devsecops-engine-tools 1.19.2__tar.gz → 1.20.0__tar.gz

{devsecops_engine_tools-1.19.2 → devsecops_engine_tools-1.20.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.19.2
+Version: 1.20.0
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

{devsecops_engine_tools-1.19.2 → devsecops_engine_tools-1.20.0}/devsecops_engine_tools/engine_risk/src/domain/usecases/break_build.py

@@ -25,6 +25,7 @@ class BreakBuild:
         vm_exclusions: "list[Exclusions]",
         report_list: "list[Report]",
         all_report: "list[Report]",
+        threshold: any,
     ):
         self.devops_platform_gateway = devops_platform_gateway
         self.printer_table_gateway = printer_table_gateway
@@ -33,6 +34,7 @@ class BreakBuild:
         self.vm_exclusions = vm_exclusions
         self.report_list = report_list
         self.all_report = all_report
+        self.threshold = threshold
         self.break_build = False
         self.warning_build = False
         self.report_breaker = []
@@ -117,13 +119,12 @@ class BreakBuild:
             print(self.devops_platform_gateway.result_pipeline("succeeded"))
 
     def _remediation_rate_control(self, all_report: "list[Report]"):
-        remote_config = self.remote_config
         mitigated = sum(1 for report in all_report if report.mitigated)
         total = len(all_report)
         print(f"Mitigated count: {mitigated}   Total count: {total}")
         remediation_rate_value = self._get_percentage(mitigated / total)
 
-        risk_threshold = remote_config["THRESHOLD"]["REMEDIATION_RATE"]
+        risk_threshold = self.threshold["REMEDIATION_RATE"]
         self.remediation_rate = remediation_rate_value
 
         if remediation_rate_value >= (risk_threshold + 5):
@@ -202,8 +203,8 @@ class BreakBuild:
     def _tag_blacklist_control(self, report_list: "list[Report]"):
         remote_config = self.remote_config
         if report_list:
-            tag_blacklist = set(remote_config["THRESHOLD"]["TAG_BLACKLIST"])
-            tag_age_threshold = remote_config["THRESHOLD"]["TAG_MAX_AGE"]
+            tag_blacklist = set(remote_config["TAG_BLACKLIST"])
+            tag_age_threshold = self.threshold["TAG_MAX_AGE"]
 
             filtered_reports_above_threshold = [
                 (report, tag)
@@ -247,7 +248,7 @@ class BreakBuild:
 
     def _risk_score_control(self, report_list: "list[Report]"):
         remote_config = self.remote_config
-        risk_score_threshold = remote_config["THRESHOLD"]["RISK_SCORE"]
+        risk_score_threshold = self.threshold["RISK_SCORE"]
         break_build = False
         if report_list:
             for report in report_list:

devsecops_engine_tools-1.20.0/devsecops_engine_tools/engine_risk/src/domain/usecases/check_threshold.py

@@ -0,0 +1,19 @@
+import re
+
+
+class CheckThreshold:
+    def __init__(self, pipeline_name, threshold, risk_exclusions):
+        self.pipeline_name = pipeline_name
+        self.threshold = threshold
+        self.risk_exclusions = risk_exclusions
+
+    def process(self):
+        if (self.pipeline_name in self.risk_exclusions.keys()) and (
+            self.risk_exclusions[self.pipeline_name].get("THRESHOLD", None)
+        ):
+            return self.risk_exclusions[self.pipeline_name]["THRESHOLD"]
+        elif "BY_PATTERN_SEARCH" in self.risk_exclusions.keys():
+            for pattern, values in self.risk_exclusions["BY_PATTERN_SEARCH"].items():
+                if re.match(pattern, self.pipeline_name):
+                    return values["THRESHOLD"]
+        return self.threshold

{devsecops_engine_tools-1.19.2 → devsecops_engine_tools-1.20.0}/devsecops_engine_tools/engine_risk/src/infrastructure/entry_points/entry_point_risk.py

