@ngocsangairvds/vsaf 3.2.14 → 3.2.15

package/tools/vds-scripts/audit_orchestrator/src/vds_audit_orchestrator/reports/sarif_generator.py

@@ -1,519 +0,0 @@
-"""SARIF report generation following SARIF 2.1.0 specification.
-
-This module generates SARIF (Static Analysis Results Interchange Format) reports
-for agent collaboration and tool integration.
-
-SARIF 2.1.0 specification: https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html
-
-Key Features:
-- Full SARIF 2.1.0 compliance with $schema reference
-- Rule definitions with help text and documentation links
-- Result mapping with severity, priority, and remediation
-- VDS-specific properties extension (SSDF, OpenSSF tags)
-- Artifact locations with region support for file content checks
-- Proper level mapping (error, warning, note)
-- Tool driver information and version tracking
-"""
-
-from __future__ import annotations
-
-import json
-from pathlib import Path
-from typing import TYPE_CHECKING, Any
-
-from structlog import get_logger
-
-from vds_audit_orchestrator import __version__
-from vds_audit_orchestrator.models.enums import CheckStatus, Priority, Severity
-
-if TYPE_CHECKING:
-    from vds_audit_orchestrator.models.findings import CheckFinding, RepositoryAuditResult
-    from vds_audit_orchestrator.models.reporting import AuditRunReport
-
-logger = get_logger(__name__)
-
-# SARIF 2.1.0 constants
-SARIF_VERSION = "2.1.0"
-SARIF_SCHEMA = "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json"
-
-# VDS-specific properties schema
-VDS_PROPERTIES_SCHEMA = {
-    "severity": {"type": "string", "enum": ["Critical", "High", "Medium", "Low", "Info"]},
-    "priority": {"type": "string", "enum": ["P1", "P2", "P3", "P4"]},
-    "migration_effort": {"type": "string", "enum": ["Low", "Medium", "High", "Very High"]},
-    "tags": {"type": "array", "items": {"type": "string"}},
-    "recommendations": {"type": "array", "items": {"type": "string"}},
-}
-
-
-def _map_severity_to_sarif_level(severity: Severity | None) -> str:
-    """Map VDS severity to SARIF level.
-
-    Mapping:
-    - Critical -> error
-    - High -> error
-    - Medium -> warning
-    - Low -> note
-    - Info -> note
-
-    Args:
-        severity: VDS severity level
-
-    Returns:
-        SARIF level string
-    """
-    if severity in {Severity.CRITICAL, Severity.HIGH}:
-        return "error"
-    if severity == Severity.MEDIUM:
-        return "warning"
-    return "note"
-
-
-def _map_severity_to_security_severity(severity: Severity | None) -> str:
-    """Map severity to SARIF security-severity score (0.0-10.0).
-
-    Mapping aligned with CVSS:
-    - Critical -> 9.0-10.0 (use 9.0)
-    - High -> 7.0-8.9 (use 7.0)
-    - Medium -> 4.0-6.9 (use 5.0)
-    - Low -> 0.1-3.9 (use 3.0)
-    - Info -> 0.0 (use 1.0 for visibility)
-
-    Args:
-        severity: VDS severity level
-
-    Returns:
-        String representation of security severity score
-    """
-    if severity == Severity.CRITICAL:
-        return "9.0"
-    if severity == Severity.HIGH:
-        return "7.0"
-    if severity == Severity.MEDIUM:
-        return "5.0"
-    if severity == Severity.LOW:
-        return "3.0"
-    return "1.0"  # INFO
-
-
-def _map_priority_to_rank(priority: Priority | None) -> int:
-    """Map VDS priority to SARIF rank (higher = more important).
-
-    Mapping:
-    - P1 -> 100 (immediate action required)
-    - P2 -> 75
-    - P3 -> 50
-    - P4 -> 25
-
-    Args:
-        priority: VDS priority level
-
-    Returns:
-        Integer rank value (0-100)
-    """
-    if priority == Priority.P1:
-        return 100
-    if priority == Priority.P2:
-        return 75
-    if priority == Priority.P3:
-        return 50
-    if priority == Priority.P4:
-        return 25
-    return 50  # Default to medium
-
-
-def _build_rule_definitions(all_findings: list[tuple[str, CheckFinding]]) -> list[dict[str, Any]]:
-    """Build SARIF rule definitions from findings.
