@ngocsangairvds/vsaf 4.1.9 → 4.1.10

package/skills/vds-skill/runtime/sonarqube_orchestrator/src/vds_sonarqube_orchestrator/config.py

@@ -0,0 +1,260 @@
+"""Strongly-typed SonarQube settings using pydantic-settings.
+
+Uses native pydantic-settings for environment variable and .env file loading.
+Credentials are loaded through the shared VDS env path/config layer with os.environ overrides.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+from typing import Any
+
+from pydantic import Field, SecretStr, ValidationError, field_validator
+from pydantic_settings import (
+    BaseSettings,
+    PydanticBaseSettingsSource,
+    SettingsConfigDict,
+)
+from vds_cli_common.env import DEFAULT_ENV_PATHS, load_shared_env
+from vds_platform_core.config import (
+    VDS_BASE_SETTINGS_CONFIG,
+    HTTPClientSettings,
+    vds_settings_customise_sources,
+)
+from vds_platform_core.credentials import resolve_secret
+from vds_platform_core.errors import SettingsError
+
+
+class SonarqubeSettings(HTTPClientSettings, BaseSettings):
+    """Strongly-typed SonarQube settings for code quality scanning.
+
+    Loads configuration from:
+    1. Shared VDS env file (primary credentials source)
+    2. Project .env file (fallback)
+    3. Environment variables (overrides everything)
+
+    Note: Sensitive fields (token, password) use SecretStr for security.
+    """
+
+    model_config = SettingsConfigDict(**VDS_BASE_SETTINGS_CONFIG, env_prefix="VDS_SONAR_")
+
+    # Override HTTPClientSettings defaults with sonarqube-specific values
+    connect_timeout: float = Field(default=10.0, ge=0)
+    read_timeout: float = Field(default=30.0, ge=0)
+    retry_backoff_initial: float = Field(default=1.5, ge=0)
+
+    # Backward-compatibility alias (HTTPClientSettings uses read_timeout)
+    @property
+    def request_timeout(self) -> float:
+        return self.read_timeout
+
+    # SonarQube server URL (required)
+    host_url: str = Field(
+        alias="VDS_SONAR_HOST_URL",
+        description="SonarQube server URL (e.g., http://sonar-10.digital.vn)",
+    )
+
+    # Authentication (optional - token preferred, username/password fallback)
+    token_secret: SecretStr | None = Field(
+        default=None,
+        alias="VDS_SONAR_TOKEN",
+        description="SonarQube authentication token (preferred)",
+    )
+    user: str | None = Field(
+        default=None,
+        alias="VDS_SONAR_USER",
+        description="SonarQube username (fallback)",
+    )
+    password_secret: SecretStr | None = Field(
+        default=None,
+        alias="VDS_SONAR_PASSWORD",
+        description="SonarQube password (fallback with user)",
+    )
+
+    # Default project configuration (optional - can be specified per-request)
+    project_key: str | None = Field(
+        default=None,
+        alias="VDS_SONAR_PROJECT_KEY",
+        description="Default project key",
+    )
+    branch_name: str | None = Field(
+        default=None,
+        alias="VDS_SONAR_BRANCH_NAME",
+        description="Default branch name",
+    )
+
+    # SSL settings
+    verify_certs: bool = Field(
+        default=False,
+        alias="VDS_SONAR_VERIFY_CERTS",
+        description="Verify SSL certificates (false for self-signed)",
+    )
+
+    # SCA (Software Composition Analysis) settings
+    sca_timeout: int = Field(
+        default=300,
+        alias="VDS_SONAR_SCA_TIMEOUT",
+        description="SCA tool timeout in seconds (default: 300)",
+    )
+    sca_tool: str = Field(
+        default="auto",
+        alias="VDS_SONAR_SCA_TOOL",
+        description="Preferred SCA tool (auto, snyk, trivy, grype, syft)",
+    )
+    sca_severity: str = Field(
+        default="HIGH",
+        alias="VDS_SONAR_SCA_SEVERITY",
+        description="Minimum severity for quality gate (CRITICAL, HIGH, MEDIUM, LOW)",
+    )
+    snyk_token: SecretStr | None = Field(
+        default=None,
+        alias="VDS_SONAR_SNYK_TOKEN",
+        description="Snyk authentication token (optional)",
+    )
+    trivy_path: str | None = Field(
+        default=None,
+        alias="VDS_SONAR_TRIVY_PATH",
+        description="Custom path to trivy binary",
+    )
+    syft_path: str | None = Field(
+        default=None,
+        alias="VDS_SONAR_SYFT_PATH",
+        description="Custom path to syft binary",
+    )
+
+    # Backward-compatibility alias (HTTPClientSettings uses retry_backoff_initial)
+    @property
+    def retry_backoff(self) -> float:
+        return self.retry_backoff_initial
+
+    @classmethod
+    def settings_customise_sources(
+        cls,
+        settings_cls: type[BaseSettings],
+        init_settings: PydanticBaseSettingsSource,
+        env_settings: PydanticBaseSettingsSource,
+        dotenv_settings: PydanticBaseSettingsSource,
+        file_secret_settings: PydanticBaseSettingsSource,
+    ) -> tuple[PydanticBaseSettingsSource, ...]:
+        """Wrapper that uses local DEFAULT_ENV_PATHS for test compatibility."""
