devsecops-engine-tools 1.21.0__tar.gz → 1.23.1__tar.gz

{devsecops_engine_tools-1.21.0 → devsecops_engine_tools-1.23.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.21.0
+Version: 1.23.1
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team
@@ -68,7 +68,7 @@ pip3 install devsecops-engine-tools
 ### Scan running - flags (CLI)
 
 ```bash
-devsecops-engine-tools --platform_devops ["local","azure","github"] --remote_config_repo ["remote_config_repo"] --tool ["engine_iac", "engine_dast", "engine_secret", "engine_dependencies", "engine_container", "engine_risk", "engine_code"] --folder_path ["Folder path scan engine_iac, engine_code and engine_dependencies"] --platform ["k8s","cloudformation","docker", "openapi", "terraform"] --use_secrets_manager ["false", "true"] --use_vulnerability_management ["false", "true"] --send_metrics ["false", "true"] --token_cmdb ["token_cmdb"] --token_vulnerability_management ["token_vulnerability_management"] --token_engine_container ["token_engine_container"] --token_engine_dependencies ["token_engine_dependencies"] --token_external_checks ["token_external_checks"] --xray_mode ["scan", "audit"] --image_to_scan ["image_to_scan"]
+devsecops-engine-tools --platform_devops ["local","azure","github"] --remote_config_repo ["remote_config_repo"] --remote_config_branch ["remote_config_branch"] --tool ["engine_iac", "engine_dast", "engine_secret", "engine_dependencies", "engine_container", "engine_risk", "engine_code"] --folder_path ["Folder path scan engine_iac, engine_code and engine_dependencies"] --platform ["k8s","cloudformation","docker", "openapi", "terraform"] --use_secrets_manager ["false", "true"] --use_vulnerability_management ["false", "true"] --send_metrics ["false", "true"] --token_cmdb ["token_cmdb"] --token_vulnerability_management ["token_vulnerability_management"] --token_engine_container ["token_engine_container"] --token_engine_dependencies ["token_engine_dependencies"] --token_external_checks ["token_external_checks"] --xray_mode ["scan", "audit"] --image_to_scan ["image_to_scan"]
 ```
 
 ### Structure Remote Config

{devsecops_engine_tools-1.21.0 → devsecops_engine_tools-1.23.1}/README.md

@@ -108,6 +108,7 @@ devsecops_engine_tools
 |           defect_dojo
 |           github
 |           input_validations
+|           sonarqube
 |           ssh
 |           utils
 ```

{devsecops_engine_tools-1.21.0 → devsecops_engine_tools-1.23.1}/devsecops_engine_tools/engine_core/src/applications/runner_engine_core.py

@@ -69,7 +69,15 @@ def get_inputs_from_cli(args):
         "--remote_config_repo",
         type=str,
         required=True,
-        help="Name or Folder Path of Config Repo",
+        help="Name or Folder Path of Remote Config Repo",
+    )
+    parser.add_argument(
+        "-rcb",
+        "--remote_config_branch",
+        type=str,
+        required=False,
+        default="",
+        help="Name of the branch of Remote Config Repo",
     )
     parser.add_argument(
         "-t",
@@ -144,7 +152,7 @@ def get_inputs_from_cli(args):
     parser.add_argument(
         "--token_external_checks",
         required=False,
-        help="Token for downloading external checks from engine_iac or engine_secret if is necessary. Ej: github:token, ssh:privatekey:pass",
+        help="Token for downloading external checks from engine_iac or engine_secret if is necessary. Ej: github_token:token, github_app:private_key, ssh:privatekey:pass",
     )
     parser.add_argument(
         "--xray_mode",
@@ -162,6 +170,7 @@ def get_inputs_from_cli(args):
     return {
         "platform_devops": args.platform_devops,
         "remote_config_repo": args.remote_config_repo,
+        "remote_config_branch": args.remote_config_branch,
         "tool": args.tool,