-
-    Each rule includes:
-    - id: Check identifier
-    - name: Human-readable name
-    - shortDescription: Brief description
-    - fullDescription: Complete description
-    - help: Remediation guidance (text + markdown)
-    - helpUri: Documentation link
-    - defaultConfiguration.level: Default severity level
-    - properties: VDS extensions (tags, category)
-
-    Args:
-        all_findings: List of (section_id, finding) tuples
-
-    Returns:
-        List of SARIF rule descriptors
-    """
-    rules: list[dict[str, Any]] = []
-    seen_rules: dict[str, dict[str, Any]] = {}
-
-    for section_id, finding in all_findings:
-        if finding.check_id in seen_rules:
-            # Merge tags if rule already exists
-            existing_tags = seen_rules[finding.check_id].get("properties", {}).get("tags", [])
-            new_tags = list(set(existing_tags + (finding.tags or [])))
-            seen_rules[finding.check_id]["properties"]["tags"] = new_tags
-            continue
-
-        # Determine category from tags or section
-        tags = finding.tags or []
-        category = _infer_category_from_tags(tags) or section_id
-
-        # Safely handle potential None message
-        message = finding.message or "No description provided"
-
-        # Build rule
-        rule: dict[str, Any] = {
-            "id": finding.check_id,
-            "name": finding.check_id.replace("_", " ").title(),
-            "shortDescription": {"text": message[:100] + "..." if len(message) > 100 else message},
-            "fullDescription": {"text": message},
-            "defaultConfiguration": {"level": _map_severity_to_sarif_level(finding.severity)},
-            "properties": {
-                "category": category,
-                "tags": tags,
-            },
-        }
-
-        # Add help/remediation if available
-        if finding.recommendation:
-            remediation_text = finding.recommendation
-            rule["help"] = {
-                "text": remediation_text,
-                "markdown": f"**Remediation:**\n\n{remediation_text}",
-            }
-
-        # Add documentation link if available
-        if finding.doc_link:
-            rule["helpUri"] = finding.doc_link
-        else:
-            # Default to VDS documentation
-            rule["helpUri"] = "https://github.com/viettel-digital-services/vds-scripts"
-
-        # Add VDS-specific properties
-        if finding.severity:
-            rule["properties"]["severity"] = finding.severity.value
-            rule["properties"]["security-severity"] = _map_severity_to_security_severity(finding.severity)
-
-        if finding.priority:
-            rule["properties"]["priority"] = finding.priority.value
-            rule["properties"]["rank"] = _map_priority_to_rank(finding.priority)
-
-        if finding.migration_effort:
-            rule["properties"]["migration_effort"] = finding.migration_effort.value
-
-        # Add framework tags for SSDF/OpenSSF mapping
-        framework_tags = _extract_framework_tags(tags)
-        if framework_tags:
-            rule["properties"]["frameworks"] = framework_tags
-
-        seen_rules[finding.check_id] = rule
-        rules.append(rule)
-
-    return rules
-
-
-def _infer_category_from_tags(tags: list[str]) -> str | None:
-    """Infer category from tags like 'security', 'compliance', etc."""
-    for tag in tags:
-        tag_lower = tag.lower()
-        if any(sec in tag_lower for sec in ["security", "ssdf", "openssf", "secure"]):
-            return "Security"
-        elif any(comp in tag_lower for comp in ["compliance", "policy", "governance"]):
-            return "Compliance"
-        elif any(qual in tag_lower for qual in ["quality", "code", "test"]):
-            return "Code Quality"
-        elif any(doc in tag_lower for doc in ["doc", "documentation", "readme"]):
-            return "Documentation"
-        elif any(infra in tag_lower for infra in ["infra", "ci", "cd", "deploy"]):
-            return "Infrastructure"
-    return None
-
-
-def _extract_framework_tags(tags: list[str]) -> list[str]:
-    """Extract framework-specific tags (SSDF, OpenSSF, etc.)."""
-    framework_tags = []
-    for tag in tags:
-        tag_upper = tag.upper()
-        if "SSDF" in tag_upper or "NIST" in tag_upper:
-            framework_tags.append("SSDF")
-        if "OPENSSF" in tag_upper or "SCORECARD" in tag_upper:
-            framework_tags.append("OpenSSF")
-        if "CIS" in tag_upper:
-            framework_tags.append("CIS")
-        if "OWASP" in tag_upper:
-            framework_tags.append("OWASP")
-    return list(set(framework_tags))
-
-
-def _build_artifact_location(repo: RepositoryAuditResult, finding: CheckFinding) -> dict[str, Any]:
-    """Build SARIF artifact location for a finding.
