PyPI - devsecops-engine-tools - Versions diffs - 1.156.1__tar.gz → 1.158.0__tar.gz - Mend

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devsecops-engine-tools
-Version: 1.156.1
+Version: 1.158.0
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

@@ -261,7 +261,6 @@ def get_inputs_from_cli(args):
         required=False,
         help="Address of the Docker daemon to connect to."
     )
     TOOLS = {
         "engine_iac": ["checkov", "kics", "kubescape", "conftest"],
         "engine_secret": ["trufflehog", "gitleaks", "all_tools"],
@@ -313,6 +312,7 @@ def get_inputs_from_cli(args):
 def application_core():
     tb = True
+    devops_platform_gateway = None
     try:
         # Get inputs from CLI
         args = get_inputs_from_cli(sys.argv[1:])

@@ -1,3 +1,4 @@
+import os
 from dataclasses import dataclass
 from devsecops_engine_tools.engine_core.src.domain.model.gateway.devops_platform_gateway import (
     DevopsPlatformGateway,
@@ -26,14 +27,17 @@ logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
 @dataclass
 class AzureDevops(DevopsPlatformGateway):
     def get_remote_config(self, repository, path, branch=""):
+        organization = os.environ.get("DET_REMOTE_ORG") or SystemVariables.System_TeamFoundationCollectionUri.value()
+        project = os.environ.get("DET_REMOTE_PROJ") or SystemVariables.System_TeamProject.value()
+        pat = os.environ.get("DET_REMOTE_TOKEN") or SystemVariables.System_AccessToken.value()
         base_compact_remote_config_url = (
-            f"https://{SystemVariables.System_TeamFoundationCollectionUri.value().rstrip('/').split('/')[-1].replace('.visualstudio.com','')}"
-            f".visualstudio.com/{SystemVariables.System_TeamProject.value()}/_git/"
-            f"{repository}?path={path}"
+            f"https://{organization.rstrip('/').split('/')[-1].replace('.visualstudio.com','')}"
+            f".visualstudio.com/{project}/_git/{repository}?path={path}"
         )
         utils_azure = AzureDevopsApi(
-            personal_access_token=SystemVariables.System_AccessToken.value(),
+            personal_access_token=pat,
             compact_remote_config_url=base_compact_remote_config_url,
         )
         connection = utils_azure.get_azure_connection()