+        return vds_settings_customise_sources(
+            settings_cls,
+            init_settings,
+            env_settings,
+            dotenv_settings,
+            file_secret_settings,
+            env_paths=DEFAULT_ENV_PATHS,
+        )
+
+    @field_validator("sca_severity", mode="before")
+    @classmethod
+    def _validate_sca_severity(cls, v: str) -> str:
+        valid = {"CRITICAL", "HIGH", "MEDIUM", "LOW"}
+        if v.upper() not in valid:
+            raise ValueError(f"Invalid sca_severity: {v}. Must be one of {valid}")
+        return v.upper()
+
+    # Property wrappers for backward compatibility - expose SecretStr values
+    @property
+    def token(self) -> str | None:
+        """Get token value (unwrapped via platform_core.resolve_secret)."""
+        return resolve_secret(self.token_secret)
+
+    @property
+    def password(self) -> str | None:
+        """Get password value (unwrapped via platform_core.resolve_secret)."""
+        return resolve_secret(self.password_secret)
+
+    @property
+    def base_url(self) -> str:
+        """Get the normalized base URL (without trailing slash)."""
+        return self.host_url.rstrip("/")
+
+    def require_credentials(self) -> None:
+        """Validate that credentials are available.
+
+        Raises:
+            ValueError: If neither token nor username/password are set.
+        """
+        if not self.token and not (self.user and self.password):
+            raise ValueError(
+                "Missing SonarQube credentials: set VDS_SONAR_TOKEN or "
+                "VDS_SONAR_USER and VDS_SONAR_PASSWORD"
+            )
+
+
+def load_settings(
+    *,
+    env_path: Path | None = None,
+    overrides: dict[str, Any] | None = None,
+    strict: bool = False,
+) -> SonarqubeSettings:
+    """Load orchestrator settings using native pydantic-settings.
+
+    Args:
+        env_path: Optional path to a specific .env file (for testing).
+                 When provided, uses custom settings source instead of DEFAULT_ENV_PATHS.
+        overrides: Optional dict of values to override settings.
+        strict: If True, require valid credentials (calls require_credentials).
+
+    Returns:
+        SonarqubeSettings instance with loaded configuration.
+
+    Raises:
+        SettingsError: If validation fails or strict mode requirements not met.
+    """
+    load_shared_env(path=env_path)
+    try:
+        # Build kwargs for settings instantiation
+        kwargs: dict[str, Any] = {}
+        if overrides:
+            kwargs.update(overrides)
+
+        # If custom env_path provided, create a custom settings class that uses it
+        if env_path is not None:
+            from pydantic_settings.sources import DotEnvSettingsSource
+
+            # Create settings with custom source chain for the provided env_path
+            class CustomSonarqubeSettings(SonarqubeSettings):
+                @classmethod
+                def settings_customise_sources(
+                    cls,
+                    settings_cls: type[BaseSettings],
+                    init_settings: PydanticBaseSettingsSource,
+                    env_settings: PydanticBaseSettingsSource,
+                    dotenv_settings: PydanticBaseSettingsSource,
+                    file_secret_settings: PydanticBaseSettingsSource,
+                ) -> tuple[PydanticBaseSettingsSource, ...]:
+                    """Custom source chain: init → env vars → custom env_path."""
