github-issue-tower-defence-management 1.74.1 → 1.76.0

package/src/domain/usecases/DailySecurityScanUseCase.test.ts

@@ -0,0 +1,412 @@
+import { DailySecurityScanUseCase } from './DailySecurityScanUseCase';
+import { LocalCommandRunner } from './adapter-interfaces/LocalCommandRunner';
+import { IssueRepository } from './adapter-interfaces/IssueRepository';
+import { HttpRepository } from './adapter-interfaces/HttpRepository';
+import { mock } from 'jest-mock-extended';
+
+const KEV_CATALOG_URL =
+  'https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json';
+
+describe('DailySecurityScanUseCase', () => {
+  const buildUseCase = () => {
+    const mockLocalCommandRunner = mock<LocalCommandRunner>();
+    const mockIssueRepository = mock<IssueRepository>();
+    const mockHttpRepository = mock<HttpRepository>();
+    const useCase = new DailySecurityScanUseCase(
+      mockLocalCommandRunner,
+      mockIssueRepository,
+      mockHttpRepository,
+    );
+    return {
+      useCase,
+      mockLocalCommandRunner,
+      mockIssueRepository,
+      mockHttpRepository,
+    };
+  };
+
+  describe('run', () => {
+    it('does nothing when no target date matches the configured hour', async () => {
+      const { useCase, mockLocalCommandRunner, mockIssueRepository } =
+        buildUseCase();
+
+      await useCase.run({
+        targetDates: [new Date('2024-01-01T03:30:00Z')],
+        org: 'example-org',
+        manager: 'manager-name',
+        dailySecurityScan: {
+          scanBaseDirectory: '/repos',
+          targetHourUtc: 5,
+        },
+      });
+
+      expect(mockLocalCommandRunner.runCommand.mock.calls).toHaveLength(0);
+      expect(mockIssueRepository.createNewIssue.mock.calls).toHaveLength(0);
+    });
+
+    it('does not run when the matching hour is not at minute zero', async () => {
+      const { useCase, mockLocalCommandRunner } = buildUseCase();
+
+      await useCase.run({
+        targetDates: [new Date('2024-01-01T05:15:00Z')],
+        org: 'example-org',
+        manager: 'manager-name',
+        dailySecurityScan: {
+          scanBaseDirectory: '/repos',
+          targetHourUtc: 5,
+        },
+      });
+
+      expect(mockLocalCommandRunner.runCommand.mock.calls).toHaveLength(0);
+    });
+
+    it('scans repositories and creates an issue when osv-scanner finds vulnerabilities', async () => {
+      const { useCase, mockLocalCommandRunner, mockIssueRepository } =
+        buildUseCase();
+
+      mockLocalCommandRunner.runCommand.mockImplementation(
+        async (program, args) => {
+          if (program === 'find') {
+            return {
+              stdout: '/repos/example-org/app/.git\n',
+              stderr: '',
+              exitCode: 0,
+            };
+          }
+          if (program === 'git') {
+            return {
+              stdout: 'git@github.com:example-org/app.git\n',
+              stderr: '',
+              exitCode: 0,
+            };
+          }
+          if (program === 'osv-scanner') {
+            return {
+              stdout: 'vulnerability detected in ' + args[args.length - 1],
+              stderr: '',
+              exitCode: 1,
+            };
+          }
+          return { stdout: '', stderr: '', exitCode: 0 };
+        },
+      );
+
+      await useCase.run({
+        targetDates: [new Date('2024-01-02T05:00:00Z')],
+        org: 'example-org',
+        manager: 'manager-name',
+        dailySecurityScan: {
+          scanBaseDirectory: '/repos',
+          targetHourUtc: 5,
+        },
+      });
+
+      expect(mockIssueRepository.createNewIssue.mock.calls).toHaveLength(1);
+      expect(mockIssueRepository.createNewIssue.mock.calls[0][0]).toBe(
+        'example-org',
+      );
