qa360 2.2.1 → 2.2.7

package/cli/dist/core/adapters/semgrep-sast.js

@@ -0,0 +1,322 @@
+/**
+ * QA360 Semgrep SAST Adapter (Socle OOTB)
+ * Static Application Security Testing with configurable severity thresholds
+ */
+import { spawn } from 'child_process';
+import { existsSync } from 'fs';
+import { join } from 'path';
+import { SecurityRedactor } from '../security/redactor.js';
+export class SemgrepSastAdapter {
+    redactor;
+    constructor() {
+        this.redactor = SecurityRedactor.forLogs();
+    }
+    /**
+     * Execute Semgrep SAST scan
+     */
+    async runSastScan(config) {
+        try {
+            console.log(`🔍 Running Semgrep SAST scan (${config.paths?.join(', ') || 'default paths'})`);
+            // Check if Semgrep is available
+            const availability = await SemgrepSastAdapter.isAvailable();
+            if (!availability.available) {
+                return {
+                    success: false,
+                    findings: [],
+                    summary: this.getDefaultSummary(),
+                    thresholds: this.getDefaultThresholds(config.security),
+                    error: availability.error
+                };
+            }
+            // Execute Semgrep
+            const result = await this.executeSemgrep(config);
+            return result;
+        }
+        catch (error) {
+            return {
+                success: false,
+                findings: [],
+                summary: this.getDefaultSummary(),
+                thresholds: this.getDefaultThresholds(config.security),
+                error: this.redactor.redact(error instanceof Error ? error.message : 'Unknown error')
+            };
+        }
+    }
+    /**
+     * Execute Semgrep command
+     */
+    async executeSemgrep(config) {
+        return new Promise((resolve) => {
+            let output = '';
+            let error = '';
+            const rules = config.rules || ['auto'];
+            const paths = config.paths || ['.'];
+            const args = [
+                '--config', rules.join(','),
+                '--json',
+                '--no-git-ignore', // Include all files
+                '--timeout', '60',
+                ...paths
+            ];
+            // Add custom config if specified
+            if (config.configFile && existsSync(join(config.workingDir, config.configFile))) {
+                args.unshift('--config', config.configFile);
+            }
+            const child = spawn('semgrep', args, {
+                cwd: config.workingDir,
+                stdio: ['ignore', 'pipe', 'pipe']
+            });
+            const timeout = setTimeout(() => {
+                child.kill('SIGKILL');
+                resolve({
+                    success: false,
+                    findings: [],
+                    summary: this.getDefaultSummary(),
+                    thresholds: this.getDefaultThresholds(config.security),
+                    error: `Semgrep scan timed out after ${config.timeout || 120000}ms`
+                });
+            }, config.timeout || 120000);
+            if (child.stdout) {
+                child.stdout.on('data', (data) => {
+                    output += data.toString();
+                });
+            }
+            if (child.stderr) {
+                child.stderr.on('data', (data) => {
+                    error += data.toString();
+                });
+            }
+            child.on('close', (code) => {
+                clearTimeout(timeout);
+                // Semgrep returns 0 for no findings, 1 for findings, 2+ for errors
+                if (code === 0 || code === 1) {
+                    const result = this.parseSemgrepResults(output, config);
+                    resolve(result);
+                }
+                else {
+                    resolve({
+                        success: false,
+                        findings: [],
+                        summary: this.getDefaultSummary(),
+                        thresholds: this.getDefaultThresholds(config.security),
+                        error: this.redactor.redact(error || `Semgrep exited with code ${code}`),
+                        rawOutput: this.redactor.redact(output)
+                    });
+                }
+            });
+            child.on('error', (err) => {
+                clearTimeout(timeout);
+                resolve({
+                    success: false,
+                    findings: [],
+                    summary: this.getDefaultSummary(),
+                    thresholds: this.getDefaultThresholds(config.security),
+                    error: `Failed to start Semgrep: ${err.message}`
+                });
+            });
+        });
+    }
+    /**
+     * Parse Semgrep JSON results
+     */
+    parseSemgrepResults(output, config) {
+        try {
+            const jsonData = JSON.parse(output);
+            const findings = [];
+            // Parse findings from results
+            if (jsonData.results && Array.isArray(jsonData.results)) {
+                for (const result of jsonData.results) {
+                    const finding = {
+                        ruleId: result.check_id || 'unknown',
+                        severity: this.mapSeverity(result.extra?.severity || 'INFO'),
+                        message: result.extra?.message || result.message || 'Security issue detected',
+                        file: result.path || 'unknown',
+                        line: result.start?.line || 0,
+                        column: result.start?.col || 0,
+                        code: result.extra?.lines ? result.extra.lines.trim() : undefined,
+                        fix: result.extra?.fix ? result.extra.fix.trim() : undefined
+                    };
+                    findings.push(finding);
+                }
+            }
+            // Calculate summary