         "folder_path": args.folder_path,
         "platform": args.platform,

{devsecops_engine_tools-1.21.0 → devsecops_engine_tools-1.23.1}/devsecops_engine_tools/engine_core/src/domain/model/gateway/devops_platform_gateway.py

@@ -3,7 +3,7 @@ from abc import ABCMeta, abstractmethod
 
 class DevopsPlatformGateway(metaclass=ABCMeta):
     @abstractmethod
-    def get_remote_config(self, repository, path):
+    def get_remote_config(self, repository, path, branch):
         "get_remote_config"
 
     @abstractmethod

{devsecops_engine_tools-1.21.0 → devsecops_engine_tools-1.23.1}/devsecops_engine_tools/engine_core/src/domain/usecases/handle_risk.py

@@ -86,7 +86,7 @@ class HandleRisk:
 
     def _exclude_services(self, dict_args, pipeline_name, service_list):
         risk_exclusions = self.devops_platform_gateway.get_remote_config(
-            dict_args["remote_config_repo"], "engine_risk/Exclusions.json"
+            dict_args["remote_config_repo"], "engine_risk/Exclusions.json", dict_args["remote_config_branch"]
         )
         if (
             pipeline_name in risk_exclusions
@@ -129,10 +129,10 @@ class HandleRisk:
 
     def process(self, dict_args: any, remote_config: any):
         risk_config = self.devops_platform_gateway.get_remote_config(
-            dict_args["remote_config_repo"], "engine_risk/ConfigTool.json"
+            dict_args["remote_config_repo"], "engine_risk/ConfigTool.json", dict_args["remote_config_branch"]
         )
         risk_exclusions = self.devops_platform_gateway.get_remote_config(
-            dict_args["remote_config_repo"], "engine_risk/Exclusions.json"
+            dict_args["remote_config_repo"], "engine_risk/Exclusions.json", dict_args["remote_config_branch"]
         )
         pipeline_name = self.devops_platform_gateway.get_variable("pipeline_name")
 

{devsecops_engine_tools-1.21.0 → devsecops_engine_tools-1.23.1}/devsecops_engine_tools/engine_core/src/infrastructure/driven_adapters/azure/azure_devops.py

@@ -23,7 +23,8 @@ logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
 
 @dataclass
 class AzureDevops(DevopsPlatformGateway):
-    def get_remote_config(self, repository, path):
+    def get_remote_config(self, repository, path, branch=""):
+
         base_compact_remote_config_url = (
             f"https://{SystemVariables.System_TeamFoundationCollectionUri.value().rstrip('/').split('/')[-1].replace('.visualstudio.com','')}"
             f".visualstudio.com/{SystemVariables.System_TeamProject.value()}/_git/"
@@ -34,7 +35,7 @@ class AzureDevops(DevopsPlatformGateway):
             compact_remote_config_url=base_compact_remote_config_url,
         )
         connection = utils_azure.get_azure_connection()
-        return utils_azure.get_remote_json_config(connection=connection)
+        return utils_azure.get_remote_json_config(connection=connection, branch=branch)
 
     def message(self, type, message):
         if type == "succeeded":

{devsecops_engine_tools-1.21.0 → devsecops_engine_tools-1.23.1}/devsecops_engine_tools/engine_core/src/infrastructure/driven_adapters/github/github_actions.py

@@ -22,18 +22,15 @@ class GithubActions(DevopsPlatformGateway):
     ICON_FAIL = "\u2718"
     ICON_SUCCESS = "\u2714"
 
-    def get_remote_config(self, repository, path):
+    def get_remote_config(self, repository, path, branch=""):
 
         github_repository = SystemVariables.github_repository.value()
         split = github_repository.split("/")
         owner = split[0]
 
-        utils_github = GithubApi(
-            personal_access_token=SystemVariables.github_access_token.value()
-        )
-
-        git_client = utils_github.get_github_connection()
-        json_config = utils_github.get_remote_json_config(git_client, owner, repository, path)
