args}`;
+    return result.exitCode;
+  },
+
+  async rmi(image) {
+    await $({ nothrow: true, quiet: true })`docker rmi -f ${image}`;
+  },
+};

package/src/tenable/fsops.js

@@ -0,0 +1,15 @@
+import fs from 'fs-extra';
+import path from 'path';
+
+// The work dir is created inside the current directory (not os.tmpdir())
+// deliberately: it must be bind-mountable for docker, and on some hosts the
+// system temp dir is a symlink docker won't follow.
+export const fsOps = {
+  mkdtemp: () => fs.mkdtempSync(path.join(process.cwd(), '.tenable-work.')),
+  mkdirp: (dir) => fs.mkdirpSync(dir),
+  exists: (p) => fs.existsSync(p),
+  listDir: (dir) => (fs.existsSync(dir) ? fs.readdirSync(dir) : []),
+  copyReports: (from, to) => fs.copySync(from, to),
+  readFile: (p) => fs.readFileSync(p, 'utf8'),
+  removeSync: (p) => fs.removeSync(p),
+};

package/src/tenable/scan.js

@@ -0,0 +1,284 @@
+import {
+  buildCodeMetadata,
+  buildPipelineRunInfo,
+  buildScanArgs,
+  defaultScanTargets,
+  parseScanTargets,
+  SEPARATOR,
+} from './args.js';
+import { docker as defaultDocker } from './docker.js';
+import { fsOps as defaultFsOps } from './fsops.js';
+
+// Scans one target: builds (or reuses a pre-built) image, exports it to a
+// tar, and runs it through the scanner container, which has no access to the
+// host docker daemon so it can't resolve an image by name alone.
+export async function scanOne(target, ctx) {
+  const {
+    reportDir,
+    scannerImage,
+    scannerEntrypoint,
+    shortSha,
+    imageNamePrefix,
+    codeBranch,
+    commit,
+    codeUser,
+    codeRepoUrl,
+    minSeverity,
+    runInfo,
+    failOnMinSeverity,
+    docker,
+    fsops,
+    log,
+  } = ctx;
+  const { label, slug, buildContext, dockerfile, prebuiltImage } = target;
+
+  let scanTarget;
+  let builtImage = '';
+
+  if (prebuiltImage) {
+    scanTarget = prebuiltImage;
+    log(`Scanning pre-existing image ${scanTarget}`);
+  } else if (fsops.exists(dockerfile)) {
+    scanTarget = `${imageNamePrefix}-${slug}:tenable-${shortSha}`;
+    log(
+      `Building ${scanTarget} from ${dockerfile} (context ${buildContext})...`,
+    );
+    const useLoad = await docker.buildxAvailable();
+    const built = await docker.build([
+      buildContext,
+      '--file',
+      dockerfile,
+      '--tag',
+      scanTarget,
+      ...(useLoad ? ['--load'] : []),
+    ]);
+    if (!built.ok) {
+      log(`Docker build failed for '${slug}' — skipping its Tenable scan.`);
+      return { slug, exitCode: 1 };
+    }
+    builtImage = scanTarget;
+  } else {
+    log(`No Dockerfile at ${dockerfile} — nothing to scan for '${label}'.`);
+    return { slug, exitCode: 0, skipped: true };
+  }
+
+  const work = fsops.mkdtemp();
+
+  log(`Exporting ${scanTarget} to an archive...`);
+  const saved = await docker.save(scanTarget, `${work}/image.tar`);
+  if (!saved.ok) {
+    log(`docker save failed for '${slug}' — skipping its Tenable scan.`);
+    fsops.removeSync(work);
+    if (builtImage) await docker.rmi(builtImage);
+    return { slug, exitCode: 1 };
+  }
+
+  // --output-path must already exist; the scanner validates it before scanning.