+            const summary = this.calculateSummary(findings);
+            // Check thresholds
+            const thresholds = this.checkThresholds(summary, config.security);
+            // Determine success based on thresholds
+            const success = thresholds.sast_max_high.passed;
+            const junit = this.generateJUnit(findings, success);
+            return {
+                success,
+                findings: findings.map(f => ({
+                    ...f,
+                    message: this.redactor.redact(f.message),
+                    code: f.code ? this.redactor.redact(f.code) : undefined,
+                    fix: f.fix ? this.redactor.redact(f.fix) : undefined
+                })),
+                summary,
+                thresholds,
+                rawOutput: this.redactor.redact(output),
+                junit
+            };
+        }
+        catch (error) {
+            return {
+                success: false,
+                findings: [],
+                summary: this.getDefaultSummary(),
+                thresholds: this.getDefaultThresholds(config.security),
+                error: `Failed to parse Semgrep results: ${error}`,
+                rawOutput: this.redactor.redact(output)
+            };
+        }
+    }
+    /**
+     * Map Semgrep severity to standard levels
+     */
+    mapSeverity(severity) {
+        const sev = severity.toUpperCase();
+        if (sev === 'ERROR' || sev === 'HIGH')
+            return 'ERROR';
+        if (sev === 'WARNING' || sev === 'MEDIUM')
+            return 'WARNING';
+        return 'INFO';
+    }
+    /**
+     * Calculate findings summary
+     */
+    calculateSummary(findings) {
+        const summary = {
+            total: findings.length,
+            critical: 0,
+            high: 0,
+            medium: 0,
+            low: 0,
+            info: 0
+        };
+        for (const finding of findings) {
+            switch (finding.severity) {
+                case 'ERROR':
+                    summary.high++;
+                    break;
+                case 'WARNING':
+                    summary.medium++;
+                    break;
+                case 'INFO':
+                    summary.info++;
+                    break;
+            }
+        }
+        return summary;
+    }
+    /**
+     * Check security thresholds
+     */
+    checkThresholds(summary, security) {
+        const maxHigh = security?.sast?.max_high ?? 0; // Default: strict (0 high findings)
+        return {
+            sast_max_high: {
+                passed: summary.high <= maxHigh,
+                actual: summary.high,
+                budget: maxHigh
+            }
+        };
+    }
+    /**
+     * Generate JUnit XML
+     */
+    generateJUnit(findings, success) {
+        const timestamp = new Date().toISOString();
+        const failures = findings.filter(f => f.severity === 'ERROR').length;
+        let junit = `<?xml version="1.0" encoding="UTF-8"?>
+<testsuite name="Semgrep SAST Scan" tests="1" failures="${success ? 0 : 1}" time="0" timestamp="${timestamp}">
+  <testcase name="SAST Security Scan" time="0">
+`;
+        if (!success) {
+            junit += `    <failure message="Security issues found">
+High severity findings: ${findings.filter(f => f.severity === 'ERROR').length}
+Medium severity findings: ${findings.filter(f => f.severity === 'WARNING').length}
+Total findings: ${findings.length}
+
+Top findings:
+${findings.slice(0, 5).map(f => `- ${f.ruleId}: ${f.message} (${f.file}:${f.line})`).join('\n')}
+    </failure>
+`;
+        }
+        junit += `  </testcase>
+</testsuite>`;
+        return junit;
+    }
+    /**
+     * Get default summary structure
+     */
+    getDefaultSummary() {
+        return {
+            total: 0,
+            critical: 0,
+            high: 0,
+            medium: 0,
+            low: 0,
+            info: 0
+        };
+    }
+    /**
+     * Get default thresholds
+     */
+    getDefaultThresholds(security) {
+        return {
+            sast_max_high: {
+                passed: true,
+                actual: 0,
+                budget: security?.sast?.max_high ?? 0
+            }
+        };
+    }
+    /**
+     * Check if Semgrep is available
+     */
+    static async isAvailable() {
+        return new Promise((resolve) => {
+            const child = spawn('semgrep', ['--version'], { stdio: 'pipe' });
+            child.on('close', (code) => {
+                resolve({
+                    available: code === 0,
+                    error: code !== 0 ? 'Semgrep not found. Install with: pip install semgrep' : undefined
+                });
+            });
+            child.on('error', () => {
+                resolve({
+                    available: false,
+                    error: 'Semgrep not found. Install with: pip install semgrep'
+                });
+            });
+        });
+    }
+    /**
+     * Validate SAST configuration
+     */
+    static validateConfig(config) {
+        const errors = [];
+        if (!config.workingDir || !existsSync(config.workingDir)) {
+            errors.push('SAST scan requires valid working directory');
+        }
+        if (config.paths) {
+            for (const path of config.paths) {
+                const fullPath = join(config.workingDir, path);
+                if (!existsSync(fullPath)) {
+                    errors.push(`SAST scan path not found: ${path}`);
+                }
+            }
+        }
+        if (config.configFile) {
+            const configPath = join(config.workingDir, config.configFile);
+            if (!existsSync(configPath)) {
+                errors.push(`Semgrep config file not found: ${config.configFile}`);
+            }
+        }
+        return {
+            valid: errors.length === 0,
+            errors
+        };
+    }
+}