+        utils_github = GithubApi()
+        git_client = utils_github.get_github_connection(SystemVariables.github_access_token.value())
+        json_config = utils_github.get_remote_json_config(git_client, owner, repository, path, branch)
 
         return json_config
 
@@ -92,4 +89,4 @@ class GithubActions(DevopsPlatformGateway):
         try:
             return variable_map.get(variable).value()
         except ValueError:
-            return None
+            return None

{devsecops_engine_tools-1.21.0 → devsecops_engine_tools-1.23.1}/devsecops_engine_tools/engine_core/src/infrastructure/driven_adapters/runtime_local/runtime_local.py

@@ -18,8 +18,10 @@ class RuntimeLocal(DevopsPlatformGateway):
     ICON_SUCCESS = "\u2714"
 
 
-    def get_remote_config(self, repository, path):
-        with open(f"{repository}/{path}") as f:
+    def get_remote_config(self, repository, path, branch=""):
+        remote_config_path = f"{repository}/{path}"
+
+        with open(remote_config_path) as f:
             return json.load(f)
 
     def message(self, type, message):

{devsecops_engine_tools-1.21.0 → devsecops_engine_tools-1.23.1}/devsecops_engine_tools/engine_core/src/infrastructure/entry_points/entry_point_core.py

@@ -24,7 +24,7 @@ def init_engine_core(
     args: any
 ):
     config_tool = devops_platform_gateway.get_remote_config(
-        args["remote_config_repo"], "/engine_core/ConfigTool.json"
+        args["remote_config_repo"], "/engine_core/ConfigTool.json", args["remote_config_branch"]
     )
     Printers.print_logo_tool(config_tool["BANNER"])
 

{devsecops_engine_tools-1.21.0 → devsecops_engine_tools-1.23.1}/devsecops_engine_tools/engine_risk/src/domain/usecases/get_exclusions.py

@@ -22,7 +22,7 @@ class GetExclusions:
 
     def process(self):
         core_config = self.devops_platform_gateway.get_remote_config(
-            self.dict_args["remote_config_repo"], "engine_core/ConfigTool.json"
+            self.dict_args["remote_config_repo"], "engine_core/ConfigTool.json", self.dict_args["remote_config_branch"]
         )
         unique_tags = self._get_unique_tags()
         exclusions = []
@@ -42,7 +42,7 @@ class GetExclusions:
 
     def _get_exclusions_by_practice(self, core_config, practice, path):
         exclusions_config = self.devops_platform_gateway.get_remote_config(
-            self.dict_args["remote_config_repo"], path
+            self.dict_args["remote_config_repo"], path, self.dict_args["remote_config_branch"]
         )
         tool = core_config[practice.upper()]["TOOL"]
         return self._get_exclusions(exclusions_config, tool)

{devsecops_engine_tools-1.21.0 → devsecops_engine_tools-1.23.1}/devsecops_engine_tools/engine_risk/src/infrastructure/entry_points/entry_point_risk.py

@@ -31,10 +31,10 @@ def init_engine_risk(
     vm_exclusions,
 ):
     remote_config = devops_platform_gateway.get_remote_config(
-        dict_args["remote_config_repo"], "engine_risk/ConfigTool.json"
+        dict_args["remote_config_repo"], "engine_risk/ConfigTool.json", dict_args["remote_config_branch"]
     )
     risk_exclusions = devops_platform_gateway.get_remote_config(
-        dict_args["remote_config_repo"], "engine_risk/Exclusions.json"
+        dict_args["remote_config_repo"], "engine_risk/Exclusions.json", dict_args["remote_config_branch"]
     )
     pipeline_name = devops_platform_gateway.get_variable("pipeline_name")
 

{devsecops_engine_tools-1.21.0 → devsecops_engine_tools-1.23.1}/devsecops_engine_tools/engine_sast/engine_code/src/domain/usecases/code_scan.py

@@ -33,7 +33,7 @@ class CodeScan:
 
     def set_config_tool(self, dict_args):
         init_config_tool = self.devops_platform_gateway.get_remote_config(
