@soos-io/soos-scm-audit 0.0.1

package/README.md

@@ -0,0 +1,36 @@
+# [SOOS](https://soos.io/)
+
+SOOS is an independent software security company, located in Winooski, VT USA, building security software for your team. [SOOS, Software security, simplified](https://soos.io).
+
+Use SOOS to scan your software for [vulnerabilities](https://app.soos.io/research/vulnerabilities) and [open source license](https://app.soos.io/research/licenses) issues with [SOOS Core SCA](https://soos.io/products/sca). [Generate and ingest SBOMs](https://soos.io/products/sbom-manager). [Export reports](https://kb.soos.io/help/soos-reports-for-export) to industry standards. Govern your open source dependencies. Run the [SOOS DAST vulnerability scanner](https://soos.io/products/dast) against your web apps or APIs. [Scan your Docker containers](https://soos.io/products/containers) for vulnerabilities. Check your source code for issues with [SAST Analysis](https://soos.io/products/sast).
+
+[Demo SOOS](https://app.soos.io/demo) or [Register for a Free Trial](https://app.soos.io/register).
+
+If you maintain an Open Source project, sign up for the Free as in Beer [SOOS Community Edition](https://soos.io/products/community-edition).
+
+## Requirements
+  - [npm](https://docs.npmjs.com/downloading-and-installing-node-js-and-npm)
+  
+## Installation
+
+### Globally
+run `npm i -g @soos-io/soos-scm-audit@latest`
+Then Run `soos-scm-audit` from any terminal and add the parameters you want.
+
+### Locally
+run `npm install --prefix ./soos @soos-io/soos-scm-audit`
+Then run from the same terminal `node ./soos/node_modules/@soos-io/soos-scm-audit/bin/index.js`
+
+## Client Parameters
+
+
+| Argument                | Default                                   | Description                                                                                                                          |
+| ----------------------- | ----------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ |
+| `--apiKey`              |  | SOOS API Key - get yours from [SOOS Integration](https://app.soos.io/integrate/sca). Uses `SOOS_API_KEY` env value if present.      |
+| `--clientId`            |  | SOOS Client ID - get yours from [SOOS Integration](https://app.soos.io/integrate/sca). Uses `SOOS_API_CLIENT` env value if present.                                           |                                                                                       |
+| `--logLevel` |  | Minimum level to show logs: DEBUG INFO, WARN, FAIL, ERROR. |
+| `--saveResults`         |                                        | Save results to file.
+| `--scmType`         |                                        | Scm Type to use for the audit. Options: GitHub.
+| `--secret`         |                                        | Secret to use for api calls, for example when --scmType=GitHub this needs to have the value of a PAT.                                                                 |
+| `--organizationName`         |                                        | Organization name to run audit.                                                                     |
+| `--verbose`             | `false`                                   | Enable verbose logging.                                                                                                             |

package/bin/enums.d.ts

@@ -0,0 +1,7 @@
+export declare enum SCMSystem {
+    GitHub = "GitHub",
+    GitLab = "GitLab",
+    Bitbucket = "Bitbucket",
+    AzureDevOps = "AzureDevOps",
+    Other = "Other"
+}

package/bin/enums.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SCMSystem = void 0;
+var SCMSystem;
+(function (SCMSystem) {
+    SCMSystem["GitHub"] = "GitHub";
+    SCMSystem["GitLab"] = "GitLab";
+    SCMSystem["Bitbucket"] = "Bitbucket";
+    SCMSystem["AzureDevOps"] = "AzureDevOps";
+    SCMSystem["Other"] = "Other";
+})(SCMSystem || (exports.SCMSystem = SCMSystem = {}));

