@soos-io/soos-sbom 1.0.1-pre.1 → 1.0.1-pre.3

package/README.md

@@ -38,4 +38,6 @@ Then run from the same terminal `node ./soos/node_modules/@soos-io/soos-sbom/bin
 | `--operatingEnvironment`|                                     | Set Operating environment for information purposes only.                                                                           |
 | `--otherOptions`        |                                     | Other Options to pass to syft.                                                                                                      |
 | `--projectName`         |                                        | Project Name - this is what will be displayed in the SOOS app.                                                                     |
+| `--directoriesToExclude` | `**/node_modules/**, "**/bin/**", "**/obj/**", "**/lib/**` | Listing of directories or patterns to exclude from the search for SBOM files. eg: **bin/start/**, **/start/**                                         |
+| `--filesToExclude` |  | Listing of files or patterns patterns to exclude from the search for SBOM files. eg: **/int**.cdx.json/, **/internal.cdx.json                         |
 | `sbomPath`              |                                        | The SBOM File to scan, it could be the location of the file or the file itself. When location is specified only the first file found will be scanned. |

package/bin/constants.d.ts

@@ -1,3 +1,7 @@
 export declare const SOOS_SBOM_CONSTANTS: {
     FileRegex: RegExp;
+    FileSyncPattern: string;
+    MaxSbomsPerScan: number;
+    UploadBatchSize: number;
+    DefaultDirectoriesToExclude: string[];
 };

package/bin/constants.js

@@ -3,4 +3,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.SOOS_SBOM_CONSTANTS = void 0;
 exports.SOOS_SBOM_CONSTANTS = {
     FileRegex: /\.(cdx|spdx)\.json$/,
+    FileSyncPattern: "**/*.@(cdx.json|spdx.json)",
+    MaxSbomsPerScan: 50,
+    UploadBatchSize: 10,
+    DefaultDirectoriesToExclude: ["**/node_modules/**", "**/bin/**", "**/obj/**", "**/lib/**"],
 };