-            dict_args["remote_config_repo"], "engine_sast/engine_code/ConfigTool.json"
+            dict_args["remote_config_repo"], "engine_sast/engine_code/ConfigTool.json", dict_args["remote_config_branch"]
         )
         scope_pipeline = self.devops_platform_gateway.get_variable("pipeline_name")
         return ConfigTool(json_data=init_config_tool, scope=scope_pipeline)

{devsecops_engine_tools-1.21.0 → devsecops_engine_tools-1.23.1}/devsecops_engine_tools/engine_sast/engine_iac/src/domain/usecases/iac_scan.py

@@ -28,11 +28,11 @@ class IacScan:
 
     def process(self, dict_args, secret_tool, tool, env):
         config_tool_iac = self.devops_platform_gateway.get_remote_config(
-            dict_args["remote_config_repo"], "engine_sast/engine_iac/ConfigTool.json"
+            dict_args["remote_config_repo"], "engine_sast/engine_iac/ConfigTool.json", dict_args["remote_config_branch"]
         )
 
         exclusions = self.devops_platform_gateway.get_remote_config(
-            dict_args["remote_config_repo"], "engine_sast/engine_iac/Exclusions.json"
+            dict_args["remote_config_repo"], "engine_sast/engine_iac/Exclusions.json", dict_args["remote_config_branch"]
         )
 
         config_tool_core, folders_to_scan, skip_tool = self.complete_config_tool(

{devsecops_engine_tools-1.21.0 → devsecops_engine_tools-1.23.1}/devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/checkov/checkov_tool.py

@@ -19,22 +19,15 @@ from devsecops_engine_tools.engine_sast.engine_iac.src.infrastructure.driven_ada
 from devsecops_engine_tools.engine_sast.engine_iac.src.infrastructure.helpers.file_generator_tool import (
     generate_file_from_tool,
 )
-from devsecops_engine_tools.engine_utilities.github.infrastructure.github_api import (
-    GithubApi,
-)
-from devsecops_engine_tools.engine_utilities.ssh.managment_private_key import (
-    create_ssh_private_file,
-    add_ssh_private_key,
-    decode_base64,
-    config_knowns_hosts,
-)
 from devsecops_engine_tools.engine_utilities.utils.logger_info import MyLogger
 from devsecops_engine_tools.engine_utilities import settings
+from devsecops_engine_tools.engine_utilities.utils.utils import Utils
 
 logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
 
 
 class CheckovTool(ToolGateway):
+    
     CHECKOV_CONFIG_FILE = "checkov_config.yaml"
     TOOL_CHECKOV = "CHECKOV"
     framework_mapping = {
@@ -62,43 +55,6 @@ class CheckovTool(ToolGateway):
             yaml.dump(checkov_config.dict_confg_file, file)
             file.close()
 
-    def configurate_external_checks(self, config_tool, secret):
-        agent_env = None
-        try:
-            if secret is None:
-                logger.warning("The secret is not configured for external controls")
-
-            # Create configuration git external checks
-            elif config_tool[self.TOOL_CHECKOV][
-                "USE_EXTERNAL_CHECKS_GIT"
-            ] == "True" and platform.system() in (
-                "Linux",
-                "Darwin",
-            ):
-                config_knowns_hosts(
-                    config_tool[self.TOOL_CHECKOV]["EXTERNAL_GIT_SSH_HOST"],
-                    config_tool[self.TOOL_CHECKOV][
-                        "EXTERNAL_GIT_PUBLIC_KEY_FINGERPRINT"
-                    ],
-                )
-                ssh_key_content = decode_base64(secret["repository_ssh_private_key"])
-                ssh_key_file_path = "/tmp/ssh_key_file"
-                create_ssh_private_file(ssh_key_file_path, ssh_key_content)
-                ssh_key_password = decode_base64(secret["repository_ssh_password"])
-                agent_env = add_ssh_private_key(ssh_key_file_path, ssh_key_password)
-
-            # Create configuration dir external checks
-            elif config_tool[self.TOOL_CHECKOV]["USE_EXTERNAL_CHECKS_DIR"] == "True":