+      expect(mockIssueRepository.createNewIssue.mock.calls[0][1]).toBe('app');
+      expect(mockIssueRepository.createNewIssue.mock.calls[0][2]).toBe(
+        'Daily security scan findings: 2024-01-02',
+      );
+      expect(mockIssueRepository.createNewIssue.mock.calls[0][4]).toEqual([
+        'manager-name',
+      ]);
+    });
+
+    it('does not create an issue when osv-scanner reports no vulnerabilities', async () => {
+      const { useCase, mockLocalCommandRunner, mockIssueRepository } =
+        buildUseCase();
+
+      mockLocalCommandRunner.runCommand.mockImplementation(async (program) => {
+        if (program === 'find') {
+          return {
+            stdout: '/repos/example-org/app/.git\n',
+            stderr: '',
+            exitCode: 0,
+          };
+        }
+        if (program === 'git') {
+          return {
+            stdout: 'git@github.com:example-org/app.git\n',
+            stderr: '',
+            exitCode: 0,
+          };
+        }
+        return { stdout: 'no vulnerabilities', stderr: '', exitCode: 0 };
+      });
+
+      await useCase.run({
+        targetDates: [new Date('2024-01-02T05:00:00Z')],
+        org: 'example-org',
+        manager: 'manager-name',
+        dailySecurityScan: {
+          scanBaseDirectory: '/repos',
+          targetHourUtc: 5,
+        },
+      });
+
+      expect(mockIssueRepository.createNewIssue.mock.calls).toHaveLength(0);
+    });
+
+    it('skips repositories whose origin remote does not belong to the org', async () => {
+      const { useCase, mockLocalCommandRunner, mockIssueRepository } =
+        buildUseCase();
+
+      mockLocalCommandRunner.runCommand.mockImplementation(async (program) => {
+        if (program === 'find') {
+          return {
+            stdout: '/repos/other-org/app/.git\n',
+            stderr: '',
+            exitCode: 0,
+          };
+        }
+        if (program === 'git') {
+          return {
+            stdout: 'git@github.com:other-org/app.git\n',
+            stderr: '',
+            exitCode: 0,
+          };
+        }
+        return { stdout: '', stderr: '', exitCode: 1 };
+      });
+
+      await useCase.run({
+        targetDates: [new Date('2024-01-02T05:00:00Z')],
+        org: 'example-org',
+        manager: 'manager-name',
+        dailySecurityScan: {
+          scanBaseDirectory: '/repos',
+          targetHourUtc: 5,
+        },
+      });
+
+      expect(mockIssueRepository.createNewIssue.mock.calls).toHaveLength(0);
+      const osvScannerInvoked =
+        mockLocalCommandRunner.runCommand.mock.calls.some(
+          (call) => call[0] === 'osv-scanner',
+        );
+      expect(osvScannerInvoked).toBe(false);
+    });
+
+    it('skips repositories whose origin remote cannot be resolved', async () => {
+      const { useCase, mockLocalCommandRunner, mockIssueRepository } =
+        buildUseCase();
+
+      mockLocalCommandRunner.runCommand.mockImplementation(async (program) => {
+        if (program === 'find') {
+          return {
+            stdout: '/repos/example-org/app/.git\n',
+            stderr: '',
+            exitCode: 0,
+          };
+        }
+        if (program === 'git') {
+          return {
+            stdout: '',
+            stderr: 'fatal: No such remote',
+            exitCode: 2,
+          };
+        }
+        return { stdout: '', stderr: '', exitCode: 1 };
+      });
+
+      await useCase.run({
+        targetDates: [new Date('2024-01-02T05:00:00Z')],
+        org: 'example-org',
+        manager: 'manager-name',
+        dailySecurityScan: {
+          scanBaseDirectory: '/repos',
+          targetHourUtc: 5,
+        },
+      });
+
+      expect(mockIssueRepository.createNewIssue.mock.calls).toHaveLength(0);
