devsecops-engine-tools 1.35.0__tar.gz → 1.36.0__tar.gz

{devsecops_engine_tools-1.35.0 → devsecops_engine_tools-1.36.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.35.0
+Version: 1.36.0
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team
@@ -74,7 +74,7 @@ pip3 install devsecops-engine-tools
 ### Scan running - flags (CLI)
 
 ```bash
-devsecops-engine-tools --platform_devops ["local","azure","github"] --remote_config_repo ["remote_config_repo"] --remote_config_branch ["remote_config_branch"] --tool ["engine_iac", "engine_dast", "engine_secret", "engine_dependencies", "engine_container", "engine_risk", "engine_code"] --folder_path ["Folder path scan engine_iac, engine_code, engine_dependencies and engine_secret"] --platform ["k8s","cloudformation","docker", "openapi", "terraform"] --use_secrets_manager ["false", "true"] --use_vulnerability_management ["false", "true"] --send_metrics ["false", "true"] --token_cmdb ["token_cmdb"] --token_vulnerability_management ["token_vulnerability_management"] --token_engine_container ["token_engine_container"] --token_engine_dependencies ["token_engine_dependencies"] --token_external_checks ["token_external_checks"] --xray_mode ["scan", "audit"] --image_to_scan ["image_to_scan"] --dast_file_path ["dast_file_path"]
+devsecops-engine-tools --platform_devops ["local","azure","github"] --remote_config_repo ["remote_config_repo"] --remote_config_branch ["remote_config_branch"] --tool ["engine_iac", "engine_dast", "engine_secret", "engine_dependencies", "engine_container", "engine_risk", "engine_code"] --folder_path ["Folder path scan engine_iac, engine_code, engine_dependencies and engine_secret"] --platform ["k8s","cloudformation","docker", "openapi", "terraform"] --use_secrets_manager ["false", "true"] --use_vulnerability_management ["false", "true"] --send_metrics ["false", "true"] --token_cmdb ["token_cmdb"] --token_vulnerability_management ["token_vulnerability_management"] --token_engine_container ["token_engine_container"] --token_engine_dependencies ["token_engine_dependencies"] --token_external_checks ["token_external_checks"] --xray_mode ["scan", "audit","build-scan"] --image_to_scan ["image_to_scan"] --dast_file_path ["dast_file_path"]
 ```
 
 ### Structure Remote Config

{devsecops_engine_tools-1.35.0 → devsecops_engine_tools-1.36.0}/devsecops_engine_tools/engine_core/src/applications/runner_engine_core.py

@@ -160,7 +160,7 @@ def get_inputs_from_cli(args):
     )
     parser.add_argument(
         "--xray_mode",
-        choices=["scan", "audit"],
+        choices=["scan", "audit","build-scan"],
         required=False,
         default="scan",
         help="Mode to execute xray, only apply engine_dependencies xray tool",

{devsecops_engine_tools-1.35.0 → devsecops_engine_tools-1.36.0}/devsecops_engine_tools/engine_core/src/domain/model/gateway/devops_platform_gateway.py

@@ -21,6 +21,10 @@ class DevopsPlatformGateway(metaclass=ABCMeta):
     @abstractmethod
     def get_base_compact_remote_config_url(self, remote_config_repo):
         "get_base_compact_remote_config_url"
+    
+    @abstractmethod
+    def get_build_pipeline_execution_url(self):
+        "get_build_pipeline_execution_url"
 
     @abstractmethod
     def get_variable(self, variable):

{devsecops_engine_tools-1.35.0 → devsecops_engine_tools-1.36.0}/devsecops_engine_tools/engine_core/src/infrastructure/driven_adapters/azure/azure_devops.py

@@ -70,6 +70,9 @@ class AzureDevops(DevopsPlatformGateway):
             f"{remote_config_repo}?path=/"
         )
 
+    def get_build_pipeline_execution_url(self):
+        return f"{SystemVariables.System_TeamFoundationCollectionUri.value()}{SystemVariables.System_TeamProject.value()}/_build?buildId={BuildVariables.Build_BuildId.value()}"
+
     def get_variable(self, variable):
 
             variable_map = {

{devsecops_engine_tools-1.35.0 → devsecops_engine_tools-1.36.0}/devsecops_engine_tools/engine_core/src/infrastructure/driven_adapters/github/github_actions.py

@@ -61,6 +61,9 @@ class GithubActions(DevopsPlatformGateway):
         owner = split[0]
         return f"{SystemVariables.github_server_url}/{owner}/{remote_config_repo}"
 