-
-    Supports:
-    - Repository URL as base location
-    - File paths for git_file_exists and git_file_content checks
-    - Region information (line numbers) for content checks
-
-    Args:
-        repo: Repository audit result
-        finding: Check finding with evidence data
-
-    Returns:
-        SARIF artifact location object
-    """
-    # Extract file path from evidence if available
-    file_path = None
-    region = None
-
-    if finding.evidence_data:
-        # Check for file path evidence
-        file_path = (
-            finding.evidence_data.get("file_path")
-            or finding.evidence_data.get("path")
-            or finding.evidence_data.get("filename")
-        )
-
-        # Check for region evidence (line numbers)
-        if "line" in finding.evidence_data:
-            line = finding.evidence_data["line"]
-            region = {"startLine": int(line) if isinstance(line, str) else line}
-        if "start_line" in finding.evidence_data or "end_line" in finding.evidence_data:
-            start = finding.evidence_data.get("start_line", 1)
-            end = finding.evidence_data.get("end_line", start)
-            region = {
-                "startLine": int(start) if isinstance(start, str) else start,
-                "endLine": int(end) if isinstance(end, str) else end,
-            }
-
-    # Build artifact location
-    if file_path:
-        # File-specific location
-        uri = file_path if file_path.startswith("/") else f"/{file_path}"
-        artifact_location = {
-            "uri": uri,
-            "uriBaseId": "REPO_ROOT",
-        }
-    else:
-        # Repository-level location
-        uri = repo.repo_url or repo.repo_name
-        artifact_location = {
-            "uri": uri,
-        }
-
-    # Build physical location
-    physical_location: dict[str, Any] = {
-        "artifactLocation": artifact_location,
-    }
-
-    # Add region if available
-    if region:
-        physical_location["region"] = region
-
-    return physical_location
-
-
-def _build_logical_locations(section_id: str) -> list[dict[str, Any]]:
-    """Build SARIF logical locations for context.
-
-    Provides hierarchical context:
-    - Section (audit category)
-    - Kind (auditSection)
-
-    Args:
-        section_id: Section identifier
-
-    Returns:
-        List of logical location objects
-    """
-    return [{"name": section_id, "kind": "auditSection", "description": {"text": f"Audit section: {section_id}"}}]
-
-
-def _build_result(
-    repo: RepositoryAuditResult,
-    section_id: str,
-    finding: CheckFinding,
-    rule_index: int,
-) -> dict[str, Any]:
-    """Build SARIF result object from a finding.
-
-    Includes:
-    - ruleId: Reference to rule definition
-    - ruleIndex: Index in rules array
-    - level: Severity level (error, warning, note)
-    - message: Primary finding message
-    - locations: Physical and logical locations
-    - properties: VDS extensions
-
-    Args:
-        repo: Repository audit result
-        section_id: Section identifier
-        finding: Check finding
-        rule_index: Index in rules array
-
-    Returns:
-        SARIF result object
-    """
-    # Determine level based on status and severity
-    if finding.status == CheckStatus.FAIL:
-        level = _map_severity_to_sarif_level(finding.severity)
-    elif finding.status == CheckStatus.WARNING:
-        level = "warning"
-    elif finding.status == CheckStatus.ERROR:
-        level = "warning"  # Errors during check execution
-    else:
-        level = "note"  # PASS, N/A, SKIPPED
-
-    # Build result
-    result: dict[str, Any] = {
-        "ruleId": finding.check_id,
-        "ruleIndex": rule_index,
-        "level": level,
-        "message": {"text": finding.message or "No description provided"},
-        "locations": [
-            {
-                "physicalLocation": _build_artifact_location(repo, finding),
-                "logicalLocations": _build_logical_locations(section_id),
-            }
-        ],
-        "properties": {
-            "repository": repo.repo_name,
-            "section": section_id,
-            "score": finding.score_percentage if hasattr(finding, "score_percentage") else finding.score,
-            "status": finding.status.value,
-            "timestamp": repo.audit_timestamp.isoformat(),
-        },
-    }
-
-    # Add VDS-specific properties
-    if finding.severity:
-        result["properties"]["severity"] = finding.severity.value
-
-    if finding.priority:
-        result["properties"]["priority"] = finding.priority.value
-
-    if finding.migration_effort:
-        result["properties"]["migration_effort"] = finding.migration_effort.value
-
-    if finding.recommendation:
-        result["properties"]["remediation"] = finding.recommendation
-
-    if finding.details:
-        result["properties"]["details"] = str(finding.details)
-
-    if finding.tags:
-        result["properties"]["tags"] = finding.tags
-
-    if finding.evidence_data:
-        result["properties"]["evidence"] = str(finding.evidence_data)
-
-    if finding.confidence is not None:
-        result["properties"]["confidence"] = finding.confidence
-
-    # Add framework tags for filtering
-    framework_tags = _extract_framework_tags(finding.tags or [])
-    if framework_tags:
-        result["properties"]["frameworks"] = framework_tags
-
-    return result
-
-
-def _collect_all_findings(report: AuditRunReport) -> list[tuple[str, CheckFinding]]:
-    """Collect all findings across all repositories with section context.