@@ -10,6 +10,9 @@ from devsecops_engine_tools.engine_risk.src.domain.usecases.add_data import (
 from devsecops_engine_tools.engine_risk.src.domain.usecases.get_exclusions import (
     GetExclusions,
 )
+from devsecops_engine_tools.engine_risk.src.domain.usecases.check_threshold import (
+    CheckThreshold,
+)
 
 
 from devsecops_engine_tools.engine_utilities.utils.logger_info import MyLogger
@@ -33,6 +36,7 @@ def init_engine_risk(
     risk_exclusions = devops_platform_gateway.get_remote_config(
         dict_args["remote_config_repo"], "engine_risk/Exclusions.json"
     )
+    pipeline_name = devops_platform_gateway.get_variable("pipeline_name")
 
     if not findings:
         print("No findings found in Vulnerability Management Platform")
@@ -61,6 +65,10 @@ def init_engine_risk(
     )
     exclusions = get_exclusions.process()
 
+    threshold = CheckThreshold(
+        pipeline_name, remote_config["THRESHOLD"], risk_exclusions
+    ).process()
+
     break_build = BreakBuild(
         devops_platform_gateway,
         print_table_gateway,
@@ -69,6 +77,7 @@ def init_engine_risk(
         vm_exclusions,
         data_added,
         findings,
+        threshold,
     )
 
     return break_build.process()

{devsecops_engine_tools-1.19.2 → devsecops_engine_tools-1.20.0}/devsecops_engine_tools/engine_utilities/utils/utils.py

@@ -6,6 +6,9 @@ from devsecops_engine_tools.engine_core.src.domain.model.threshold import Thresh
 from devsecops_engine_tools.engine_core.src.domain.model.level_vulnerability import (
     LevelVulnerability,
 )
+from devsecops_engine_tools.engine_core.src.domain.model.level_compliance import (
+    LevelCompliance,
+)
 
 
 class Utils:
@@ -20,21 +23,23 @@ class Utils:
         return base64_token
 
     def update_threshold(self, threshold: Threshold, exclusions_data, pipeline_name):
-        def set_vulnerability(level):
-            threshold.vulnerability = LevelVulnerability(level)
+        def set_threshold(new_threshold):
+            threshold.vulnerability = LevelVulnerability(new_threshold.get("VULNERABILITY"))
+            threshold.compliance = LevelCompliance(new_threshold.get("COMPLIANCE")) if new_threshold.get("COMPLIANCE") else threshold.compliance
+            threshold.cve = new_threshold.get("CVE") if new_threshold.get("CVE") is not None else threshold.cve
             return threshold
 
         threshold_pipeline = exclusions_data.get(pipeline_name, {}).get("THRESHOLD", {})
         if threshold_pipeline:
-            return set_vulnerability(threshold_pipeline.get("VULNERABILITY"))
+            return set_threshold(threshold_pipeline)
 
         search_patterns = exclusions_data.get("BY_PATTERN_SEARCH", {})
         
         match_pattern = next(
-            (v["THRESHOLD"]["VULNERABILITY"]
+            (v["THRESHOLD"]
             for pattern, v in search_patterns.items()
             if re.match(pattern, pipeline_name, re.IGNORECASE)),
             None
         )
 
-        return set_vulnerability(match_pattern) if match_pattern else threshold
+        return set_threshold(match_pattern) if match_pattern else threshold

devsecops_engine_tools-1.20.0/devsecops_engine_tools/version.py

@@ -0,0 +1 @@
+version = '1.20.0'

{devsecops_engine_tools-1.19.2 → devsecops_engine_tools-1.20.0}/devsecops_engine_tools.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.19.2
+Version: 1.20.0
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

{devsecops_engine_tools-1.19.2 → devsecops_engine_tools-1.20.0}/devsecops_engine_tools.egg-info/SOURCES.txt

@@ -83,6 +83,7 @@ devsecops_engine_tools/engine_risk/src/domain/model/gateways/add_epss_gateway.py
 devsecops_engine_tools/engine_risk/src/domain/usecases/__init__.py
 devsecops_engine_tools/engine_risk/src/domain/usecases/add_data.py
 devsecops_engine_tools/engine_risk/src/domain/usecases/break_build.py
+devsecops_engine_tools/engine_risk/src/domain/usecases/check_threshold.py
 devsecops_engine_tools/engine_risk/src/domain/usecases/get_exclusions.py
 devsecops_engine_tools/engine_risk/src/domain/usecases/handle_filters.py
 devsecops_engine_tools/engine_risk/src/infrastructure/__init__.py

devsecops_engine_tools-1.19.2/devsecops_engine_tools/version.py

@@ -1 +0,0 @@
-version = '1.19.2'