azure-devops-extension-api 4.226.0 → 4.228.0

package/Alert/Alert.d.ts

@@ -0,0 +1,484 @@
+import * as WebApi from "../WebApi/WebApi";
+export interface Alert {
+    /**
+     * Identifier for the alert. It is unqiue within Azure DevOps organization.
+     */
+    alertId: number;
+    /**
+     * Type of the alert. E.g. secret, code, etc.
+     */
+    alertType: AlertType;
+    /**
+     * Contains information for the dismissal of the alert if the alert has been dismissed.
+     */
+    dismissal: Dismissal;
+    /**
+     * This value is computed and returned by the service. This value represents the first time the service has seen this issue reported in an analysis instance.
+     */
+    firstSeenDate: Date;
+    /**
+     * This value is computed and returned by the service. If the issue is fixed, this value represents the time the service has seen this issue fixed in an analysis instance.
+     */
+    fixedDate: Date;
+    /**
+     * Reference to a git object, e.g. branch ref.
+     */
+    gitRef: string;
+    /**
+     * This value is computed and returned by the service. This value represents the first time the vulnerability was introduced.
+     */
+    introducedDate: Date;
+    /**
+     * This value is computed and returned by the service. This value represents the last time the service has seen this issue reported in an analysis instance.
+     */
+    lastSeenDate: Date;
+    /**
+     * Logical locations for the alert. This value is computed and returned by the service. It is a value based on the results from all analysis configurations. An example of a logical location is a component.
+     */
+    logicalLocations: LogicalLocation[];
+    /**
+     * This value is computed and returned by the service. It is a value based on the results from all analysis configurations. An example of a physical location is a file location.
+     */
+    physicalLocations: PhysicalLocation[];
+    /**
+     * Repository URL where the alert was detected.
+     */
+    repositoryUrl: string;
+    /**
+     * Severity of the alert.
+     */
+    severity: Severity;
+    /**
+     * This value is computed and returned by the service. It is a value based on the results from all analysis configurations.
+     */
+    state: State;
+    /**
+     * Title will only be rendered as text and does not support markdown formatting. There is a maximum character limit of 256.
+     */
+    title: string;
+    /**
+     * Tools that have detected this issue.
+     */
+    tools: Tool[];
+}
+/**
+ * Summary of the state of the alert for a given analysis configuration.
+ */
+export interface AlertAnalysisInstance {
+    /**
+     * Analysis configuration.
+     */
+    analysisConfiguration: AnalysisConfiguration;
+    /**
+     * Analysis instance where the issue was first detected for a given analysis configuration.
+     */
+    firstSeen: AnalysisInstance;
+    /**
+     * Analysis instance where the issue was fixed for a given analysis configuration.
+     */
+    fixedIn: AnalysisInstance;
+    /**
+     * Analysis instance where the issue was last detected for a given analysis configuration.
+     */
+    lastSeen: AnalysisInstance;
+    /**
+     * The most recent instatnce of the analysis.
+     */
+    recentAnalysisInstance: AnalysisInstance;
+    /**
+     * Result state for a given analysis configuration.
+     */
+    state: State;
+}
+export interface AlertStateUpdate {
+    dismissedComment: string;
+    dismissedReason: DismissalType;
+    state: State;
+}
+export declare enum AlertType {
+    Unknown = 0,
+    Dependency = 1,
+    Secret = 2,
+    Code = 3
+}
+/**
+ * AnalysisConfiguration class models a build definition.
+ */
+export interface AnalysisConfiguration {
+    /**
+     * Details for the configuration. Populated values depend on the type of configuration.
+     */
+    analysisConfigurationDetails: AnalysisConfigurationDetails;
+    /**
+     * Identifier for the analysis configuration.
+     */
+    analysisConfigurationId: number;
+    /**
+     * Type of the configuration.
+     */
+    analysisConfigurationType: AnalysisConfigurationType;
+    /**
+     * Name of the tool that ran on this configuration.
+     */
+    toolName: string;
+    /**
+     * The latest version of the tool that ran on this configuration.
+     */
+    toolVersion: string;
+}
+export interface AnalysisConfigurationDetails {
+    /**
+     * Reference to a git object, e.g. branch ref.
+     */
+    gitRef: string;
+    /**
+     * Is this the default branch?