-
-    Args:
-        report: Complete audit run report
-
-    Returns:
-        List of (section_id, finding) tuples
-    """
-    findings: list[tuple[str, CheckFinding]] = []
-    for repo in report.repositories:
-        for section in repo.sections:
-            for finding in section.findings:
-                findings.append((section.section_id, finding))
-    return findings
-
-
-def write_sarif_report(report: AuditRunReport, path: Path) -> Path:
-    """Write SARIF 2.1.0 compliant report to disk.
-
-    Generates a complete SARIF log file with:
-    - Version and schema reference
-    - Tool driver with version info
-    - Rule definitions for all checks
-    - Results for failed/warning/error findings
-    - Run metadata and invocation details
-    - VDS-specific properties extension
-
-    Args:
-        report: Complete audit run report
-        path: Output path for SARIF file
-
-    Returns:
-        Path to generated SARIF file
-    """
-    logger.info("generating_sarif_report", path=str(path), repo_count=len(report.repositories))
-
-    # Collect all findings for rule building
-    all_findings = _collect_all_findings(report)
-
-    # Build rule definitions
-    rules = _build_rule_definitions(all_findings)
-
-    # Build rule index map for result references
-    rule_index_map: dict[str, int] = {rule["id"]: idx for idx, rule in enumerate(rules)}
-
-    # Build results (only actionable findings)
-    results: list[dict[str, Any]] = []
-    for repo in report.repositories:
-        for section in repo.sections:
-            for finding in section.findings:
-                # Only include actionable findings
-                if finding.status not in {CheckStatus.FAIL, CheckStatus.WARNING, CheckStatus.ERROR}:
-                    continue
-
-                rule_index = rule_index_map.get(finding.check_id, 0)
-                result = _build_result(repo, section.section_id, finding, rule_index)
-                results.append(result)
-
-    # Build tool driver
-    tool_driver: dict[str, Any] = {
-        "name": "vds-audit-orchestrator",
-        "version": __version__,
-        "semanticVersion": __version__,
-        "informationUri": "https://github.com/viettel-digital-services/vds-scripts",
-        "rules": rules,
-    }
-
-    if report.metadata.template_name:
-        tool_driver["properties"] = {
-            "template": report.metadata.template_name,
-            "templateVersion": report.metadata.template_version,
-        }
-
-    # Build run with invocation details
-    run: dict[str, Any] = {
-        "tool": {"driver": tool_driver},
-        "results": results,
-        "invocations": [
-            {
-                "executionSuccessful": True,
-                "startTimeUtc": report.metadata.started_at.isoformat(),
-                "endTimeUtc": report.metadata.finished_at.isoformat(),
-                "properties": {
-                    "auditId": report.metadata.audit_id,
-                    "repositoryCount": len(report.repositories),
-                },
-            }
-        ],
-        "originalUriBaseIds": {
-            "REPO_ROOT": {"uri": "file:///", "description": {"text": "Repository root"}},
-        },
-    }
-
-    sarif_payload = {
-        "$schema": SARIF_SCHEMA,
-        "version": SARIF_VERSION,
-        "runs": [run],
-    }
-
-    path.write_text(json.dumps(sarif_payload, indent=2, sort_keys=True), encoding="utf-8")
-    logger.info("sarif_report_generated", path=str(path), results_count=len(results))
-    return path

package/tools/vds-scripts/audit_orchestrator/src/vds_audit_orchestrator/runtime_profiles.py

@@ -1,98 +0,0 @@
-"""Audit-specific runtime profile loader.