package/cli/dist/core/adapters/unit-test-types.d.ts

@@ -0,0 +1,119 @@
+/**
+ * QA360 Unit Test Ingestion - Common Types
+ *
+ * Shared types for unit test result adapters (Jest, Vitest, pytest, etc.)
+ */
+/**
+ * Coverage thresholds configuration
+ */
+export interface CoverageThresholds {
+    /** Minimum percentage for statements coverage */
+    statements?: number;
+    /** Minimum percentage for branches coverage */
+    branches?: number;
+    /** Minimum percentage for functions coverage */
+    functions?: number;
+    /** Minimum percentage for lines coverage */
+    lines?: number;
+}
+/**
+ * Unit test configuration for adapters
+ */
+export interface UnitTestConfig {
+    /** Path to the test results file (JSON format) */
+    results?: string;
+    /** Path to the coverage report file */
+    coverage?: string;
+    /** Coverage thresholds to enforce */
+    thresholds?: CoverageThresholds;
+    /** Working directory for running tests */
+    cwd?: string;
+    /** Test command to run if results don't exist */
+    command?: string;
+    /** Timeout for test execution (ms) */
+    timeout?: number;
+}
+/**
+ * Individual test result
+ */
+export interface UnitTestResult {
+    /** Test file path */
+    file: string;
+    /** Test name/description */
+    name: string;
+    /** Full test name including suite */
+    fullName: string;
+    /** Test status */
+    status: 'passed' | 'failed' | 'skipped' | 'pending';
+    /** Execution duration in milliseconds */
+    duration: number;
+    /** Error message if failed */
+    error?: string;
+    /** Error stack trace if failed */
+    stack?: string;
+    /** Assertion count */
+    assertions?: number;
+}
+/**
+ * Coverage statistics
+ */
+export interface CoverageStats {
+    /** Statements covered / total */
+    statements: {
+        covered: number;
+        total: number;
+        percentage: number;
+    };
+    /** Branches covered / total */
+    branches: {
+        covered: number;
+        total: number;
+        percentage: number;
+    };
+    /** Functions covered / total */
+    functions: {
+        covered: number;
+        total: number;
+        percentage: number;
+    };
+    /** Lines covered / total */
+    lines: {
+        covered: number;
+        total: number;
+        percentage: number;
+    };
+}
+/**
+ * Unit test execution result
+ */
+export interface UnitTestExecutionResult {
+    /** Adapter name (jest, vitest, pytest, etc.) */
+    adapter: string;
+    /** Total number of tests */
+    total: number;
+    /** Number of passed tests */
+    passed: number;
+    /** Number of failed tests */
+    failed: number;
+    /** Number of skipped tests */
+    skipped: number;
+    /** Number of pending tests */
+    pending: number;
+    /** Total execution duration in milliseconds */
+    duration: number;
+    /** Individual test results */
+    tests: UnitTestResult[];
+    /** Coverage statistics if available */
+    coverage?: CoverageStats;
+    /** Coverage threshold results */
+    thresholdResults?: {
+        statements: boolean;
+        branches: boolean;
+        functions: boolean;
+        lines: boolean;
+    };
+    /** Overall success status */
+    success: boolean;
+    /** Error message if execution failed (e.g., no results found) */
+    error?: string;
+}

package/cli/dist/core/adapters/unit-test-types.js

@@ -0,0 +1,6 @@
+/**
+ * QA360 Unit Test Ingestion - Common Types
+ *
+ * Shared types for unit test result adapters (Jest, Vitest, pytest, etc.)
+ */
+export {};

package/cli/dist/core/adapters/vitest-adapter.d.ts

@@ -0,0 +1,46 @@
+/**
+ * QA360 Vitest Adapter
+ *
+ * Ingests Vitest test results and coverage reports into QA360.
+ *
+ * @see https://vitest.dev/guide/#json-output
+ *
+ * Supported result formats:
+ * - test-results.json (from --reporter=json)
+ * - coverage/coverage-final.json (from --coverage)
+ *
+ * NOTE: Vitest JSON format changed in v1.0+
+ * Old format (< v1.0): testResults[].result.state
+ * New format (>= v1.0): testResults[].assertionResults[].status
+ */
+import { UnitTestConfig, UnitTestExecutionResult } from './unit-test-types.js';
+export declare class VitestAdapter {
+    private cwd;
+    constructor(cwd?: string);
+    /**
+     * Execute Vitest tests and return results
+     */
+    execute(config: UnitTestConfig): Promise<UnitTestExecutionResult>;
+    /**
+     * Parse Vitest results into QA360 format
+     * Supports both legacy (< v1.0) and new (>= v1.0) formats
+     */
+    private parseResults;
+    /**
+     * Map Vitest status to QA360 status
+     * Supports both legacy and new status values
+     */
+    private mapVitestStatus;
+    /**
+     * Parse Vitest coverage into QA360 format
+     */
+    private parseCoverage;
+    /**
+     * Check if coverage meets thresholds
+     */
+    private checkThresholds;
+}
+/**
+ * Create a Vitest adapter instance
+ */
+export declare function createVitestAdapter(cwd?: string): VitestAdapter;