+      const osvScannerInvoked =
+        mockLocalCommandRunner.runCommand.mock.calls.some(
+          (call) => call[0] === 'osv-scanner',
+        );
+      expect(osvScannerInvoked).toBe(false);
+    });
+
+    it('does not fetch the KEV catalog when KEV reporting is disabled', async () => {
+      const { useCase, mockLocalCommandRunner, mockHttpRepository } =
+        buildUseCase();
+
+      mockLocalCommandRunner.runCommand.mockResolvedValue({
+        stdout: '',
+        stderr: '',
+        exitCode: 0,
+      });
+
+      await useCase.run({
+        targetDates: [new Date('2024-01-02T05:00:00Z')],
+        org: 'example-org',
+        manager: 'manager-name',
+        dailySecurityScan: {
+          scanBaseDirectory: '/repos',
+          targetHourUtc: 5,
+          enableKevNvdReport: false,
+        },
+      });
+
+      expect(mockHttpRepository.get.mock.calls).toHaveLength(0);
+    });
+
+    it('does not fetch the KEV catalog when the report repo is missing', async () => {
+      const { useCase, mockLocalCommandRunner, mockHttpRepository } =
+        buildUseCase();
+
+      mockLocalCommandRunner.runCommand.mockResolvedValue({
+        stdout: '',
+        stderr: '',
+        exitCode: 0,
+      });
+
+      await useCase.run({
+        targetDates: [new Date('2024-01-02T05:00:00Z')],
+        org: 'example-org',
+        manager: 'manager-name',
+        dailySecurityScan: {
+          scanBaseDirectory: '/repos',
+          targetHourUtc: 5,
+          enableKevNvdReport: true,
+        },
+      });
+
+      expect(mockHttpRepository.get.mock.calls).toHaveLength(0);
+    });
+
+    it('creates a KEV report issue for vulnerabilities added since yesterday', async () => {
+      const {
+        useCase,
+        mockLocalCommandRunner,
+        mockIssueRepository,
+        mockHttpRepository,
+      } = buildUseCase();
+
+      mockLocalCommandRunner.runCommand.mockResolvedValue({
+        stdout: '',
+        stderr: '',
+        exitCode: 0,
+      });
+      mockHttpRepository.get.mockResolvedValue(
+        JSON.stringify({
+          vulnerabilities: [
+            {
+              cveID: 'CVE-2024-0001',
+              vulnerabilityName: 'New Vulnerability',
+              dateAdded: '2024-01-02',
+            },
+            {
+              cveID: 'CVE-2023-9999',
+              vulnerabilityName: 'Old Vulnerability',
+              dateAdded: '2023-12-31',
+            },
+          ],
+        }),
+      );
+
+      await useCase.run({
+        targetDates: [new Date('2024-01-02T05:00:00Z')],
+        org: 'example-org',
+        manager: 'manager-name',
+        dailySecurityScan: {
+          scanBaseDirectory: '/repos',
+          targetHourUtc: 5,
+          enableKevNvdReport: true,
+          kevReportRepo: 'security-reports',
+        },
+      });
+
+      expect(mockHttpRepository.get.mock.calls).toHaveLength(1);
+      expect(mockHttpRepository.get.mock.calls[0][0]).toBe(KEV_CATALOG_URL);
+      expect(mockIssueRepository.createNewIssue.mock.calls).toHaveLength(1);
+      expect(mockIssueRepository.createNewIssue.mock.calls[0][0]).toBe(
+        'example-org',
+      );
+      expect(mockIssueRepository.createNewIssue.mock.calls[0][1]).toBe(
+        'security-reports',
+      );
+      expect(mockIssueRepository.createNewIssue.mock.calls[0][2]).toBe(
+        'CISA KEV new additions since 2024-01-01',
+      );
+      expect(mockIssueRepository.createNewIssue.mock.calls[0][3]).toContain(
+        'CVE-2024-0001',
+      );
+      expect(mockIssueRepository.createNewIssue.mock.calls[0][3]).not.toContain(
+        'CVE-2023-9999',
+      );
+    });
+
+    it('does not create a KEV report issue when there are no new additions', async () => {