-                github_api = GithubApi(secret["github_token"])
-                github_api.download_latest_release_assets(
-                    config_tool[self.TOOL_CHECKOV]["EXTERNAL_DIR_OWNER"],
-                    config_tool[self.TOOL_CHECKOV]["EXTERNAL_DIR_REPOSITORY"],
-                    "/tmp",
-                )
-
-        except Exception as ex:
-            logger.error(f"An error ocurred configuring external checks {ex}")
-        return agent_env
 
     def retryable_install_package(self, package: str, version: str) -> bool:
         MAX_RETRIES = 3
@@ -258,29 +214,8 @@ class CheckovTool(ToolGateway):
         secret_tool,
         secret_external_checks,
     ):
-        secret = None
-        if secret_tool is not None:
-            secret = secret_tool
-        elif secret_external_checks is not None:
-            secret = {
-                "github_token": (
-                    secret_external_checks.split("github:")[1]
-                    if "github" in secret_external_checks
-                    else None
-                ),
-                "repository_ssh_private_key": (
-                    secret_external_checks.split("ssh:")[1].split(":")[0]
-                    if "ssh" in secret_external_checks
-                    else None
-                ),
-                "repository_ssh_password": (
-                    secret_external_checks.split("ssh:")[1].split(":")[1]
-                    if "ssh" in secret_external_checks
-                    else None
-                ),
-            }
-
-        agent_env = self.configurate_external_checks(config_tool, secret)
+        util = Utils()
+        agent_env = util.configurate_external_checks(self.TOOL_CHECKOV,config_tool, secret_tool,secret_external_checks)
 
         checkov_install = self.retryable_install_package(
             "checkov", config_tool[self.TOOL_CHECKOV]["VERSION"]
@@ -310,4 +245,4 @@ class CheckovTool(ToolGateway):
                 ),
             )
         else:
-            return [], None
+            return [], None

{devsecops_engine_tools-1.21.0 → devsecops_engine_tools-1.23.1}/devsecops_engine_tools/engine_sast/engine_secret/src/domain/model/DeserializeConfigTool.py

@@ -12,5 +12,7 @@ class DeserializeConfigTool:
         self.enable_custom_rules = json_data[tool]["ENABLE_CUSTOM_RULES"]
         self.external_dir_owner = json_data[tool]["EXTERNAL_DIR_OWNER"]
         self.external_dir_repo = json_data[tool]["EXTERNAL_DIR_REPOSITORY"]
+        self.app_id_github = json_data[tool]["APP_ID_GITHUB"]
+        self.installation_id_github = json_data[tool]["INSTALLATION_ID_GITHUB"]
         self.tool_version = json_data[tool]["VERSION"]
         self.extradata_rules = json_data[tool]["RULES"]

{devsecops_engine_tools-1.21.0 → devsecops_engine_tools-1.23.1}/devsecops_engine_tools/engine_sast/engine_secret/src/domain/usecases/secret_scan.py

@@ -67,7 +67,7 @@ class SecretScan:
     def complete_config_tool(self, dict_args, tool):
         tool = str(tool).lower()
         init_config_tool = self.devops_platform_gateway.get_remote_config(
-            dict_args["remote_config_repo"], "engine_sast/engine_secret/ConfigTool.json"
+            dict_args["remote_config_repo"], "engine_sast/engine_secret/ConfigTool.json", dict_args["remote_config_branch"]
         )
         config_tool = DeserializeConfigTool(json_data=init_config_tool, tool=tool)
         config_tool.scope_pipeline = self.devops_platform_gateway.get_variable("pipeline_name")

{devsecops_engine_tools-1.21.0 → devsecops_engine_tools-1.23.1}/devsecops_engine_tools/engine_sast/engine_secret/src/domain/usecases/set_input_core.py

@@ -30,7 +30,7 @@ class SetInputCore:
             dict: Remote configuration.