package/bin/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/bin/index.js

@@ -0,0 +1,54 @@
+#!/usr/bin/env node
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+const package_json_1 = require("../package.json");
+const api_client_1 = require("@soos-io/api-client");
+const process_1 = require("process");
+const utilities_1 = require("@soos-io/api-client/dist/utilities");
+const ContributorAuditService_1 = tslib_1.__importDefault(require("@soos-io/api-client/dist/services/ContributorAuditService/ContributorAuditService"));
+const ContributorAuditArgumentParser_1 = tslib_1.__importDefault(require("@soos-io/api-client/dist/services/ContributorAuditArgumentParser"));
+class SOOSSCMAudit {
+    constructor(args) {
+        this.args = args;
+    }
+    static parseArgs() {
+        const contributorAuditArgumentParser = ContributorAuditArgumentParser_1.default.create();
+        contributorAuditArgumentParser.addBaseContributorArguments();
+        api_client_1.soosLogger.info("Parsing arguments");
+        return contributorAuditArgumentParser.parseArguments();
+    }
+    async runAudit() {
+        const contributingDeveloperService = ContributorAuditService_1.default.create(this.args.apiKey, this.args.apiURL, this.args.scmType);
+        const auditParams = {
+            days: this.args.days,
+            secret: this.args.secret,
+            organizationName: this.args.organizationName,
+            scriptVersion: package_json_1.version,
+        };
+        api_client_1.soosLogger.info(`Running Contributing Developer audit for ${this.args.scmType}`);
+        const contributingDevelopers = await contributingDeveloperService.audit(auditParams);
+        await contributingDeveloperService.uploadContributorAudits(this.args.clientId, contributingDevelopers);
+        if (this.args.saveResults) {
+            contributingDeveloperService.saveResults(contributingDevelopers);
+        }
+    }
+    static async createAndRun() {
+        api_client_1.soosLogger.info("Starting SOOS SCM Contributor Audit");
+        api_client_1.soosLogger.logLineSeparator();
+        try {
+            const args = this.parseArgs();
+            api_client_1.soosLogger.setMinLogLevel(args.logLevel);
+            api_client_1.soosLogger.setVerbose(args.verbose);
+            api_client_1.soosLogger.verboseDebug(JSON.stringify((0, utilities_1.obfuscateProperties)(args, ["apiKey", "secret"]), null, 2));
+            api_client_1.soosLogger.logLineSeparator();
+            const soosSCMAudit = new SOOSSCMAudit(args);
+            await soosSCMAudit.runAudit();
+        }
+        catch (error) {
+            api_client_1.soosLogger.error(`Error on createAndRun: ${error}`);
+            (0, process_1.exit)(1);
+        }
+    }
+}
+SOOSSCMAudit.createAndRun();

package/bin/services/GitHubService.d.ts

@@ -0,0 +1,92 @@
+export interface GitHubOrganization {
+    login: string;
+    id: number;
+    node_id: string;
+    url: string;
+    repos_url: string;
+    events_url: string;
+    hooks_url: string;
+    issues_url: string;
+    members_url: string;
+    public_members_url: string;
+    avatar_url: string;
+    description: string | null;
+}
+export interface GitHubRepository {
+    id: number;
+    node_id: string;
+    name: string;
+    full_name: string;
+    private: boolean;
+    owner: GitHubOrganization;
+    html_url: string;
+    description: string | null;
+    fork: boolean;
+    url: string;
+    forks_url: string;
+    keys_url: string;
+    collaborators_url: string;
+    teams_url: string;
+    hooks_url: string;
+    issue_events_url: string;
+    events_url: string;
+    assignees_url: string;
+    branches_url: string;
+    tags_url: string;
+    blobs_url: string;
+    git_tags_url: string;
+    git_refs_url: string;
+    trees_url: string;
+    statuses_url: string;
+    languages_url: string;
+    stargazers_url: string;
+    contributors_url: string;
+    subscribers_url: string;
+    subscription_url: string;
+    commits_url: string;
+    git_commits_url: string;
+    comments_url: string;
+    issue_comment_url: string;
+    contents_url: string;
+    compare_url: string;
+    merges_url: string;
+    archive_url: string;
+    downloads_url: string;
+    issues_url: string;
+    pulls_url: string;
+    milestones_url: string;
+    notifications_url: string;
+    labels_url: string;
+    releases_url: string;
+    deployments_url: string;
+}
+export interface Commits {
+    commit: {
+        author: author;
+    };
+}
+export interface author {
+    name: string;
+    email: string;
+}
+interface ContributingDeveloper {
+    username: string;
+    repositories: ContributingDeveloperRepositories[];
+}
+interface ContributingDeveloperRepositories {
+    id: number;
+    name: string;
+    lastCommit: string;
+    isPrivate: boolean;
+}
+export declare const threeMonthsDate: string;
+declare class GitHubService {
+    githubPAT: string;
+    apiURL: string;
+    constructor(githubPAT: string, apiURL?: string);
+    static create(githubPAT: string): GitHubService;
+    getGithubOrgs(): Promise<GitHubOrganization[]>;
+    getGithubOrgRepos(org: GitHubOrganization): Promise<GitHubRepository[]>;
+    getContributorsForRepo(repository: GitHubRepository): Promise<ContributingDeveloper[]>;
+}
+export default GitHubService;