+      const {
+        useCase,
+        mockLocalCommandRunner,
+        mockIssueRepository,
+        mockHttpRepository,
+      } = buildUseCase();
+
+      mockLocalCommandRunner.runCommand.mockResolvedValue({
+        stdout: '',
+        stderr: '',
+        exitCode: 0,
+      });
+      mockHttpRepository.get.mockResolvedValue(
+        JSON.stringify({
+          vulnerabilities: [
+            {
+              cveID: 'CVE-2023-9999',
+              vulnerabilityName: 'Old Vulnerability',
+              dateAdded: '2023-12-31',
+            },
+          ],
+        }),
+      );
+
+      await useCase.run({
+        targetDates: [new Date('2024-01-02T05:00:00Z')],
+        org: 'example-org',
+        manager: 'manager-name',
+        dailySecurityScan: {
+          scanBaseDirectory: '/repos',
+          targetHourUtc: 5,
+          enableKevNvdReport: true,
+          kevReportRepo: 'security-reports',
+        },
+      });
+
+      expect(mockHttpRepository.get.mock.calls).toHaveLength(1);
+      expect(mockHttpRepository.get.mock.calls[0][0]).toBe(KEV_CATALOG_URL);
+      expect(mockIssueRepository.createNewIssue.mock.calls).toHaveLength(0);
+    });
+
+    it('throws when the KEV catalog format is unexpected', async () => {
+      const { useCase, mockLocalCommandRunner, mockHttpRepository } =
+        buildUseCase();
+
+      mockLocalCommandRunner.runCommand.mockResolvedValue({
+        stdout: '',
+        stderr: '',
+        exitCode: 0,
+      });
+      mockHttpRepository.get.mockResolvedValue(
+        JSON.stringify({ unexpected: 'structure' }),
+      );
+
+      await expect(
+        useCase.run({
+          targetDates: [new Date('2024-01-02T05:00:00Z')],
+          org: 'example-org',
+          manager: 'manager-name',
+          dailySecurityScan: {
+            scanBaseDirectory: '/repos',
+            targetHourUtc: 5,
+            enableKevNvdReport: true,
+            kevReportRepo: 'security-reports',
+          },
+        }),
+      ).rejects.toThrow('Unexpected CISA KEV catalog format');
+    });
+  });
+});

package/src/domain/usecases/DailySecurityScanUseCase.ts

@@ -0,0 +1,200 @@
+import { LocalCommandRunner } from './adapter-interfaces/LocalCommandRunner';
+import { IssueRepository } from './adapter-interfaces/IssueRepository';
+import { HttpRepository } from './adapter-interfaces/HttpRepository';
+import { Member } from '../entities/Member';
+
+export type DailySecurityScanConfig = {
+  scanBaseDirectory: string;
+  targetHourUtc: number;
+  enableKevNvdReport?: boolean;
+  kevReportRepo?: string;
+};
+
+type KevVulnerability = {
+  cveID: string;
+  vulnerabilityName: string;
+  dateAdded: string;
+};
+
+type KevCatalog = {
+  vulnerabilities: KevVulnerability[];
+};
+
+const isKevVulnerability = (value: unknown): value is KevVulnerability => {
+  if (typeof value !== 'object' || value === null) {
+    return false;
+  }
+  const record: Record<string, unknown> = { ...value };
+  return (
+    typeof record.cveID === 'string' &&
+    typeof record.vulnerabilityName === 'string' &&
+    typeof record.dateAdded === 'string'
+  );
+};
+
+const isKevCatalog = (value: unknown): value is KevCatalog => {
+  if (typeof value !== 'object' || value === null) {
+    return false;
+  }
+  const record: Record<string, unknown> = { ...value };
+  return (
+    Array.isArray(record.vulnerabilities) &&
+    record.vulnerabilities.every(isKevVulnerability)
+  );
+};
+
+const KEV_CATALOG_URL =
+  'https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json';
+
+export class DailySecurityScanUseCase {
+  constructor(
+    readonly localCommandRunner: LocalCommandRunner,
+    readonly issueRepository: Pick<IssueRepository, 'createNewIssue'>,