+     */
+    isDefaultBranch: boolean;
+    /**
+     * Phase ID of the pipeline.
+     */
+    phaseId: string;
+    /**
+     * Phase name.
+     */
+    phaseName: string;
+    /**
+     * AzureDevOps pipeline id.
+     */
+    pipelineId: number;
+    /**
+     * Name of the pipeline.
+     */
+    pipelineName: string;
+}
+export declare enum AnalysisConfigurationType {
+    /**
+     * Default analysis configuration that is not attached to any other configuration data
+     */
+    Default = 0,
+    /**
+     * Ado Pipeline, contains branch, pipeline, phase, and ADOPipelineId
+     */
+    AdoPipeline = 1
+}
+/**
+ * AnalysisInstance class models a build.
+ */
+export interface AnalysisInstance {
+    /**
+     * CommitId is a commit id for that instance
+     */
+    commitId: string;
+    /**
+     * Analysis configuration.
+     */
+    configuration: AnalysisConfiguration;
+    /**
+     * Date when the analysis was created.
+     */
+    createdDate: Date;
+    /**
+     * InstanceIdentifier is a key that uniquely establishes this instance
+     */
+    instanceIdentifier: string;
+    /**
+     * Results that were reported by the analysis.
+     */
+    results: AnalysisResult[];
+    /**
+     * Url is the permalink to the build.
+     */
+    url: string;
+}
+export interface AnalysisResult {
+    analysisResultId: number;
+    firstIntroducedInstanceId: number;
+    fixedInstanceId: number;
+    introducedInstanceId: number;
+    lastSeenInstanceId: number;
+    result: Result;
+    state: State;
+}
+export interface Branch {
+    branchId: number;
+    deletedDate: Date;
+    name: string;
+}
+/**
+ * This enum defines the dependency components.
+ */
+export declare enum ComponentType {
+    Unknown = 0,
+    NuGet = 1,
+    /**
+     * Indicates the component is an Npm package.
+     */
+    Npm = 2,
+    /**
+     * Indicates the component is a Maven artifact.
+     */
+    Maven = 3,
+    /**
+     * Indicates the component is a Git repository.
+     */
+    Git = 4,
+    /**
+     * Indicates the component is not any of the supported component types by Governance.
+     */
+    Other = 5,
+    /**
+     * Indicates the component is a Ruby gem.
+     */
+    RubyGems = 6,
+    /**
+     * Indicates the component is a Cargo package.
+     */
+    Cargo = 7,
+    /**
+     * Indicates the component is a Pip package.
+     */
+    Pip = 8,
+    /**
+     * Indicates the component is a loose file. Not a package as understood by different package managers.
+     */
+    File = 9,
+    Go = 10,
+    /**
+     * Indicates the component is a Docker Image
+     */
+    DockerImage = 11,
+    /**
+     * Indicates the component is a CocoaPods pod.
+     */
+    Pod = 12,
+    /**
+     * Indicates the component is found in a linux environment. A package understood by linux based package managers like apt and rpm.
+     */
+    Linux = 13,
+    /**
+     * Indicates the component is a Conda package.
+     */
+    Conda = 14,
+    /**
+     * Indicates the component is a Docker Reference.
+     */
+    DockerReference = 15,
+    /**
+     * Indicates the component is a Vcpkg Package.
+     */
+    Vcpkg = 16
+}
+export interface Dependency {
+    componentName: string;
+    componentType: ComponentType;
+    componentVersion: string;
+    dependencyId: number;
+}
+export interface DependencyResult {
+    dependency: Dependency;
+    dependencyResultId: number;
+    resultId: number;
+    rootDependencyId: number;
+    versionControlFilePath: VersionControlFilePath;
+}
+export interface Dismissal {
+    dismissalId: number;
+    dismissalType: DismissalType;
+    message: string;
+    requestedOn: Date;
+    stateChangedBy: string;
+    stateChangedByIdentity: WebApi.IdentityRef;
+}
+export declare enum DismissalType {
+    /**
+     * Dismissal type unknown
+     */
+    Unknown = 0,
+    /**
+     * Dismissal indicating alert has been fixed
+     */
+    Fixed = 1,
+    /**
+     * Dismissal indicating user is accepting a risk for the alert
+     */
+    AcceptedRisk = 2,
+    /**
+     * Dismissal indicating alert is a false positive and will likely not be fixed.
