@govuk-pay/cli 0.0.15 → 0.0.17

package/resources/legacy-ruby-cli/vulnerability_scan/scan.sh

@@ -1,88 +0,0 @@
-#!/bin/bash
-
-# Script for scanning ECR docker vulnerabilities with "docker scout cves"
-# https://docs.docker.com/engine/reference/commandline/scout_cves/
-
-# **** Run this from the root of pay-infra to store reports in this folder. ****
-
-# This will take about 5 minutes unless you already have the images cached locally.
-# You will be prompted for your aws-vault auth/MFA code.
-# The report will be stored in reports/vulnerability_scan_report-YYYY-MM-DD.csv
-
-set -euo pipefail
-
-ACCOUNT="staging"
-ACCOUNT_ID="888564216586"
-SOURCE_DIR=$(realpath "$(dirname "${BASH_SOURCE[0]}")")
-REPORTS_FOLDER="$SOURCE_DIR/reports"
-ARCHITECTURE_TO_SCAN="linux/amd64"
-
-echo "🔍 checking for dependencies..."
-
-declare -a commands=("aws" "aws-vault" "docker" "docker scout")
-
-for cmd in "${commands[@]}"; do
-  # shellcheck disable=SC2086
-  if ! command -v $cmd &> /dev/null
-  then
-    echo "❌ $cmd"
-    exit 1
-  else
-    echo "✅ $cmd"
-  fi
-done
-
-# Login to ECR
-echo "Logging into $ACCOUNT ECR"
-aws-vault exec "$ACCOUNT" -- aws ecr get-login-password --region eu-west-1 | docker login --username AWS --password-stdin "${ACCOUNT_ID}.dkr.ecr.eu-west-1.amazonaws.com"
-
-IMAGES=""
-
-# Get a all ECS clusters
-echo "Getting list of ECS clusters"
-CLUSTERS=$(aws-vault exec "$ACCOUNT" -- aws ecs list-clusters --query clusterArns --output text)
-
-for CLUSTER in $CLUSTERS; do
-  echo "Checking services in cluster $CLUSTER"
-  SERVICES=$(aws-vault exec "$ACCOUNT" -- aws ecs list-services --cluster "$CLUSTER" --query 'serviceArns' --output text | xargs -n1 | sort)
-
-  for SERVICE in $SERVICES; do
-    echo "Checking for container images in service $SERVICE"
-    TASK_DEFINITION=$(\
-      aws-vault exec "$ACCOUNT" -- \
-        aws ecs describe-services --cluster "$CLUSTER" --service "$SERVICE" --query 'services[].taskDefinition' --output text
-    )
-    CONTAINER_IMAGES=$(aws-vault exec "$ACCOUNT" -- aws ecs describe-task-definition --task-definition "$TASK_DEFINITION" --query 'taskDefinition.containerDefinitions[].image' --output text)
-    for CONTAINER_IMAGE in $CONTAINER_IMAGES; do
-      IMAGES="$IMAGES $CONTAINER_IMAGE"
-    done
-  done
-done
-
-for IMAGE in $(xargs -n1 <<<"$IMAGES" | sort | uniq); do
-  SHORT_REPO_AND_TAG=$(cut -d'/' -f 3 <<<"$IMAGE")
-  SHORT_REPO_NAME=$(cut -f 1 -d ":" <<<"$SHORT_REPO_AND_TAG")
-  IMAGE_TAG=$(cut -f 2 -d ":" <<<"$SHORT_REPO_AND_TAG")
-
-  echo "Scanning image $IMAGE"
-  docker scout cves --format sarif --platform "$ARCHITECTURE_TO_SCAN" --output "${REPORTS_FOLDER}/${SHORT_REPO_NAME}-${IMAGE_TAG}.json" "$IMAGE"
-done
-
-pushd "$SOURCE_DIR" >>/dev/null 2>&1
-
-echo "Installing node dependencies"
-npm install
-
-echo
-echo "|============================================================================================"
-echo "| Generating vulnerability report"
-echo "|============================================================================================"
-node "${SOURCE_DIR}/generate_vulnerability_report.js"
-echo "|============================================================================================"
-echo
-
-popd >>/dev/null 2>&1
-
-# Clean up report JSON files once done
-echo "Removing JSON report files..."
-rm $REPORTS_FOLDER/*.json