+    readonly httpRepository: HttpRepository,
+  ) {}
+
+  run = async (input: {
+    targetDates: Date[];
+    org: string;
+    manager: Member['name'];
+    dailySecurityScan: DailySecurityScanConfig;
+  }): Promise<void> => {
+    const shouldRun = input.targetDates.some(
+      (targetDate) =>
+        targetDate.getUTCHours() === input.dailySecurityScan.targetHourUtc &&
+        targetDate.getUTCMinutes() === 0,
+    );
+    if (!shouldRun) {
+      return;
+    }
+
+    const lastTargetDate = input.targetDates[input.targetDates.length - 1];
+    const today = lastTargetDate.toISOString().slice(0, 10);
+
+    await this.scanRepositories(
+      input.org,
+      input.manager,
+      today,
+      input.dailySecurityScan,
+    );
+
+    await this.reportKevAdditions(
+      input.org,
+      input.manager,
+      lastTargetDate,
+      input.dailySecurityScan,
+    );
+  };
+
+  private scanRepositories = async (
+    org: string,
+    manager: Member['name'],
+    today: string,
+    config: DailySecurityScanConfig,
+  ): Promise<void> => {
+    const { stdout: findOutput } = await this.localCommandRunner.runCommand(
+      'find',
+      [
+        config.scanBaseDirectory,
+        '-mindepth',
+        '4',
+        '-maxdepth',
+        '4',
+        '-name',
+        '.git',
+        '-type',
+        'd',
+      ],
+    );
+
+    const repositoryDirectories = findOutput
+      .split('\n')
+      .filter((line) => line.length > 0)
+      .map((gitDirectory) => gitDirectory.replace(/\/\.git$/, ''));
+
+    for (const repositoryDirectory of repositoryDirectories) {
+      const { stdout: remoteUrl, exitCode: remoteExitCode } =
+        await this.localCommandRunner.runCommand('git', [
+          '-C',
+          repositoryDirectory,
+          'remote',
+          'get-url',
+          'origin',
+        ]);
+      if (remoteExitCode !== 0) {
+        continue;
+      }
+
+      const remoteMatch = remoteUrl
+        .trim()
+        .match(/github\.com[:/]([^/]+)\/([^/.]+)/);
+      if (!remoteMatch || remoteMatch[1] !== org) {
+        continue;
+      }
+      const repositoryOrg = remoteMatch[1];
+      const repositoryName = remoteMatch[2];
+
+      const { stdout: scanOutput, exitCode: scanExitCode } =
+        await this.localCommandRunner.runCommand('osv-scanner', [
+          'scan',
+          'source',
+          '-r',
+          repositoryDirectory,
+        ]);
+      if (scanExitCode !== 1) {
+        continue;
+      }
+
+      await this.issueRepository.createNewIssue(
+        repositoryOrg,
+        repositoryName,
+        `Daily security scan findings: ${today}`,
+        `## OSV-Scanner findings\n\n\`\`\`\n${scanOutput}\n\`\`\``,
+        [manager],
+        [],
+      );
+    }
+  };
+
+  private reportKevAdditions = async (
+    org: string,
+    manager: Member['name'],
+    lastTargetDate: Date,
+    config: DailySecurityScanConfig,
+  ): Promise<void> => {
+    if (!config.enableKevNvdReport || !config.kevReportRepo) {
+      return;
+    }
+
+    const yesterday = new Date(lastTargetDate);
+    yesterday.setUTCDate(yesterday.getUTCDate() - 1);
+    const yesterdayYmd = yesterday.toISOString().slice(0, 10);
+
+    const kevJson = await this.httpRepository.get(KEV_CATALOG_URL);
+    const parsedKev: unknown = JSON.parse(kevJson);
+    if (!isKevCatalog(parsedKev)) {
+      throw new Error(
+        `Unexpected CISA KEV catalog format from ${KEV_CATALOG_URL}`,
+      );
+    }
+
+    const newKevEntries = parsedKev.vulnerabilities
+      .filter((vulnerability) => vulnerability.dateAdded >= yesterdayYmd)
+      .map(
+        (vulnerability) =>
+          `- ${vulnerability.dateAdded} ${vulnerability.cveID} ${vulnerability.vulnerabilityName}`,
+      );