+     */
+    FalsePositive = 3
+}
+export interface LogicalLocation {
+    fullyQualifiedName: string;
+    /**
+     * Possible values: "unknown" "rootDependency" and "vulnerableDependency"
+     */
+    kind: string;
+}
+export interface PhysicalLocation {
+    filePath: string;
+    region: Region;
+    versionControl: VersionControlDetails;
+}
+export interface Pipeline {
+    adoPipelineId: number;
+    name: string;
+    phase: string;
+    phaseId: string;
+}
+export interface Region {
+    columnEnd: number;
+    columnStart: number;
+    highlightSnippet: string;
+    lineEnd: number;
+    lineStart: number;
+    snippet: string;
+}
+export interface Result {
+    dependencyResult: DependencyResult;
+    fingerprint: string;
+    fingerprintId: number;
+    resultId: number;
+    /**
+     * This is the index into the SARIF Results array. If we have to do any tool specific insertions, we'll use this key to index back into the SARIF Results array.
+     */
+    resultIndex: number;
+    resultMessage: string;
+    resultType: ResultType;
+    ruleId: number;
+    ruleShortDescription: string;
+    severity: Severity;
+    versionControlResult: VersionControlResult;
+}
+/**
+ * This enum defines the different result types.
+ */
+export declare enum ResultType {
+    Unknown = 0,
+    Dependency = 1,
+    VersionControl = 2
+}
+/**
+ * The analysis rule that caused the alert.
+ */
+export interface Rule {
+    description: string;
+    friendlyName: string;
+    helpMessage: string;
+    opaqueId: string;
+    /**
+     * Markdown-formatted list of resources to learn more about the Rule. In some cases, RuleInfo.AdditionalProperties.advisoryUrls is used instead.
+     */
+    resources: string;
+    tags: string[];
+}
+export interface SearchCriteria {
+    /**
+     * If provided, only return alerts of this type. Otherwise, return alerts of all types.
+     */
+    alertType: AlertType;
+    /**
+     * If provided, only alerts for this dependency are returned. \<br /\>Otherwise, return alerts for all dependencies. \<br /\>In a sarif submission, a dependency (or a vulnerable component) is specified in result.RelatedLocations[].logicalLocation.
+     */
+    dependencyName: string;
+    /**
+     * If provided, only return alerts last seen after this date. \<br /\>Otherwise return all alerts.
+     */
+    fromDate: Date;
+    /**
+     * If provided, only return alerts whose titles match this pattern.
+     */
+    keywords: string;
+    /**
+     * If true, only return alerts found on the default branch of the repository. \<br /\>If there have been no runs completed on the default branch, the last run is used instead regardless of the branch used for that run. \<br /\>This option is ignored if branchName or ref are provided.
+     */
+    onlyDefaultBranchAlerts: boolean;
+    /**
+     * If provided with pipelineName, only return alerts detected in this pipeline phase \<br /\>Otherwise, return alerts detected in all phases.
+     */
+    phaseId: string;
+    /**
+     * If provided with pipelineName, only return alerts detected in this pipeline phase \<br /\>Otherwise, return alerts detected in all phases.
+     */
+    phaseName: string;
+    /**
+     * If provided, only return alerts detected in this pipeline. \<br /\>Otherwise, return alerts detected in all pipelines.
+     */
+    pipelineName: string;
+    /**
+     * If provided, only include alerts for this ref. \<br /\>If not provided and OnlyDefaultBranch is true, only include alerts found on the default branch or last run branch if there is no analysis configuration for the default branch. \<br /\>Otherwise, include alerts from all branches.
+     */
+    ref: string;
+    /**
+     * If provided, only return alerts for this rule. \<br /\>Otherwise, return alerts of all rules.
+     */
+    ruleId: string;
+    /**
+     * If provided, only return alerts for this rule. \<br /\>Otherwise, return alerts for all rules.
+     */
+    ruleName: string;
+    /**
+     * If provided, only return alerts at these severities. \<br /\>Otherwise, return alerts at any serverity.
+     */
+    severities: Severity[];
+    /**
+     * If provided, only return alerts in these states. \<br /\>Otherwise, return alerts in any state.