@@ -3,6 +3,7 @@ import requests
 import subprocess
 import platform
 import os
+import re
 from devsecops_engine_tools.engine_core.src.domain.model.gateway.sbom_manager import (
     SbomManagerGateway,
@@ -35,6 +36,9 @@ class CdxGen(SbomManagerGateway):
             debug_pipelines = config["CDXGEN"].get("DEBUG_PIPELINES", [])
             lifecycle_pipelines = config["CDXGEN"].get("LIFECYCLE_PIPELINES", {})
             spec_version = config["CDXGEN"].get("SPEC_VERSION", "1.6")
+            break_on_build_failure = config["CDXGEN"].get("BREAK_ON_BUILD_FAILURE", True)
+            build_failure_patterns = config["CDXGEN"].get("BUILD_FAILURE_PATTERNS", [])
+            failure_patterns = build_failure_patterns if break_on_build_failure else []
             if config["CDXGEN"].get("OVERRIDE_REGISTRIES", False):
                 registries = config["CDXGEN"].get("REGISTRIES", {})
@@ -86,13 +90,14 @@ class CdxGen(SbomManagerGateway):
                     logger.warning(f"{os_platform} is not supported.")
                     return None
-            result_sbom = self._run_cdxgen(command_prefix, artifact, service_name, exclude_types, exclude_paths, recurse, install_deps, lifecycle_pipelines, enable_debug, spec_version)
+            result_sbom = self._run_cdxgen(command_prefix, artifact, service_name, exclude_types, exclude_paths, recurse, install_deps, lifecycle_pipelines, enable_debug, spec_version, failure_patterns)
             return get_list_component(result_sbom, config["CDXGEN"]["OUTPUT_FORMAT"])
         except Exception as e:
             logger.error(f"Error generating SBOM: {e}")
             return None
-    def _run_cdxgen(self, command_prefix, artifact, service_name, exclude_types, exclude_paths, recurse, install_deps, lifecycle_pipelines, enable_debug=False, spec_version="1.6"):
+    def _run_cdxgen(self, command_prefix, artifact, service_name, exclude_types, exclude_paths, recurse, install_deps, lifecycle_pipelines, enable_debug=False, spec_version="1.6", failure_patterns=None):
+        failure_patterns = failure_patterns or []
         result_file = f"{service_name}_SBOM.json"
         command = [
             command_prefix,
@@ -143,7 +148,18 @@ class CdxGen(SbomManagerGateway):
                     logger.info(f"CDXGEN stdout: {result.stdout}")
                 if result.stderr:
                     logger.info(f"CDXGEN stderr: {result.stderr}")
+            matched_pattern = self._detect_build_failure(
+                f"{result.stdout or ''}\n{result.stderr or ''}", failure_patterns
+            )
+            if matched_pattern:
+                self._remove_incomplete_sbom(result_file)
+                raise Exception(
+                    f"Detected build failure pattern '{matched_pattern}' in cdxgen output for "
+                    f"'{service_name}'. The underlying build likely failed; aborting to avoid "
+                    "generating an incomplete or empty SBOM."
+                )
             if result.returncode == 0:
                 print(f"SBOM generated and saved to: {result_file}")
                 return result_file
@@ -153,6 +169,27 @@ class CdxGen(SbomManagerGateway):
         except Exception as e:
             logger.error(f"Error running cdxgen: {e}")
+    def _detect_build_failure(self, output, patterns):
+        """Return the first configured regex pattern that matches the cdxgen output, if any."""
+        if not output or not patterns:
+            return None
+        for pattern in patterns:
+            try:
+                if re.search(pattern, output, re.IGNORECASE):
+                    return pattern
+            except re.error as e:
+                logger.debug(f"Invalid build failure regex pattern '{pattern}': {e}")
+        return None
+    def _remove_incomplete_sbom(self, result_file):
+        """Best-effort removal of a possibly incomplete/empty SBOM file left by a failed build."""
+        try:
+            if result_file and os.path.exists(result_file):
+                os.remove(result_file)
+                logger.info(f"Removed incomplete SBOM file: {result_file}")
+        except OSError as e:
+            logger.debug(f"Could not remove incomplete SBOM file '{result_file}': {e}")
     def _check_cdxgen_in_path(self):
         """Check if cdxgen is available in PATH and return its path if found."""
         try:

@@ -1,3 +1,4 @@
+import os
 from dataclasses import dataclass
 from devsecops_engine_tools.engine_core.src.domain.model.gateway.devops_platform_gateway import (
     DevopsPlatformGateway,
@@ -25,13 +26,18 @@ class GithubActions(DevopsPlatformGateway):
     ICON_SUCCESS = "\u2714"
     def get_remote_config(self, repository, path, branch=""):
+        token = os.environ.get("DET_REMOTE_TOKEN") or SystemVariables.github_access_token.value()
+        github_repository = os.environ.get("DET_GITHUB_REPOSITORY") or SystemVariables.github_repository.value()
+        # Accept both owner/repo and full URL formats.
+        if github_repository.startswith("https://") or github_repository.startswith("http://"):
+            github_repository = github_repository.rstrip("/").split("github.com/")[-1]
-        github_repository = SystemVariables.github_repository.value()
         split = github_repository.split("/")
         owner = split[0]
         utils_github = GithubApi()
-        git_client = utils_github.get_github_connection(SystemVariables.github_access_token.value())
+        git_client = utils_github.get_github_connection(token)
         json_config = utils_github.get_remote_json_config(git_client, owner, repository, path, branch)
         return json_config

	@@ -0,0 +1 @@
1	+ version = '1.158.0'

	@@ -1 +0,0 @@
1	- version = '1.156.1'

devsecops-engine-tools 1.156.1__tar.gz → 1.158.0__tar.gz

devsecops-engine-tools 1.156.1tar.gz → 1.158.0tar.gz