         """
         return self.tool_remote.get_remote_config(
-            self.dict_args["remote_config_repo"], file_path
+            self.dict_args["remote_config_repo"], file_path, self.dict_args["remote_config_branch"]
         )
 
     def get_variable(self, variable):

{devsecops_engine_tools-1.21.0 → devsecops_engine_tools-1.23.1}/devsecops_engine_tools/engine_sast/engine_secret/src/infrastructure/driven_adapters/trufflehog/trufflehog_run.py

@@ -73,9 +73,15 @@ class TrufflehogRun(ToolGateway):
         include_paths = self.config_include_path(files_commits, agent_work_folder, agent_os)
         enable_custom_rules = config_tool.enable_custom_rules.lower()
         secret = None
-        
+        github_api = GithubApi()
+
         if secret_tool is not None:
-            secret = secret_tool["github_token"] if "github_token" in secret_tool else None
+            secret_tmp = secret_tool
+            secret = github_api.get_installation_access_token(
+                secret_tmp["github_token"],
+                config_tool.app_id_github,
+                config_tool.installation_id_github
+            )
         elif secret_external_checks is not None:
             secret = secret_external_checks.split("github:")[1] if "github" in secret_external_checks else None            
 
@@ -161,10 +167,11 @@ class TrufflehogRun(ToolGateway):
     
     def configurate_external_checks(self, config_tool, secret):
         try:
-            github_api = GithubApi(secret)
+            github_api = GithubApi()
             github_api.download_latest_release_assets(
                 config_tool.external_dir_owner,
                 config_tool.external_dir_repo,
+                secret,
                 "/tmp",
             )
         except Exception as ex:

{devsecops_engine_tools-1.21.0 → devsecops_engine_tools-1.23.1}/devsecops_engine_tools/engine_sast/engine_secret/src/infrastructure/entry_points/entry_point_tool.py

@@ -6,7 +6,7 @@ from devsecops_engine_tools.engine_sast.engine_secret.src.domain.usecases.set_in
 
 def engine_secret_scan(devops_platform_gateway, tool_gateway, dict_args, tool, tool_deserealizator, git_gateway, secret_tool):
     exclusions = devops_platform_gateway.get_remote_config(
-        dict_args["remote_config_repo"], "engine_sast/engine_secret/Exclusions.json"
+        dict_args["remote_config_repo"], "engine_sast/engine_secret/Exclusions.json", dict_args["remote_config_branch"]
     )
     secret_scan = SecretScan(tool_gateway, devops_platform_gateway, tool_deserealizator, git_gateway)
     config_tool, skip_tool_isp = secret_scan.complete_config_tool(dict_args, tool)

{devsecops_engine_tools-1.21.0 → devsecops_engine_tools-1.23.1}/devsecops_engine_tools/engine_sca/engine_container/src/infrastructure/entry_points/entry_point_tool.py

@@ -23,10 +23,10 @@ def init_engine_sca_rm(
     tool,
 ):
     remote_config = tool_remote.get_remote_config(
-        dict_args["remote_config_repo"], "engine_sca/engine_container/ConfigTool.json"
+        dict_args["remote_config_repo"], "engine_sca/engine_container/ConfigTool.json", dict_args["remote_config_branch"]
     )
     exclusions = tool_remote.get_remote_config(
-        dict_args["remote_config_repo"], "engine_sca/engine_container/Exclusions.json"
+        dict_args["remote_config_repo"], "engine_sca/engine_container/Exclusions.json", dict_args["remote_config_branch"]
     )
     pipeline_name = tool_remote.get_variable("pipeline_name")
     handle_remote_config_patterns = HandleRemoteConfigPatterns(

{devsecops_engine_tools-1.21.0 → devsecops_engine_tools-1.23.1}/devsecops_engine_tools/engine_sca/engine_dependencies/src/infrastructure/entry_points/entry_point_tool.py

@@ -23,10 +23,12 @@ def init_engine_dependencies(
     remote_config = tool_remote.get_remote_config(