+     */
+    states: State[];
+    /**
+     * If provided, only return alerts last seen before this date. \<br /\>Otherwise return all alerts.
+     */
+    toDate: Date;
+}
+export declare enum Severity {
+    Low = 0,
+    Medium = 1,
+    High = 2,
+    Critical = 3
+}
+export declare enum State {
+    Unknown = 0,
+    Active = 1,
+    Dismissed = 2,
+    Fixed = 4,
+    AutoDismissed = 8
+}
+export interface Tool {
+    name: string;
+    rules: Rule[];
+}
+export interface UxFilters {
+    branches: Branch[];
+    packages: Dependency[];
+    pipelines: Pipeline[];
+    progressPercentage: number;
+    rules: Rule[];
+    secretTypes: string[];
+    severities: Severity[];
+    states: State[];
+}
+export interface VersionControlDetails {
+    commitHash: string;
+    itemUrl: string;
+}
+export interface VersionControlFilePath {
+    filePath: string;
+    filePathHash: number[];
+    versionControlFilePathId: number;
+}
+export interface VersionControlResult {
+    resultId: number;
+    versionControlSnippet: VersionControlSnippet;
+}
+export interface VersionControlSnippet {
+    endColumn: number;
+    endLine: number;
+    highlightSnippet: string;
+    snippet: string;
+    startColumn: number;
+    startLine: number;
+    versionControl: string;
+    versionControlFilePath: VersionControlFilePath;
+    versionControlFilePathId: number;
+    versionControlSnippetId: number;
+}

package/Alert/Alert.js

@@ -0,0 +1,135 @@
+/*
+ * ---------------------------------------------------------
+ * Copyright(C) Microsoft Corporation. All rights reserved.
+ * ---------------------------------------------------------
+ */
+define(["require", "exports"], function (require, exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    var AlertType;
+    (function (AlertType) {
+        AlertType[AlertType["Unknown"] = 0] = "Unknown";
+        AlertType[AlertType["Dependency"] = 1] = "Dependency";
+        AlertType[AlertType["Secret"] = 2] = "Secret";
+        AlertType[AlertType["Code"] = 3] = "Code";
+    })(AlertType = exports.AlertType || (exports.AlertType = {}));
+    var AnalysisConfigurationType;
+    (function (AnalysisConfigurationType) {
+        /**
+         * Default analysis configuration that is not attached to any other configuration data
+         */
+        AnalysisConfigurationType[AnalysisConfigurationType["Default"] = 0] = "Default";
+        /**
+         * Ado Pipeline, contains branch, pipeline, phase, and ADOPipelineId
+         */
+        AnalysisConfigurationType[AnalysisConfigurationType["AdoPipeline"] = 1] = "AdoPipeline";
+    })(AnalysisConfigurationType = exports.AnalysisConfigurationType || (exports.AnalysisConfigurationType = {}));
+    /**
+     * This enum defines the dependency components.
+     */
+    var ComponentType;
+    (function (ComponentType) {
+        ComponentType[ComponentType["Unknown"] = 0] = "Unknown";
+        ComponentType[ComponentType["NuGet"] = 1] = "NuGet";
+        /**
+         * Indicates the component is an Npm package.
+         */
+        ComponentType[ComponentType["Npm"] = 2] = "Npm";
+        /**
+         * Indicates the component is a Maven artifact.
+         */
+        ComponentType[ComponentType["Maven"] = 3] = "Maven";
+        /**
+         * Indicates the component is a Git repository.
+         */
+        ComponentType[ComponentType["Git"] = 4] = "Git";
+        /**
+         * Indicates the component is not any of the supported component types by Governance.
+         */
+        ComponentType[ComponentType["Other"] = 5] = "Other";
+        /**
+         * Indicates the component is a Ruby gem.
+         */
+        ComponentType[ComponentType["RubyGems"] = 6] = "RubyGems";
+        /**
+         * Indicates the component is a Cargo package.
+         */
+        ComponentType[ComponentType["Cargo"] = 7] = "Cargo";
+        /**
+         * Indicates the component is a Pip package.
+         */
+        ComponentType[ComponentType["Pip"] = 8] = "Pip";
+        /**
+         * Indicates the component is a loose file. Not a package as understood by different package managers.