+  fsops.mkdirp(`${work}/out`);
+
+  const scanArgs = buildScanArgs({
+    slug,
+    scanTarget,
+    codeBranch,
+    commit,
+    codeUser,
+    codeRepoUrl,
+    minSeverity,
+    runInfo,
+    failOnMinSeverity,
+  });
+
+  log(
+    `Running Tenable scan for '${slug}' (min-severity=${minSeverity}${
+      failOnMinSeverity ? `, fail-on=${failOnMinSeverity}` : ''
+    })...`,
+  );
+  const exitCode = await docker.run({
+    image: scannerImage,
+    args: scanArgs,
+    volume: `${work}:/tmp/tenable`,
+    workdir: '/tmp/tenable',
+    entrypoint: scannerEntrypoint,
+    // The output destination goes over BOTH transports on purpose. Tenable's own
+    // GitHub action passes output-path and output-file-name only as TENABLE_*
+    // env vars, never as flags, so a build of the scanner that ignores the flags
+    // would silently fall back to its default path (the working directory) and
+    // leave the reports where nothing looks for them.
+    env: [
+      'TENABLE_API_TOKEN',
+      'TENABLE_API_URL',
+      'TENABLE_OUTPUT_PATH=/tmp/tenable/out',
+      `TENABLE_OUTPUT_FILE_NAME=${slug}-tenable`,
+    ],
+  });
+
+  // Collect reports even on a non-zero exit — a threshold failure still produces them.
+  if (fsops.listDir(`${work}/out`).length > 0) {
+    fsops.mkdirp(reportDir);
+    fsops.copyReports(`${work}/out`, reportDir);
+  } else {
+    // Before declaring the scan reportless, look in the work root: that is the
+    // scanner's default output path, so anything it wrote while ignoring the
+    // requested one lands beside the archive — and the work dir is deleted a few
+    // lines below, taking the reports with it.
+    const stray = fsops
+      .listDir(work)
+      .filter((name) => name !== 'image.tar' && name !== 'out');
+    if (stray.length > 0) {
+      log(
+        `Tenable wrote to the work root rather than the requested output path: ${stray.join(', ')}`,
+      );
+      fsops.mkdirp(reportDir);
+      for (const name of stray) {
+        fsops.copyReports(`${work}/${name}`, `${reportDir}/${name}`);
+      }
+    } else {
+      // The scanner exits 0 and prints nothing when it rejects an output format,
+      // so an empty work dir is worth reporting with the exit code attached.
+      log(
+        `Tenable produced no report files for '${slug}' (scanner exit ${exitCode}).`,
+      );
+    }
+  }
+
+  const summaryPath = `${reportDir}/${slug}-tenable.md`;
+  if (fsops.exists(summaryPath)) {
+    log(`--- Tenable summary: ${slug} ---`);
+    log(fsops.readFile(summaryPath).split('\n').slice(0, 60).join('\n'));
+  }
+
+  fsops.removeSync(work);
+  if (builtImage) await docker.rmi(builtImage);
+
+  return { slug, exitCode };
+}
+
+export async function runTenableScan({
+  tenableApiToken = process.env.TENABLE_API_TOKEN,
+  tenableApiUrl = process.env.TENABLE_API_URL,
+  reportDir = process.env.TENABLE_REPORT_DIR || 'tenable-report',
+  scannerImage = process.env.TENABLE_SCANNER_IMAGE ||
+    'tenable/cloud-security-scanner:latest',
+  scannerEntrypoint = process.env.TENABLE_SCANNER_ENTRYPOINT || 'tenable',
+  minSeverity = process.env.TENABLE_MIN_SEVERITY || 'Medium',
+  failOnMinSeverity = process.env.TENABLE_FAIL_ON_MIN_SEVERITY || '',
+  tenableImage = process.env.TENABLE_IMAGE || '',
+  scanTargetsEnv = process.env.SCAN_TARGETS || '',