         dict_args["remote_config_repo"],
         "engine_sca/engine_dependencies/ConfigTool.json",
+        dict_args["remote_config_branch"]
     )
     exclusions = tool_remote.get_remote_config(
         dict_args["remote_config_repo"],
         "engine_sca/engine_dependencies/Exclusions.json",
+        dict_args["remote_config_branch"]
     )
     pipeline_name = tool_remote.get_variable("pipeline_name")
 

{devsecops_engine_tools-1.21.0 → devsecops_engine_tools-1.23.1}/devsecops_engine_tools/engine_sca/engine_dependencies/src/infrastructure/helpers/get_artifacts.py

@@ -14,7 +14,9 @@ class GetArtifacts:
 
     def excluded_files(self, remote_config, pipeline_name, exclusions, tool):
         pattern = remote_config[tool]["REGEX_EXPRESSION_EXTENSIONS"]
-        if pipeline_name in exclusions:
+        if (pipeline_name in exclusions) and (
+            exclusions[pipeline_name].get(tool, None)
+        ):
             for ex in exclusions[pipeline_name][tool]:
                 if ex.get("SKIP_FILES", 0):
                     exclusion = ex.get("SKIP_FILES")

{devsecops_engine_tools-1.21.0 → devsecops_engine_tools-1.23.1}/devsecops_engine_tools/engine_utilities/azuredevops/infrastructure/azure_devops_api.py

@@ -2,6 +2,7 @@ import json
 from devsecops_engine_tools.engine_utilities.utils.api_error import ApiError
 from urllib.parse import urlsplit, unquote
 from azure.devops.connection import Connection
+from azure.devops.v7_1.wiki.models import GitVersionDescriptor    
 from msrest.authentication import BasicAuthentication
 from devsecops_engine_tools.engine_utilities.utils.logger_info import MyLogger
 from devsecops_engine_tools.engine_utilities.settings import SETTING_LOGGER
@@ -48,14 +49,19 @@ class AzureDevopsApi:
         except Exception as e:
             raise ApiError("Error getting Azure DevOps connection: " + str(e))
 
-    def get_remote_json_config(self, connection: Connection):
+    def get_remote_json_config(self, connection: Connection, branch):
         try:
             git_client = connection.clients.get_git_client()
+            version_descriptor = None
+            if branch: version_descriptor = GitVersionDescriptor(version=branch, version_type="branch")
+
             file_content = git_client.get_item_text(
                 repository_id=self.__repository_id,
                 path=self.__remote_config_path,
                 project=self.__project_remote_config,
+                version_descriptor=version_descriptor
             )
+            
             data = json.loads(b"".join(file_content).decode("utf-8"))
             return data
         except Exception as e:

{devsecops_engine_tools-1.21.0 → devsecops_engine_tools-1.23.1}/devsecops_engine_tools/engine_utilities/github/infrastructure/github_api.py

@@ -1,28 +1,28 @@
 import requests
 import zipfile
 import json
-from github import Github
+from github import Github, GithubIntegration
 from devsecops_engine_tools.engine_utilities.utils.api_error import ApiError
 
 
 class GithubApi:
-    def __init__(
-            self,
-            personal_access_token: str = ""
-    ):
-        self.__personal_access_token = personal_access_token
 
     def unzip_file(self, zip_file_path, extract_path):
         with zipfile.ZipFile(zip_file_path, "r") as zip_ref:
             zip_ref.extractall(extract_path)
+    
+    def get_installation_access_token(self,private_key,app_id,instalation_id):
+        if private_key:
+            private_key = private_key.replace("\\n", "\n")
+        integration = GithubIntegration(app_id, private_key)
+        access_token = integration.get_access_token(instalation_id)
+        return access_token.token
 
     def download_latest_release_assets(
-        self, owner, repository, download_path="."