+         */
+        ComponentType[ComponentType["File"] = 9] = "File";
+        ComponentType[ComponentType["Go"] = 10] = "Go";
+        /**
+         * Indicates the component is a Docker Image
+         */
+        ComponentType[ComponentType["DockerImage"] = 11] = "DockerImage";
+        /**
+         * Indicates the component is a CocoaPods pod.
+         */
+        ComponentType[ComponentType["Pod"] = 12] = "Pod";
+        /**
+         * Indicates the component is found in a linux environment. A package understood by linux based package managers like apt and rpm.
+         */
+        ComponentType[ComponentType["Linux"] = 13] = "Linux";
+        /**
+         * Indicates the component is a Conda package.
+         */
+        ComponentType[ComponentType["Conda"] = 14] = "Conda";
+        /**
+         * Indicates the component is a Docker Reference.
+         */
+        ComponentType[ComponentType["DockerReference"] = 15] = "DockerReference";
+        /**
+         * Indicates the component is a Vcpkg Package.
+         */
+        ComponentType[ComponentType["Vcpkg"] = 16] = "Vcpkg";
+    })(ComponentType = exports.ComponentType || (exports.ComponentType = {}));
+    var DismissalType;
+    (function (DismissalType) {
+        /**
+         * Dismissal type unknown
+         */
+        DismissalType[DismissalType["Unknown"] = 0] = "Unknown";
+        /**
+         * Dismissal indicating alert has been fixed
+         */
+        DismissalType[DismissalType["Fixed"] = 1] = "Fixed";
+        /**
+         * Dismissal indicating user is accepting a risk for the alert
+         */
+        DismissalType[DismissalType["AcceptedRisk"] = 2] = "AcceptedRisk";
+        /**
+         * Dismissal indicating alert is a false positive and will likely not be fixed.
+         */
+        DismissalType[DismissalType["FalsePositive"] = 3] = "FalsePositive";
+    })(DismissalType = exports.DismissalType || (exports.DismissalType = {}));
+    /**
+     * This enum defines the different result types.
+     */
+    var ResultType;
+    (function (ResultType) {
+        ResultType[ResultType["Unknown"] = 0] = "Unknown";
+        ResultType[ResultType["Dependency"] = 1] = "Dependency";
+        ResultType[ResultType["VersionControl"] = 2] = "VersionControl";
+    })(ResultType = exports.ResultType || (exports.ResultType = {}));
+    var Severity;
+    (function (Severity) {
+        Severity[Severity["Low"] = 0] = "Low";
+        Severity[Severity["Medium"] = 1] = "Medium";
+        Severity[Severity["High"] = 2] = "High";
+        Severity[Severity["Critical"] = 3] = "Critical";
+    })(Severity = exports.Severity || (exports.Severity = {}));
+    var State;
+    (function (State) {
+        State[State["Unknown"] = 0] = "Unknown";
+        State[State["Active"] = 1] = "Active";
+        State[State["Dismissed"] = 2] = "Dismissed";
+        State[State["Fixed"] = 4] = "Fixed";
+        State[State["AutoDismissed"] = 8] = "AutoDismissed";
+    })(State = exports.State || (exports.State = {}));
+});

package/Alert/Alert.min.js

@@ -0,0 +1 @@
+define(["require","exports"],function(e,n){"use strict";Object.defineProperty(n,"__esModule",{value:!0});!function(e){e[e.Unknown=0]="Unknown",e[e.Dependency=1]="Dependency",e[e.Secret=2]="Secret",e[e.Code=3]="Code"}(n.AlertType||(n.AlertType={}));!function(e){e[e.Default=0]="Default",e[e.AdoPipeline=1]="AdoPipeline"}(n.AnalysisConfigurationType||(n.AnalysisConfigurationType={}));!function(e){e[e.Unknown=0]="Unknown",e[e.NuGet=1]="NuGet",e[e.Npm=2]="Npm",e[e.Maven=3]="Maven",e[e.Git=4]="Git",e[e.Other=5]="Other",e[e.RubyGems=6]="RubyGems",e[e.Cargo=7]="Cargo",e[e.Pip=8]="Pip",e[e.File=9]="File",e[e.Go=10]="Go",e[e.DockerImage=11]="DockerImage",e[e.Pod=12]="Pod",e[e.Linux=13]="Linux",e[e.Conda=14]="Conda",e[e.DockerReference=15]="DockerReference",e[e.Vcpkg=16]="Vcpkg"}(n.ComponentType||(n.ComponentType={}));!function(e){e[e.Unknown=0]="Unknown",e[e.Fixed=1]="Fixed",e[e.AcceptedRisk=2]="AcceptedRisk",e[e.FalsePositive=3]="FalsePositive"}(n.DismissalType||(n.DismissalType={}));!function(e){e[e.Unknown=0]="Unknown",e[e.Dependency=1]="Dependency",e[e.VersionControl=2]="VersionControl"}(n.ResultType||(n.ResultType={}));!function(e){e[e.Low=0]="Low",e[e.Medium=1]="Medium",e[e.High=2]="High",e[e.Critical=3]="Critical"}(n.Severity||(n.Severity={}));!function(e){e[e.Unknown=0]="Unknown",e[e.Active=1]="Active",e[e.Dismissed=2]="Dismissed",e[e.Fixed=4]="Fixed",e[e.AutoDismissed=8]="AutoDismissed"}(n.State||(n.State={}))});

package/Alert/AlertClient.d.ts

@@ -0,0 +1,68 @@
+import { IVssRestClientOptions } from "../Common/Context";
+import { RestClientBase } from "../Common/RestClientBase";
+import * as Alert from "../Alert/Alert";
+import * as WebApi from "../WebApi/WebApi";
+export declare class AlertRestClient extends RestClientBase {
+    constructor(options: IVssRestClientOptions);
+    /**
+     * @param project - Project ID or project name
+     * @param alertId -
+     * @param repository -
+     * @param ref -
+     */
+    getAlert(project: string, alertId: number, repository: string, ref?: string): Promise<Alert.Alert>;
+    /**
+     * Get alerts for a repository
+     *
+     * @param project - Project ID or project name
+     * @param repository - The name or ID of the repository
+     * @param top - The maximum number of alerts to return
+     * @param orderBy - Must be "id" "firstSeen" "lastSeen" "fixedOn" or "severity"  Defaults to "id"
+     * @param criteria - Options to limit the alerts returned
+     * @param continuationToken - If there are more alerts than can be returned, a continuation token is placed in the "x-ms-continuationtoken" header.  Use that token here to get the next page of alerts
+     */
+    getAlerts(project: string, repository: string, top?: number, orderBy?: string, criteria?: Alert.SearchCriteria, continuationToken?: string): Promise<WebApi.PagedList<Alert.Alert>>;
+    /**
+     * @param project - Project ID or project name
+     * @param alertId -
+     * @param repository -
+     * @param ref -
+     */
+    getAlertSarif(project: string, alertId: number, repository: string, ref?: string): Promise<string>;
+    /**
+     * Update the status of an alert
+     *
+     * @param stateUpdate - The new status of the alert
+     * @param project - Project ID or project name
+     * @param alertId - The ID of the alert
+     * @param repository - The name or ID of the repository
+     */
+    updateAlert(stateUpdate: Alert.AlertStateUpdate, project: string, alertId: number, repository: string): Promise<Alert.Alert>;
+    /**
+     * @param project - Project ID or project name
+     * @param alertId -
+     * @param repository -
+     * @param ref -
+     */
+    getAlertInstances(project: string, alertId: number, repository: string, ref?: string): Promise<Alert.AlertAnalysisInstance[]>;
+    /**
+     * Upload a Sarif containing security alerts
+     *
+     * @param content - Content to upload
+     * @param project - Project ID or project name
+     * @param repository - The name or ID of a repository
+     */
+    uploadSarif(content: string, project: string, repository: string): Promise<number>;
+    /**
+     * @param project - Project ID or project name
+     * @param repository -
+     * @param alertType -
+     */
+    getUxFilters(project: string, repository: string, alertType: Alert.AlertType): Promise<Alert.UxFilters>;
+    /**
+     * Get the status of the Sarif processing job
+     *
+     * @param sarifId - Sarif ID returned when the Sarif was uploaded
+     */
+    getSarif(sarifId: number): Promise<boolean>;
+}