package/bin/services/GitHubService.js

@@ -0,0 +1,99 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.threeMonthsDate = void 0;
+const api_client_1 = require("@soos-io/api-client");
+const d = new Date();
+d.setDate(d.getDate() - 90);
+exports.threeMonthsDate = `${d.getUTCFullYear()}-${d.getMonth() + 1}-${d.getUTCDate()}T${d.getHours()}:${d.getMinutes()}:${d.getSeconds()}Z`;
+class GitHubService {
+    constructor(githubPAT, apiURL = "https://api.github.com") {
+        this.githubPAT = githubPAT;
+        this.apiURL = apiURL;
+    }
+    static create(githubPAT) {
+        return new GitHubService(githubPAT);
+    }
+    async getGithubOrgs() {
+        const url = `${this.apiURL}/user/orgs?per_page=100`;
+        api_client_1.soosLogger.verboseDebug(`Fetching GitHub orgs from ${url}`);
+        const response = await fetch(url, {
+            method: "GET",
+            headers: {
+                accept: "application/vnd.github+json",
+                Authorization: `Bearer ${this.githubPAT}`,
+            },
+        });
+        if (!response.ok) {
+            throw new Error(`Failed to fetch GitHub orgs: ${response.statusText}`);
+        }
+        api_client_1.soosLogger.verboseDebug(`Fetched GitHub orgs from ${url}`);
+        const orgs = await response.json();
+        api_client_1.soosLogger.verboseDebug(`GitHub orgs response: ${JSON.stringify(orgs)}`);
+        return orgs;
+    }
+    async getGithubOrgRepos(org) {
+        const url = `${this.apiURL}/orgs/${org.login}/repos?per_page=1`;
+        api_client_1.soosLogger.verboseDebug(`Fetching GitHub org repos from ${url}`);
+        const response = await fetch(url, {
+            method: "GET",
+            headers: {
+                accept: "application/vnd.github+json",
+                Authorization: `Bearer ${this.githubPAT}`,
+            },
+        });
+        if (!response.ok) {
+            throw new Error(`Failed to fetch GitHub org repos: ${response.statusText}`);
+        }
+        api_client_1.soosLogger.verboseDebug(`Fetched GitHub org repos from ${url}`);
+        const repos = await response.json();
+        api_client_1.soosLogger.verboseDebug(`GitHub org repos response: ${JSON.stringify(repos)}`);
+        return repos;
+    }
+    async getContributorsForRepo(repository) {
+        const url = `${this.apiURL}/repos/${repository.owner.login}/${repository.name}/commits?per_page=100&since=${exports.threeMonthsDate}`;
+        api_client_1.soosLogger.verboseDebug(`Fetching GitHub repo contributors from ${url}`);
+        const response = await fetch(url, {
+            method: "GET",
+            headers: {
+                accept: "application/vnd.github+json",
+                Authorization: `Bearer ${this.githubPAT}`,
+            },
+        });
+        if (!response.ok) {
+            throw new Error(`Failed to fetch GitHub repo contributors: ${response.statusText}`);
+        }
+        api_client_1.soosLogger.verboseDebug(`Fetched GitHub repo contributors from ${url}`);
+        const commits = await response.json();
+        const contributors = [];
+        commits.forEach(commit => {
+            const username = commit.commit.author;
+            const repo = {
+                id: repository.id,
+                name: repository.name,
+                lastCommit: exports.threeMonthsDate,
+                isPrivate: repository.private
+            };
+            const existingContributor = contributors.find(contributor => contributor.username === username.name);
+            if (existingContributor) {
+                existingContributor.repositories.forEach(existingRepo => {
+                    if (existingRepo.id === repo.id) {
+                        api_client_1.soosLogger.info("Repo already exists in the list");
+                        return;
+                    }
+                    else {
+                        existingContributor.repositories.push(repo);
+                    }
+                });
+            }
+            else {
+                contributors.push({
+                    username: username.name,
+                    repositories: [repo]
+                });
+            }
+        });
+        api_client_1.soosLogger.verboseDebug(`GitHub repo contributors response: ${JSON.stringify(contributors)}`);
+        return contributors;
+    }
+}
+exports.default = GitHubService;