-    ):
+        self, owner, repository, token, download_path=".",
+    ):               
         url = f"https://api.github.com/repos/{owner}/{repository}/releases/latest"
-
-        headers = {"Authorization": f"token {self.__personal_access_token}"}
-
+        headers = {"Authorization": f"token {token}", "Accept": "application/vnd.github+json"}
         response = requests.get(url, headers=headers)
 
         if response.status_code == 200:
@@ -32,11 +32,8 @@ class GithubApi:
             for asset in assets:
                 asset_url = asset["url"]
                 asset_name = asset["name"]
-
                 headers.update({"Accept": "application/octet-stream"})
-
                 response = requests.get(asset_url, headers=headers, stream=True)
-
                 if response.status_code == 200:
                     with open(f"{download_path}/{asset_name}", "wb") as file:
                         for chunk in response.iter_content(chunk_size=8192):
@@ -51,18 +48,20 @@ class GithubApi:
                 f"Error getting the assets of the last release. Status code: {response.status_code}"
             )
 
-    def get_github_connection(self):
-        git_client = Github(self.__personal_access_token)
-
+    def get_github_connection(self,personal_access_token):
+        git_client = Github(personal_access_token)
         return git_client
 
-    def get_remote_json_config(self, git_client: Github, owner, repository, path):
+    def get_remote_json_config(self, git_client: Github, owner, repository, path, branch=""):
         try:
             repo = git_client.get_repo(f"{owner}/{repository}")
-            file_content = repo.get_contents(path)
+
+            if branch: file_content = repo.get_contents(path, ref=branch)
+            else: file_content = repo.get_contents(path)
+
             data = file_content.decoded_content.decode()
             content_json = json.loads(data)
 
             return content_json
         except Exception as e:
-            raise ApiError("Error getting remote github configuration file: " + str(e))
+            raise ApiError("Error getting remote github configuration file: " + str(e))

{devsecops_engine_tools-1.21.0 → devsecops_engine_tools-1.23.1}/devsecops_engine_tools/engine_utilities/sonarqube/src/applications/runner_report_sonar.py

@@ -32,6 +32,14 @@ def get_inputs_from_cli(args):
         required=True,
         help="Name of Config Repo",
     )
+    parser.add_argument(
+        "-rcb",
+        "--remote_config_branch",
+        type=str,
+        required=False,
+        default="",
+        help="Name of the branch of Config Repo",
+    )
     parser.add_argument(
         "--use_secrets_manager",
         choices=["true", "false"],
@@ -70,6 +78,7 @@ def get_inputs_from_cli(args):
     args = parser.parse_args()
     return {
         "remote_config_repo": args.remote_config_repo,
+        "remote_config_branch": args.remote_config_branch,
         "use_secrets_manager": args.use_secrets_manager,
         "send_metrics": args.send_metrics,
         "sonar_url": args.sonar_url,

{devsecops_engine_tools-1.21.0 → devsecops_engine_tools-1.23.1}/devsecops_engine_tools/engine_utilities/sonarqube/src/domain/usecases/report_sonar.py

@@ -60,7 +60,8 @@ class ReportSonar:
         )
         config_tool = self.devops_platform_gateway.get_remote_config(
             args["remote_config_repo"],
-            "/engine_core/ConfigTool.json"
+            "/engine_core/ConfigTool.json",
+            args["remote_config_branch"]
         )
         environment = define_env(None, branch)
         
@@ -73,7 +74,8 @@ class ReportSonar:
 
         report_config_tool = self.devops_platform_gateway.get_remote_config(
             args["remote_config_repo"],
-            "/report_sonar/ConfigTool.json"
+            "/report_sonar/ConfigTool.json",
+            args["remote_config_branch"]
         )
 
         get_components = report_config_tool["PIPELINE_COMPONENTS"].get(pipeline_name)

{devsecops_engine_tools-1.21.0 → devsecops_engine_tools-1.23.1}/devsecops_engine_tools/engine_utilities/sonarqube/src/infrastructure/entry_points/entry_point_report_sonar.py

@@ -15,7 +15,7 @@ logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
 
 def init_report_sonar(vulnerability_management_gateway, secrets_manager_gateway, devops_platform_gateway, sonar_gateway, metrics_manager_gateway, args):
     config_tool = devops_platform_gateway.get_remote_config(
-        args["remote_config_repo"], "/engine_core/ConfigTool.json"
+        args["remote_config_repo"], "/engine_core/ConfigTool.json", args["remote_config_branch"]
     )
     report_config_tool = devops_platform_gateway.get_remote_config(
         args["remote_config_repo"], "/report_sonar/ConfigTool.json"