+    def get_build_pipeline_execution_url(self):
+        return f"{SystemVariables.github_server_url.value()}/{SystemVariables.github_repository.value()}/actions/runs/{BuildVariables.github_run_id.value()}"
+
     def get_variable(self, variable):
         variable_map = {
             "branch_name": BuildVariables.github_ref,

{devsecops_engine_tools-1.35.0 → devsecops_engine_tools-1.36.0}/devsecops_engine_tools/engine_core/src/infrastructure/driven_adapters/runtime_local/runtime_local.py

@@ -42,6 +42,9 @@ class RuntimeLocal(DevopsPlatformGateway):
 
     def get_source_code_management_uri(self):
         return os.environ.get("DET_SOURCE_CODE_MANAGEMENT_URI")
+    
+    def get_build_pipeline_execution_url(self):
+        return os.environ.get("DET_BUILD_PIPELINE_EXECUTION_URL")
 
     def get_base_compact_remote_config_url(self, remote_config_repo):
         return f"{os.environ.get('DET_BASE_COMPACT_REMOTE_CONFIG_URL')}?path=/"

{devsecops_engine_tools-1.35.0 → devsecops_engine_tools-1.36.0}/devsecops_engine_tools/engine_sca/engine_dependencies/src/domain/model/gateways/tool_gateway.py

@@ -4,6 +4,6 @@ from abc import ABCMeta, abstractmethod
 class ToolGateway(metaclass=ABCMeta):
     @abstractmethod
     def run_tool_dependencies_sca(
-        self, remote_config, dict_args, to_scan, secret_tool, token_engine_dependencies
+        self, remote_config, dict_args,to_scan, secret_tool, token_engine_dependencies,**kwargs
     ) -> str:
         "run tool dependencies sca"

{devsecops_engine_tools-1.35.0 → devsecops_engine_tools-1.36.0}/devsecops_engine_tools/engine_sca/engine_dependencies/src/domain/usecases/dependencies_sca_scan.py

@@ -17,6 +17,9 @@ class DependenciesScan:
         pipeline_name,
         to_scan,
         secret_tool,
+        build_id,
+        build_url
+
     ):
         self.tool_run = tool_run
         self.tool_deserializator = tool_deserializator
@@ -26,6 +29,9 @@ class DependenciesScan:
         self.dict_args = dict_args
         self.to_scan = to_scan
         self.secret_tool = secret_tool
+        self.build_id = build_id
+        self.build_url = build_url
+
 
     def process(self):
         """
@@ -41,6 +47,8 @@ class DependenciesScan:
             self.to_scan,
             self.secret_tool,
             self.dict_args["token_engine_dependencies"],
+            build_id=self.build_id,
+            build_url=self.build_url
         )
 
     def deserializator(self, dependencies_scanned):

{devsecops_engine_tools-1.35.0 → devsecops_engine_tools-1.36.0}/devsecops_engine_tools/engine_sca/engine_dependencies/src/infrastructure/driven_adapters/dependency_check/dependency_check_tool.py

@@ -119,6 +119,7 @@ class DependencyCheckTool(ToolGateway):
         to_scan,
         token,
         token_engine_dependencies,
+        **kwargs,
     ):
         if not self.is_java_installed():
             logger.error(

{devsecops_engine_tools-1.35.0 → devsecops_engine_tools-1.36.0}/devsecops_engine_tools/engine_sca/engine_dependencies/src/infrastructure/driven_adapters/xray_tool/xray_manager_scan.py

@@ -105,13 +105,42 @@ class XrayScan(ToolGateway):
         if os.path.exists(gradlew_path):
             os.chmod(gradlew_path, 0o755)
 