+                    sources: list[PydanticBaseSettingsSource] = [
+                        init_settings,
+                        env_settings,
+                    ]
+                    if env_path.exists():
+                        sources.append(
+                            DotEnvSettingsSource(
+                                settings_cls,
+                                env_file=env_path,
+                                env_file_encoding="utf-8",
+                            )
+                        )
+                    return tuple(sources)
+
+            settings = CustomSonarqubeSettings(**kwargs)
+        else:
+            # Use standard settings with default source chain
+            settings = SonarqubeSettings(**kwargs)
+
+    except ValidationError as exc:
+        raise SettingsError(str(exc)) from exc
+
+    if strict:
+        try:
+            settings.require_credentials()
+        except ValueError as exc:
+            raise SettingsError(str(exc)) from exc
+
+    return settings
+
+
+__all__ = ["SonarqubeSettings", "SettingsError", "load_settings", "DEFAULT_ENV_PATHS"]

package/skills/vds-skill/runtime/sonarqube_orchestrator/src/vds_sonarqube_orchestrator/diff.py

@@ -0,0 +1,220 @@
+"""Diff analysis for comparing SonarQube analysis results between commits/branches."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, Any
+
+import structlog
+
+if TYPE_CHECKING:
+    from vds_sonarqube_orchestrator.config import SonarqubeSettings
+
+logger = structlog.get_logger(__name__)
+
+
+class DiffError(Exception):
+    """Base error for diff operations."""
+
+    def __init__(self, message: str, context: dict[str, Any] | None = None) -> None:
+        super().__init__(message)
+        self.context = context or {}
+
+
+@dataclass
+class IssueDiff:
+    """Difference in issues between two analysis points."""
+
+    new_issues: list[dict[str, Any]] = field(default_factory=list)
+    resolved_issues: list[dict[str, Any]] = field(default_factory=list)
+    unchanged_issues: int = 0
+
+    @property
+    def new_count(self) -> int:
+        return len(self.new_issues)
+
+    @property
+    def resolved_count(self) -> int:
+        return len(self.resolved_issues)
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "new_issues": self.new_issues,
+            "resolved_issues": self.resolved_issues,
+            "new_count": self.new_count,
+            "resolved_count": self.resolved_count,
+            "unchanged_issues": self.unchanged_issues,
+        }
+
+
+@dataclass
+class MetricDiff:
+    """Difference in a metric between two analysis points."""
+
+    metric: str
+    before_value: float | int | None
+    after_value: float | int | None
+
+    @property
+    def delta(self) -> float | int | None:
+        if self.before_value is None or self.after_value is None:
+            return None
+        return self.after_value - self.before_value
+
+    @property
+    def improved(self) -> bool | None:
+        if self.delta is None:
+            return None
+        negative_is_good = self.metric in (
+            "bugs",
+            "vulnerabilities",
+            "code_smells",
+            "duplicated_lines_density",
+        )
+        return self.delta < 0 if negative_is_good else self.delta > 0
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "metric": self.metric,
+            "before_value": self.before_value,
+            "after_value": self.after_value,
+            "delta": self.delta,
+            "improved": self.improved,
+        }
+
+
+@dataclass
+class AnalysisDiff:
+    """Complete diff between two analysis points."""
+
+    project_key: str
+    before_ref: str
+    after_ref: str
+    issues: IssueDiff = field(default_factory=IssueDiff)
+    metrics: list[MetricDiff] = field(default_factory=list)
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "project_key": self.project_key,
+            "before_ref": self.before_ref,
+            "after_ref": self.after_ref,
+            "issues": self.issues.to_dict(),
+            "metrics": [m.to_dict() for m in self.metrics],
+        }
+
+
+class DiffAnalyzer:
+    """Analyzer for comparing SonarQube analysis results."""