package/package.json

@@ -0,0 +1,44 @@
+{
+  "name": "@soos-io/soos-scm-audit",
+  "version": "0.0.1",
+  "description": "SOOS SCM Audit CLI",
+  "main": "bin/index.js",
+  "scripts": {
+    "setup:install": "npm install",
+    "setup:clean-install": "npm ci",
+    "setup:update": "npx npm-check -u",
+    "setup:clean": "npx rimraf node_modules && npx rimraf package-lock.json",
+    "build": "tsc",
+    "build:clean": "npx rimraf build",
+    "format": "prettier ./src --check",
+    "format:fix": "prettier ./src --write",
+    "typecheck": "tsc --noEmit",
+    "check": "npm run format && npm run typecheck && npm outdated",
+    "patch-api-client": "npm version patch --no-git-tag-version && npm run setup:clean && npm install @soos-io/api-client@latest --save-exact && npm install && npm run check",
+    "link:local": "npm link @soos-io/api-client && npm run build && npm link"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/soos-io/soos-scm-audit.git"
+  },
+  "author": "SOOS",
+  "license": "MIT",
+  "bugs": {
+    "url": "https://github.com/soos-io/soos-scm-audit/issues"
+  },
+  "homepage": "https://github.com/soos-io/soos-scm-audit#readme",
+  "dependencies": {
+    "@soos-io/api-client": "0.2.32",
+    "argparse": "^2.0.1",
+    "tslib": "^2.6.2"
+  },
+  "devDependencies": {
+    "@types/argparse": "^2.0.11",
+    "@types/node": "^20.11.5",
+    "prettier": "^3.2.4",
+    "typescript": "^5.3.3"
+  },
+  "bin": {
+    "soos-scm-audit": "bin/index.js"
+  }
+}