-    def scan_dependencies(self, prefix, cwd, config, mode, to_scan):
+    def scan_dependencies(self, prefix, cwd,pipeline_name,build_id,build_url,config, mode, to_scan):
         command = [
             prefix,
             mode,
             "--format=json",
             f"{to_scan}",
         ]
+
+        if mode == "build-scan":
+            #build info execution command
+            build_info_command =[
+               prefix,
+               "rt",
+               "bp",
+                pipeline_name,
+                build_id,
+                "--env-exclude=*password*;*psw*;*secret*;*key*;*token*;*auth*;",
+                f"--build-url={build_url}"  
+            ]
+            build_info_result = subprocess.run(build_info_command, cwd=cwd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
+
+            if  not build_info_result.stdout:
+               logger.error(f"Build info  NOT  successfully deployed to Jfrog Arifactory.: {build_info_result.stderr}")
+               return None
+            print("##[info]Build info successfully deployed.")
+            #build-scan execution command
+            command = [
+                prefix,
+                mode,
+                pipeline_name,
+                build_id,
+                "--format=json",
+                "--vuln",
+                "--fail=false",
+                "--rescan=true"
+            ]
         result = subprocess.run(
             command, cwd=cwd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True
         )
@@ -153,9 +182,10 @@ class XrayScan(ToolGateway):
         to_scan,
         secret_tool,
         token_engine_dependencies,
+        **kwargs,
     ):
         token = secret_tool["token_xray"] if secret_tool else token_engine_dependencies
-        if dict_args["xray_mode"] == "scan":
+        if dict_args["xray_mode"] == "scan" or dict_args["xray_mode"] == "build-scan":
             get_artifacts = GetArtifacts()
             pattern = get_artifacts.excluded_files(
                 remote_config, pipeline_name, exclusion, "XRAY"
@@ -192,6 +222,9 @@ class XrayScan(ToolGateway):
         results_file = self.scan_dependencies(
             command_prefix,
             cwd,
+            pipeline_name,
+            kwargs.get("build_id"),
+            kwargs.get("build_url"),
             remote_config,
             dict_args["xray_mode"],
             to_scan,

{devsecops_engine_tools-1.35.0 → devsecops_engine_tools-1.36.0}/devsecops_engine_tools/engine_sca/engine_dependencies/src/infrastructure/entry_points/entry_point_tool.py

@@ -42,6 +42,8 @@ def init_engine_dependencies(
         dict_args["remote_config_branch"]
     )
     pipeline_name = tool_remote.get_variable("pipeline_name")
+    build_id = tool_remote.get_variable("build_id")
+    build_url = tool_remote.get_build_pipeline_execution_url()
 
     handle_remote_config_patterns = HandleRemoteConfigPatterns(
         remote_config, exclusions, pipeline_name
@@ -72,6 +74,9 @@ def init_engine_dependencies(
                 pipeline_name,
                 to_scan,
                 secret_tool,
+                build_id,
+                build_url
+
             )
             if config_sbom["ENABLED"] and any(
                 branch in str(tool_remote.get_variable("branch_tag"))

devsecops_engine_tools-1.36.0/devsecops_engine_tools/version.py

@@ -0,0 +1 @@
+version = '1.36.0'

{devsecops_engine_tools-1.35.0 → devsecops_engine_tools-1.36.0}/devsecops_engine_tools.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.35.0
+Version: 1.36.0
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team
@@ -74,7 +74,7 @@ pip3 install devsecops-engine-tools
 ### Scan running - flags (CLI)
 
 ```bash
-devsecops-engine-tools --platform_devops ["local","azure","github"] --remote_config_repo ["remote_config_repo"] --remote_config_branch ["remote_config_branch"] --tool ["engine_iac", "engine_dast", "engine_secret", "engine_dependencies", "engine_container", "engine_risk", "engine_code"] --folder_path ["Folder path scan engine_iac, engine_code, engine_dependencies and engine_secret"] --platform ["k8s","cloudformation","docker", "openapi", "terraform"] --use_secrets_manager ["false", "true"] --use_vulnerability_management ["false", "true"] --send_metrics ["false", "true"] --token_cmdb ["token_cmdb"] --token_vulnerability_management ["token_vulnerability_management"] --token_engine_container ["token_engine_container"] --token_engine_dependencies ["token_engine_dependencies"] --token_external_checks ["token_external_checks"] --xray_mode ["scan", "audit"] --image_to_scan ["image_to_scan"] --dast_file_path ["dast_file_path"]
+devsecops-engine-tools --platform_devops ["local","azure","github"] --remote_config_repo ["remote_config_repo"] --remote_config_branch ["remote_config_branch"] --tool ["engine_iac", "engine_dast", "engine_secret", "engine_dependencies", "engine_container", "engine_risk", "engine_code"] --folder_path ["Folder path scan engine_iac, engine_code, engine_dependencies and engine_secret"] --platform ["k8s","cloudformation","docker", "openapi", "terraform"] --use_secrets_manager ["false", "true"] --use_vulnerability_management ["false", "true"] --send_metrics ["false", "true"] --token_cmdb ["token_cmdb"] --token_vulnerability_management ["token_vulnerability_management"] --token_engine_container ["token_engine_container"] --token_engine_dependencies ["token_engine_dependencies"] --token_external_checks ["token_external_checks"] --xray_mode ["scan", "audit","build-scan"] --image_to_scan ["image_to_scan"] --dast_file_path ["dast_file_path"]
 ```
 
 ### Structure Remote Config

devsecops_engine_tools-1.35.0/devsecops_engine_tools/version.py

@@ -1 +0,0 @@
-version = '1.35.0'