-
-This module wraps :mod:`vds_agent_core.profiles` with audit-specific glue:
-- ``_AuditConfigHooks`` bridges audit's config singleton (`get_config` /
-  `set_config` / `reset_config`) into the generic profile applier.
-- ``_AuditCredentialResolver`` delegates ``${codex:...}`` references to
-  audit's CodexOAuth implementation.
-- All call sites use the ``VDS_AUDIT_`` env prefix.
-
-It is NOT a compatibility shim — calling
-``vds_agent_core.profiles.apply_runtime_profile`` directly would not pick
-up audit's config singleton or credential resolver. Audit-orchestrator
-code should import from this module; non-audit consumers should import
-generic surfaces from ``vds_agent_core.profiles`` directly.
-"""
-
-from __future__ import annotations
-
-from typing import Any
-
-from vds_agent_core.profiles import RuntimeProfileActivation
-from vds_agent_core.profiles import apply_runtime_profile as _core_apply
-from vds_agent_core.profiles import build_llm_settings_for_profile as _core_build
-from vds_agent_core.profiles import inherit_runtime_llm_policy as _core_inherit
-
-__all__ = [
-    "apply_runtime_profile",
-    "build_llm_settings_for_profile",
-    "inherit_runtime_llm_policy",
-]
-
-
-class _AuditConfigHooks:
-    """Audit-specific config hooks — lazy imports to avoid circular deps."""
-
-    def get_config(self) -> Any:
-        from vds_audit_orchestrator.config import get_config
-
-        return get_config()
-
-    def set_config(self, cfg: Any) -> None:
-        from vds_audit_orchestrator.config import set_config
-
-        set_config(cfg)
-
-    def reset_config(self) -> None:
-        from vds_audit_orchestrator.config import reset_config
-
-        reset_config()
-
-
-class _AuditCredentialResolver:
-    """Resolve ${codex:...} references via audit OAuth."""
-
-    def resolve(self, field: str) -> str:
-        from vds_audit_orchestrator.llm.codex_oauth import CodexCredentialResolverImpl
-
-        return CodexCredentialResolverImpl().resolve(field)
-
-
-def apply_runtime_profile(
-    requested_profile: str | None,
-    *,
-    force_override: bool = False,
-) -> RuntimeProfileActivation:
-    """Apply runtime profile with audit-specific config hooks and credential resolver."""
-    return _core_apply(
-        requested_profile,
-        env_prefix="VDS_AUDIT_",
-        force_override=force_override,
-        _config_hooks=_AuditConfigHooks(),
-        credential_resolver=_AuditCredentialResolver(),
-    )
-
-
-def build_llm_settings_for_profile(profile_name: str) -> Any:
-    """Build isolated LLMSettings for a runtime profile without persistent env mutation."""
-    from vds_audit_orchestrator.llm.provider import LLMSettings
-
-    return _core_build(
-        profile_name,
-        env_prefix="VDS_AUDIT_",
-        config_hooks=_AuditConfigHooks(),
-        settings_factory=LLMSettings.from_config,
-    )
-
-
-def inherit_runtime_llm_policy(profile_name: str, *, source_llm: Any | None = None) -> Any:
-    """Build profile settings while preserving active runtime execution policy knobs."""
-    from vds_audit_orchestrator.llm.provider import LLMSettings
-
-    return _core_inherit(
-        profile_name,
-        source_llm=source_llm,
-        env_prefix="VDS_AUDIT_",
-        config_hooks=_AuditConfigHooks(),
-        settings_factory=LLMSettings.from_config,
-    )

package/tools/vds-scripts/audit_orchestrator/src/vds_audit_orchestrator/seed/__init__.py

@@ -1,29 +0,0 @@
-"""Seed resolution helpers."""
-
-from .seed_loader import (
-    repo_slug,
-    select_all_repos,
-    select_project,
-    select_project_by_key,
-    select_project_by_name,
-    select_project_by_page_id,
-    select_repos,
-    select_repos_by_slug,
-    select_repos_by_url,
-    sorted_projects,
-    sorted_repos,
-)
-
-__all__ = [
-    "repo_slug",
-    "select_all_repos",
-    "select_project",
-    "select_project_by_key",
-    "select_project_by_name",
-    "select_project_by_page_id",
-    "select_repos",
-    "select_repos_by_slug",
-    "select_repos_by_url",
-    "sorted_projects",
-    "sorted_repos",
-]