+    if (newKevEntries.length === 0) {
+      return;
+    }
+
+    await this.issueRepository.createNewIssue(
+      org,
+      config.kevReportRepo,
+      `CISA KEV new additions since ${yesterdayYmd}`,
+      newKevEntries.join('\n'),
+      [manager],
+      [],
+    );
+  };
+}

package/src/domain/usecases/HandleScheduledEventUseCase.test.ts

@@ -25,6 +25,7 @@ import { RevertOrphanedPreparationUseCase } from './RevertOrphanedPreparationUse
 import { RevertNotReadyAwaitingQualityCheckUseCase } from './RevertNotReadyAwaitingQualityCheckUseCase';
 import { SetupTowerDefenceProjectUseCase } from './SetupTowerDefenceProjectUseCase';
 import { UpdateRateLimitCacheUseCase } from './UpdateRateLimitCacheUseCase';
+import { DailySecurityScanUseCase } from './DailySecurityScanUseCase';
 
 describe('HandleScheduledEventUseCase', () => {
   describe('createTargetDateTimes', () => {
@@ -117,6 +118,7 @@ describe('HandleScheduledEventUseCase', () => {
     const mockRevertNotReadyAwaitingQualityCheckUseCase =
       mock<RevertNotReadyAwaitingQualityCheckUseCase>();
     const mockUpdateRateLimitCacheUseCase = mock<UpdateRateLimitCacheUseCase>();
+    const mockDailySecurityScanUseCase = mock<DailySecurityScanUseCase>();
     const mockDateRepository = mock<DateRepository>();
     const mockSpreadsheetRepository = mock<SpreadsheetRepository>();
     const mockProjectRepository = mock<ProjectRepository>();
@@ -142,6 +144,7 @@ describe('HandleScheduledEventUseCase', () => {
       mockRevertOrphanedPreparationUseCase,
       mockRevertNotReadyAwaitingQualityCheckUseCase,
       mockUpdateRateLimitCacheUseCase,
+      mockDailySecurityScanUseCase,
       mockDateRepository,
       mockSpreadsheetRepository,
       mockProjectRepository,

package/src/domain/usecases/HandleScheduledEventUseCase.ts

@@ -29,6 +29,10 @@ import { RevertNotReadyAwaitingQualityCheckUseCase } from './RevertNotReadyAwait
 import { resolveLabelsAsLlmAgentName } from './resolveLabelsAsLlmAgentName';
 import { SetupTowerDefenceProjectUseCase } from './SetupTowerDefenceProjectUseCase';
 import { UpdateRateLimitCacheUseCase } from './UpdateRateLimitCacheUseCase';
+import {
+  DailySecurityScanConfig,
+  DailySecurityScanUseCase,
+} from './DailySecurityScanUseCase';
 
 export class ProjectNotFoundError extends Error {
   constructor(message: string) {
@@ -60,6 +64,7 @@ export class HandleScheduledEventUseCase {
     readonly revertOrphanedPreparationUseCase: RevertOrphanedPreparationUseCase,
     readonly revertNotReadyAwaitingQualityCheckUseCase: RevertNotReadyAwaitingQualityCheckUseCase,
     readonly updateRateLimitCacheUseCase: UpdateRateLimitCacheUseCase | null,
+    readonly dailySecurityScanUseCase: DailySecurityScanUseCase | null,
     readonly dateRepository: DateRepository,
     readonly spreadsheetRepository: SpreadsheetRepository,
     readonly projectRepository: ProjectRepository,
@@ -97,6 +102,7 @@ export class HandleScheduledEventUseCase {
       labelsAsLlmAgentName?: string[] | null;
     } | null;
     thresholdForAutoReject?: number;
+    dailySecurityScan?: DailySecurityScanConfig | null;
   }): Promise<{
     project: Project;
     issues: Issue[];
@@ -291,6 +297,14 @@ ${JSON.stringify(e)}
       allowIssueCacheMinutes: input.allowIssueCacheMinutes,
       labelsAsLlmAgentName,
     });
+    if (this.dailySecurityScanUseCase !== null && input.dailySecurityScan) {
+      await this.dailySecurityScanUseCase.run({
+        targetDates: targetDateTimes,
+        org: input.org,
+        manager: input.manager,
+        dailySecurityScan: input.dailySecurityScan,
+      });
+    }
     if (input.startPreparation) {
       if (this.updateRateLimitCacheUseCase !== null) {
         await this.updateRateLimitCacheUseCase.run({