+  buildContextFallback = process.env.XRAY_BUILD_CONTEXT || '.',
+  dockerfileFallback = process.env.XRAY_DOCKERFILE_PATH || '',
+  commit = process.env.BITBUCKET_COMMIT || 'local',
+  branch = process.env.BITBUCKET_BRANCH || '',
+  prDestinationBranch = process.env.BITBUCKET_PR_DESTINATION_BRANCH || '',
+  workspace = process.env.BITBUCKET_WORKSPACE || 'unknown',
+  repoSlug = process.env.BITBUCKET_REPO_SLUG || 'unknown',
+  gitAuthorName = '',
+  prId = process.env.BITBUCKET_PR_ID || '',
+  buildNumber = process.env.BITBUCKET_BUILD_NUMBER || '',
+  runId = process.env.TENABLE_PIPELINE_RUN_ID || '',
+  runTrigger = process.env.TENABLE_PIPELINE_RUN_TRIGGER || '',
+  runUrl = process.env.TENABLE_PIPELINE_RUN_URL || '',
+  docker = defaultDocker,
+  fsops = defaultFsOps,
+  log = console.log,
+} = {}) {
+  if (!tenableApiToken || !tenableApiUrl) {
+    log('TENABLE_API_TOKEN / TENABLE_API_URL not set — skipping Tenable scan.');
+    return { exitCode: 0, skipped: true, results: [] };
+  }
+
+  const { shortSha, codeBranch, codeRepoUrl, codeUser } = buildCodeMetadata({
+    commit,
+    branch,
+    prDestinationBranch,
+    workspace,
+    repoSlug,
+    gitAuthorName,
+  });
+  const runInfo = buildPipelineRunInfo({
+    runId,
+    runTrigger,
+    runUrl,
+    prId,
+    buildNumber,
+    workspace,
+    repoSlug,
+  });
+
+  const scanCtx = {
+    reportDir,
+    scannerImage,
+    scannerEntrypoint,
+    shortSha,
+    imageNamePrefix: repoSlug,
+    codeBranch,
+    commit,
+    codeUser,
+    codeRepoUrl,
+    minSeverity,
+    runInfo,
+    failOnMinSeverity,
+    docker,
+    fsops,
+    log,
+  };
+
+  const results = [];
+
+  // TENABLE_IMAGE names an already-built image, which is inherently single-target.
+  if (tenableImage) {
+    results.push(
+      await scanOne(
+        { label: 'image', slug: 'image', prebuiltImage: tenableImage },
+        scanCtx,
+      ),
+    );
+  } else {
+    const targetsStr =
+      scanTargetsEnv ||
+      defaultScanTargets(buildContextFallback, dockerfileFallback);
+    if (!scanTargetsEnv) {
+      log(`SCAN_TARGETS not set — scanning a single target: ${targetsStr}`);
+    }
+
+    let scanned = 0;
+    for (const target of parseScanTargets(targetsStr)) {
+      if (target.skipped) {
+        log(
+          `Target '${target.label}' has no build context — skipping its image scan.`,
+        );
+        continue;
+      }
+      log(SEPARATOR);
+      log(`Tenable target '${target.label}'`);
+      log(SEPARATOR);
+      results.push(await scanOne(target, scanCtx));
+      scanned += 1;
+    }
+
+    if (scanned === 0) {
+      log('No scannable targets in SCAN_TARGETS — nothing to do.');
+    }
+  }
+
+  // Report the worst outcome across targets, so one clean app can't mask
+  // another's failure.
+  const exitCode = results.reduce(
+    (worst, r) => (r.exitCode !== 0 ? r.exitCode : worst),
+    0,
+  );
+
+  if (fsops.listDir(reportDir).length > 0) {
+    log(`Reports written to ${reportDir}/:`);
+    log(fsops.listDir(reportDir).join('\n'));
+  }
+
+  if (exitCode !== 0) {
+    log(
+      failOnMinSeverity
+        ? `Tenable scan exited ${exitCode} — findings at or above ${failOnMinSeverity}, or a scan itself failed.`
+        : `Tenable scan exited ${exitCode}.`,
+    );
+  }
+
+  return { exitCode, skipped: false, results };
+}