package/bin/index.js

@@ -11,6 +11,8 @@ const AnalysisArgumentParser_1 = tslib_1.__importDefault(require("@soos-io/api-c
 const package_json_1 = require("../package.json");
 const AnalysisService_1 = tslib_1.__importDefault(require("@soos-io/api-client/dist/services/AnalysisService"));
 const constants_1 = require("./constants");
+const utilities_2 = require("./utilities");
+const Glob = tslib_1.__importStar(require("glob"));
 class SOOSSBOMAnalysis {
     constructor(args) {
         this.args = args;
@@ -18,6 +20,21 @@ class SOOSSBOMAnalysis {
     static parseArgs() {
         const analysisArgumentParser = AnalysisArgumentParser_1.default.create(api_client_1.IntegrationName.SoosSbom, api_client_1.IntegrationType.Script, api_client_1.ScanType.SBOM, package_json_1.version);
         analysisArgumentParser.addBaseScanArguments();
+        analysisArgumentParser.argumentParser.add_argument("--directoriesToExclude", {
+            help: "Listing of directories or patterns to exclude from the search for SBOM files. eg: **bin/start/**, **/start/**",
+            type: (value) => {
+                return (0, utilities_2.removeDuplicates)(value.split(",").map((pattern) => pattern.trim()));
+            },
+            default: constants_1.SOOS_SBOM_CONSTANTS.DefaultDirectoriesToExclude,
+            required: false,
+        });
+        analysisArgumentParser.argumentParser.add_argument("--filesToExclude", {
+            help: "Listing of files or patterns patterns to exclude from the search for SBOM files. eg: **/int**.cdx.json/, **/internal.cdx.json",
+            type: (value) => {
+                return value.split(",").map((pattern) => pattern.trim());
+            },
+            required: false,
+        });
         analysisArgumentParser.argumentParser.add_argument("sbomPath", {
             help: "The SBOM File to scan, it could be the location of the file or the file itself. When location is specified only the first file found will be scanned.",
         });
@@ -31,7 +48,15 @@ class SOOSSBOMAnalysis {
         let branchHash;
         let analysisId;
         let scanStatusUrl;
-        const sbomFilePath = await this.findSbomFilePath();
+        let sbomFilePaths = await this.findSbomFilePaths();
+        const hasMoreThanMaximumManifests = sbomFilePaths.length > constants_1.SOOS_SBOM_CONSTANTS.MaxSbomsPerScan;
+        if (hasMoreThanMaximumManifests) {
+            const filesToSkip = sbomFilePaths.slice(constants_1.SOOS_SBOM_CONSTANTS.MaxSbomsPerScan);
+            sbomFilePaths = sbomFilePaths.slice(0, constants_1.SOOS_SBOM_CONSTANTS.MaxSbomsPerScan);
+            const filesDetectedString = utilities_1.StringUtilities.pluralizeTemplate(sbomFilePaths.length, "file was", "files were");
+            const filesSkippedString = utilities_1.StringUtilities.pluralizeTemplate(filesToSkip.length, "file");
+            api_client_1.soosLogger.info(`The maximum number of SBOMs per scan is ${constants_1.SOOS_SBOM_CONSTANTS.MaxSbomsPerScan}. ${filesDetectedString} detected, and ${filesSkippedString} will be not be uploaded. \n`, `The following SBOMs will not be included in the scan: \n`, filesToSkip.map((file) => `  "${Path.parse(file).base}": "${file}"`).join("\n"));
+        }
         try {
             const result = await soosAnalysisService.setupScan({
                 clientId: this.args.clientId,
@@ -66,17 +91,22 @@ class SOOSSBOMAnalysis {
             analysisId = result.analysisId;
             scanStatusUrl = result.scanStatusUrl;
             api_client_1.soosLogger.logLineSeparator();
-            api_client_1.soosLogger.info("Uploading SBOM File...");
-            const formData = await soosAnalysisService.getAnalysisFilesAsFormData([sbomFilePath], this.args.sbomPath);
-            const manifestUploadResponse = await soosAnalysisService.analysisApiClient.uploadManifestFiles({
-                clientId: this.args.clientId,
-                projectHash,
-                branchHash,
-                analysisId,
-                manifestFiles: formData,
-                hasMoreThanMaximumManifests: false,
-            });
-            api_client_1.soosLogger.info(` SBOM Files: \n`, `  ${manifestUploadResponse.message} \n`, manifestUploadResponse.manifests?.map((m) => `  ${m.name}: ${m.statusMessage}`).join("\n"));
+            api_client_1.soosLogger.info("Uploading SBOM File(s)...");
+            for (let i = 0; i < sbomFilePaths.length; i += constants_1.SOOS_SBOM_CONSTANTS.UploadBatchSize) {
+                const sbomFilePathsBatch = sbomFilePaths.slice(i, i + constants_1.SOOS_SBOM_CONSTANTS.UploadBatchSize);
+                const formData = await soosAnalysisService.getAnalysisFilesAsFormData(sbomFilePathsBatch, this.args.sbomPath);
+                const manifestUploadResponse = await soosAnalysisService.analysisApiClient.uploadManifestFiles({
+                    clientId: this.args.clientId,
+                    projectHash,
+                    branchHash,
+                    analysisId,
+                    manifestFiles: formData,
+                    hasMoreThanMaximumManifests,
+                });
+                api_client_1.soosLogger.info(` SBOM Files: \n`, `  ${manifestUploadResponse.message} \n`, manifestUploadResponse.manifests
+                    ?.map((m) => `  ${m.name}: ${m.statusMessage}`)
+                    .join("\n"));
+            }
             api_client_1.soosLogger.logLineSeparator();
             await soosAnalysisService.startScan({
                 clientId: this.args.clientId,
@@ -112,20 +142,25 @@ class SOOSSBOMAnalysis {
             (0, process_1.exit)(1);
         }
     }
-    async findSbomFilePath() {
+    async findSbomFilePaths() {
         const sbomPathStat = await FileSystem.statSync(this.args.sbomPath);
         if (sbomPathStat.isDirectory()) {
-            const files = await FileSystem.promises.readdir(this.args.sbomPath);
-            const sbomFile = files.find((file) => constants_1.SOOS_SBOM_CONSTANTS.FileRegex.test(file));
-            if (!sbomFile) {
-                throw new Error("No SBOM file found in the directory.");
+            const searchPattern = this.args.sbomPath.endsWith("/") || this.args.sbomPath.endsWith("\\")
+                ? `${this.args.sbomPath}${constants_1.SOOS_SBOM_CONSTANTS.FileSyncPattern}`
+                : `${this.args.sbomPath}/${constants_1.SOOS_SBOM_CONSTANTS.FileSyncPattern}`;
+            const sbomFiles = Glob.sync(searchPattern, {
+                ignore: [...(this.args.filesToExclude || []), ...(this.args.directoriesToExclude || [])],
+                nocase: true,
+            });
+            if (!sbomFiles || sbomFiles.length == 0) {
+                throw new Error("No SBOM files found in the directory.");
             }
-            return Path.join(this.args.sbomPath, sbomFile);
+            return sbomFiles;
         }
         if (!constants_1.SOOS_SBOM_CONSTANTS.FileRegex.test(this.args.sbomPath)) {
             throw new Error("The file does not match the required SBOM pattern.");
         }
-        return this.args.sbomPath;
+        return [this.args.sbomPath];
     }
     static async createAndRun() {
         api_client_1.soosLogger.info("Starting SOOS SBOM Analysis");

package/bin/utilities.d.ts

@@ -0,0 +1 @@
+export declare const removeDuplicates: <T>(list: Array<T>) => Array<T>;

package/bin/utilities.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.removeDuplicates = void 0;
+const removeDuplicates = (list) => [...new Set(list)];
+exports.removeDuplicates = removeDuplicates;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@soos-io/soos-sbom",
-  "version": "1.0.1-pre.1",
+  "version": "1.0.1-pre.3",
   "description": "SOOS wrapper script to upload SBOMs.",
   "main": "bin/index.js",
   "scripts": {
@@ -39,16 +39,16 @@
   },
   "homepage": "https://github.com/soos-io/soos-sbom#readme",
   "dependencies": {
-    "@soos-io/api-client": "1.0.1",
+    "@soos-io/api-client": "1.0.5",
     "argparse": "^2.0.1",
     "glob": "^11.0.0",
     "tslib": "^2.6.3"
   },
   "devDependencies": {
-    "@types/argparse": "^2.0.15",
-    "@types/node": "^20.16.3",
+    "@types/argparse": "^2.0.16",
+    "@types/node": "^20.16.5",
     "prettier": "^3.3.3",
-    "typescript": "^5.5.4"
+    "typescript": "^5.6.2"
   },
   "bin": {
     "soos-sbom": "bin/index.js"