+
+    def __init__(self, settings: SonarqubeSettings) -> None:
+        self._settings = settings
+        self._client = None
+
+    def _get_client(self):
+        if self._client is None:
+            from vds_sonarqube_orchestrator.client import SonarqubeClient
+
+            self._client = SonarqubeClient(self._settings)
+        return self._client
+
+    def compare_branches(
+        self,
+        project_key: str,
+        before_branch: str,
+        after_branch: str,
+        metrics: list[str] | None = None,
+    ) -> AnalysisDiff:
+        """Compare analysis results between two branches."""
+        if metrics is None:
+            metrics = ["bugs", "vulnerabilities", "code_smells", "coverage"]
+
+        client = self._get_client()
+
+        with client:
+            before_measures = client.get_measures(project_key, metrics, before_branch)
+            after_measures = client.get_measures(project_key, metrics, after_branch)
+
+            before_issues = client.get_issues(project_key=project_key, per_page=500)
+            after_issues = client.get_issues(project_key=project_key, per_page=500)
+
+        metric_diffs = []
+        for metric in metrics:
+            metric_diffs.append(
+                MetricDiff(
+                    metric=metric,
+                    before_value=before_measures.get(metric),
+                    after_value=after_measures.get(metric),
+                )
+            )
+
+        before_keys = {i.get("key") for i in before_issues}
+        after_keys = {i.get("key") for i in after_issues}
+
+        new_keys = after_keys - before_keys
+        resolved_keys = before_keys - after_keys
+
+        issue_diff = IssueDiff(
+            new_issues=[i for i in after_issues if i.get("key") in new_keys],
+            resolved_issues=[i for i in before_issues if i.get("key") in resolved_keys],
+            unchanged_issues=len(before_keys & after_keys),
+        )
+
+        return AnalysisDiff(
+            project_key=project_key,
+            before_ref=before_branch,
+            after_ref=after_branch,
+            issues=issue_diff,
+            metrics=metric_diffs,
+        )
+
+    def compare_with_new_code(
+        self,
+        project_key: str,
+        branch: str | None = None,
+    ) -> AnalysisDiff:
+        """Compare current state with new code period."""
+        client = self._get_client()
+
+        with client:
+            issues = client.get_issues(
+                project_key=project_key,
+                statuses=["OPEN", "CONFIRMED", "REOPENED"],
+                per_page=500,
+            )
+
+        new_issues = [i for i in issues if i.get("isNew", False)]
+        existing_issues = [i for i in issues if not i.get("isNew", False)]
+
+        issue_diff = IssueDiff(
+            new_issues=new_issues,
+            resolved_issues=[],
+            unchanged_issues=len(existing_issues),
+        )
+
+        return AnalysisDiff(
+            project_key=project_key,
+            before_ref="baseline",
+            after_ref=branch or "current",
+            issues=issue_diff,
+            metrics=[],
+        )
+
+    def close(self) -> None:
+        if self._client:
+            self._client.close()
+            self._client = None
+
+    def __enter__(self) -> DiffAnalyzer:
+        return self
+
+    def __exit__(self, *args: object) -> None:
+        self.close()
+
+
+__all__ = [
+    "DiffAnalyzer",
+    "AnalysisDiff",
+    "IssueDiff",
+    "MetricDiff",
+    "DiffError",
+]

package/skills/vds-skill/runtime/sonarqube_orchestrator/src/vds_sonarqube_orchestrator/errors.py

@@ -0,0 +1,34 @@
+"""SonarQube error types — re-exports from vds_platform_core with service tag."""
+
+from vds_platform_core.errors import (
+    AuthError,
+    ClientPermissionError,
+    ClientTimeoutError,
+    ConflictError,
+    NotFoundError,
+    RateLimitError,
+    ResponseError,
+    RetryError,
+    SettingsError,
+    TransportError,
+    VDSClientError,
+    VDSError,
+)
+
+SERVICE_NAME = "sonarqube"
+
+__all__ = [
+    "AuthError",
+    "ClientPermissionError",
+    "ClientTimeoutError",
+    "ConflictError",
+    "NotFoundError",
+    "RateLimitError",
+    "ResponseError",
+    "RetryError",
+    "SettingsError",
+    "TransportError",
+    "VDSClientError",
+    "VDSError",
+    "SERVICE_NAME",
+]