package/soos_contributor_audit.json

@@ -0,0 +1,264 @@
+{
+  "metadata": {
+    "scriptVersion": "0.0.1",
+    "days": 90
+  },
+  "organizationName": "soos-io",
+  "contributors": [
+    {
+      "username": "SOOS-GSteen",
+      "repositories": [
+        {
+          "id": 391059521,
+          "name": "soos-ci-analysis-python",
+          "lastCommit": "2023-11-15T18:34:28Z",
+          "isPrivate": false
+        },
+        {
+          "id": 391060504,
+          "name": "soos-sca-github-action",
+          "lastCommit": "2024-01-04T13:52:17Z",
+          "isPrivate": false
+        },
+        {
+          "id": 417488624,
+          "name": "soos-dast",
+          "lastCommit": "2024-01-18T20:08:17Z",
+          "isPrivate": false
+        },
+        {
+          "id": 421561326,
+          "name": "soos-dast-github-action",
+          "lastCommit": "2023-12-01T16:33:47Z",
+          "isPrivate": false
+        },
+        {
+          "id": 703769955,
+          "name": "soos-csa",
+          "lastCommit": "2024-01-18T20:03:54Z",
+          "isPrivate": false
+        },
+        {
+          "id": 707826823,
+          "name": "soos-api-client",
+          "lastCommit": "2024-01-18T19:53:48Z",
+          "isPrivate": false
+        },
+        {
+          "id": 715746107,
+          "name": "soos-sbom",
+          "lastCommit": "2024-01-18T20:13:00Z",
+          "isPrivate": false
+        },
+        {
+          "id": 717064373,
+          "name": "soos-csa-github-action",
+          "lastCommit": "2023-12-21T16:14:19Z",
+          "isPrivate": false
+        },
+        {
+          "id": 720060036,
+          "name": "soos-sast",
+          "lastCommit": "2024-01-18T20:10:23Z",
+          "isPrivate": false
+        },
+        {
+          "id": 721676171,
+          "name": "soos-sast-github-action",
+          "lastCommit": "2023-12-21T16:13:20Z",
+          "isPrivate": false
+        },
+        {
+          "id": 724596621,
+          "name": "soos-sca",
+          "lastCommit": "2024-01-18T20:11:50Z",
+          "isPrivate": false
+        }
+      ]
+    },
+    {
+      "username": "SOOS-JAlvarez",
+      "repositories": [
+        {
+          "id": 391060504,
+          "name": "soos-sca-github-action",
+          "lastCommit": "2023-12-26T14:52:44Z",
+          "isPrivate": false
+        },
+        {
+          "id": 391061021,
+          "name": "soos-ci-analysis-circleci-orb",
+          "lastCommit": "2023-12-26T14:56:14Z",
+          "isPrivate": false
+        },
+        {
+          "id": 409715211,
+          "name": "soos-integration-java-core",
+          "lastCommit": "2024-01-15T14:04:25Z",
+          "isPrivate": false
+        },
+        {
+          "id": 417488624,
+          "name": "soos-dast",
+          "lastCommit": "2024-01-11T17:54:10Z",
+          "isPrivate": false
+        },
+        {
+          "id": 421561326,
+          "name": "soos-dast-github-action",
+          "lastCommit": "2024-01-03T15:20:21Z",
+          "isPrivate": false
+        },
+        {
+          "id": 424384707,
+          "name": "kb-docs",
+          "lastCommit": "2024-01-09T18:15:47Z",
+          "isPrivate": false
+        },
+        {
+          "id": 488242034,
+          "name": "soos-dast-circleci-orb",
+          "lastCommit": "2023-11-28T19:02:29Z",
+          "isPrivate": false
+        },
+        {
+          "id": 560396288,
+          "name": "zaproxy",
+          "lastCommit": "2024-01-02T18:17:40Z",
+          "isPrivate": false
+        },
+        {
+          "id": 587360611,
+          "name": "sample-project-python",
+          "lastCommit": "2024-01-11T14:43:17Z",
+          "isPrivate": false
+        },
+        {
+          "id": 587363859,
+          "name": "sample-project-nuget",
+          "lastCommit": "2024-01-11T14:42:21Z",
+          "isPrivate": false
+        },
+        {
+          "id": 587366020,
+          "name": "sample-project-npm",
+          "lastCommit": "2024-01-11T14:48:26Z",
+          "isPrivate": false
+        },
+        {
+          "id": 592821605,
+          "name": "sample-project-node-package-fetch",
+          "lastCommit": "2024-01-11T14:53:07Z",
+          "isPrivate": false
+        },
+        {
+          "id": 592878845,
+          "name": "sample-project-node-vulnerability-fetch",
+          "lastCommit": "2024-01-11T14:52:05Z",
+          "isPrivate": false
+        },
+        {
+          "id": 592896836,
+          "name": "sample-project-node-license-fetch",
+          "lastCommit": "2024-01-11T14:51:00Z",
+          "isPrivate": false
+        },
+        {
+          "id": 596250526,
+          "name": "sample-project-dart",
+          "lastCommit": "2024-01-11T14:55:03Z",
+          "isPrivate": false
+        },
+        {
+          "id": 596576194,
+          "name": "sample-project-erlang",
+          "lastCommit": "2024-01-11T14:43:25Z",
+          "isPrivate": false
+        },
+        {
+          "id": 597169916,
+          "name": "sample-project-go",
+          "lastCommit": "2024-01-11T14:43:00Z",
+          "isPrivate": false
+        },
+        {
+          "id": 598310766,
+          "name": "sample-project-ruby",
+          "lastCommit": "2024-01-11T15:09:20Z",
+          "isPrivate": false
+        },
+        {
+          "id": 598814834,
+          "name": "sample-project-php",
+          "lastCommit": "2024-01-11T14:42:52Z",
+          "isPrivate": false
+        },
+        {
+          "id": 599211441,
+          "name": "sample-project-rust",
+          "lastCommit": "2024-01-11T14:42:31Z",
+          "isPrivate": false
+        },
+        {
+          "id": 703769955,
+          "name": "soos-csa",
+          "lastCommit": "2023-12-20T17:57:18Z",
+          "isPrivate": false
+        },
+        {
+          "id": 707826823,
+          "name": "soos-api-client",
+          "lastCommit": "2024-01-22T19:12:32Z",
+          "isPrivate": false
+        },
+        {
+          "id": 715746107,
+          "name": "soos-sbom",
+          "lastCommit": "2024-01-16T12:44:31Z",
+          "isPrivate": false
+        },
+        {
+          "id": 717064373,
+          "name": "soos-csa-github-action",
+          "lastCommit": "2023-12-14T14:50:37Z",
+          "isPrivate": false
+        },
+        {
+          "id": 719078266,
+          "name": "soos-sbom-github-action",
+          "lastCommit": "2023-11-17T18:19:48Z",
+          "isPrivate": false
+        },
+        {
+          "id": 720060036,
+          "name": "soos-sast",
+          "lastCommit": "2024-01-16T12:44:36Z",
+          "isPrivate": false
+        },
+        {
+          "id": 721676171,
+          "name": "soos-sast-github-action",
+          "lastCommit": "2024-01-02T18:33:05Z",
+          "isPrivate": false
+        },
+        {
+          "id": 724596621,
+          "name": "soos-sca",
+          "lastCommit": "2023-12-21T15:30:03Z",
+          "isPrivate": false
+        }
+      ]
+    },
+    {
+      "username": "SOOS-JGomez",
+      "repositories": [
+        {
+          "id": 499192142,
+          "name": "sca-dast-aws-codebuild-cloud",
+          "lastCommit": "2023-12-15T16:22:18Z",
+          "isPrivate": false
+        }
+      ]
+    }
+  ]
+}