* Improve logs of credentialdiggerScan step
* 'Restore step'
* Use dockerhub image for Credential Digger
* Regenerate credentialdiggerScan
* Update docker image tag
* Fix report generation with exportAll
* Update docker image for credentialdiggerScan
* Regenerate credentialdiggerScan step with new docker image
* Dont duplicate step name with log.Entry()
* Refactor RepoURL according to #4639
---------
Co-authored-by: Marcus Holl <marcus.holl@sap.com>
Co-authored-by: Googlom <36107508+Googlom@users.noreply.github.com>
* Remove blue green deployment support for cf native build tools
* Empty for testing
* Remove obsolete dependency
* feedback from code review
* Fix IT's run
* Add test
* chore: switch to new parameter name
Since warnings-ng plugin version 11 the blameDisabled parameter
has been replaced by skipBlames.
To be compatible with Jenkinsfile Runner we put the recordIssues step
into a try/catch, so no exception is thrown and the build fails.
* docs: improve wording
Co-authored-by: Srinikitha Kondreddy <srinikitha.kondreddy@sap.com>
---------
Co-authored-by: Srinikitha Kondreddy <srinikitha.kondreddy@sap.com>
* fix dead link in sonarExecuteScan.yaml
https://docs.sonarqube.org/display/SCAN/Analyzing+with+SonarQube+Scanner leads to "Page not found"
* Update sonarExecuteScan.yaml
* Update sonarExecuteScan.yaml
typo
* Update sonarExecuteScan_generated.go
---------
Co-authored-by: Christopher Fenner <26137398+CCFenner@users.noreply.github.com>
* Initial in progress
* compiling but not yet functional
* Missed file
* updated checkmarxone step
* Working up to fetching a project then breaks
* Missed file
* Breaks when retrieving projects+proxy set
* Create project & run scan working, now polling
* Fixed polling
* added back the zipfile remove command
* Fixed polling again
* Generates and downloads PDF report
* Updated and working, prep for refactor
* Added compliance steps
* Cleanup, reporting, added groovy connector
* fixed groovy file
* checkmarxone to checkmarxOne
* checkmarxone to checkmarxOne
* split credentials (id+secret, apikey), renamed pullrequestname to branch, groovy fix
* Fixed filenames & yaml
* missed the metadata_generated.go
* added json to sarif conversion
* fix:type in new checkmarxone package
* fix:type in new checkmarxone package
* removed test logs, added temp error log for creds
* extra debugging to fix crash
* improved auth logging, fixed query parse issue
* fixed bug with group fetch when using oauth user
* CWE can be -1 if not defined, can't be uint
* Query also had CweID
* Disabled predicates-fetch in sarif generation
* Removing leftover info log message
* Better error handling
* fixed default preset configuration
* removing .bat files - sorry
* Cleanup per initial review
* refactoring per Gist, fixed project find, add apps
* small fix - sorry for commit noise while testing
* Fixing issues with incremental scans.
* removing maxretries
* Updated per PR feedback, further changes todo toda
* JSON Report changes and reporting cleanup
* removing .bat (again?)
* adding docs, groovy unit test, linter fixes
* Started adding tests maybe 15% covered
* fix(checkmarxOne): test cases for pkg and reporting
* fix(checkmarxOne):fix formatting
* feat(checkmarxone): update interface with missing method
* feat(checkmarxone):change runStep signature to be able to inject dependency
* feat(checkmarxone): add tests for step (wip)
* Adding a bit more coverage
* feat(checkmarxOne): fix code review
* feat(checkmarxOne): fix code review
* feat(checkmarxOne): fix code review
* feat(checkmarxOne): fix integration test PR
* adding scan-summary bug workaround, reportgen fail
* enforceThresholds fix when no results passed in
* fixed gap when preset empty in yaml & project conf
* fixed another gap in preset selection
* fix 0-result panic
* fail when no preset is set anywhere
* removed comment
* initial project-under-app support
* fixing sarif reportgen
* some cleanup of error messages
* post-merge test fixes
* revert previous upstream merge
* adding "incremental" to "full" triggers
* wrong boolean
* project-in-application api change prep
* Fixing SARIF report without preset access
* fix sarif deeplink
* removing comments
* fix(cxone):formatting
* fix(cxone):formatting
* small sarif fixes
* fixed merge
* attempt at pulling git source repo branch
* fix(cxone):new endpoint for project creation
* fix(cxOne): taxa is an array
* fix(cxOne): get Git branch from commonPipelineEnvironment
* fix(cxOne): add params to tag a scan and a project
* fix(cxOne): unit test - update project
* fix(cxOne): unit test - update project tags
* fix(cxOne): improve logs
* fix(cxOne): improve logs
---------
Co-authored-by: michael kubiaczyk <michael.kubiaczyk@checkmarx.com>
Co-authored-by: michaelkubiaczyk <48311127+michaelkubiaczyk@users.noreply.github.com>
Co-authored-by: sumeet patil <sumeet.patil@sap.com>
* added running custom command
* go mod tidy
* added log with parsed command info
* fixed log format
---------
Co-authored-by: sumeet patil <sumeet.patil@sap.com>
* support trustedCerts for cloneGitRepo
* some more steps
* Update sap_com_0948.go
* remove warning for config value type
* updated description for certificateNames
* go generate artifacts
* variable order and space in "[]interface {}"
* Initial in progress
* compiling but not yet functional
* Missed file
* updated checkmarxone step
* Working up to fetching a project then breaks
* Missed file
* Breaks when retrieving projects+proxy set
* Create project & run scan working, now polling
* Fixed polling
* added back the zipfile remove command
* Fixed polling again
* Generates and downloads PDF report
* Updated and working, prep for refactor
* Added compliance steps
* Cleanup, reporting, added groovy connector
* fixed groovy file
* checkmarxone to checkmarxOne
* checkmarxone to checkmarxOne
* split credentials (id+secret, apikey), renamed pullrequestname to branch, groovy fix
* Fixed filenames & yaml
* missed the metadata_generated.go
* added json to sarif conversion
* fix:type in new checkmarxone package
* fix:type in new checkmarxone package
* removed test logs, added temp error log for creds
* extra debugging to fix crash
* improved auth logging, fixed query parse issue
* fixed bug with group fetch when using oauth user
* CWE can be -1 if not defined, can't be uint
* Query also had CweID
* Disabled predicates-fetch in sarif generation
* Removing leftover info log message
* Better error handling
* fixed default preset configuration
* removing .bat files - sorry
* Cleanup per initial review
* refactoring per Gist, fixed project find, add apps
* small fix - sorry for commit noise while testing
* Fixing issues with incremental scans.
* removing maxretries
* Updated per PR feedback, further changes todo toda
* JSON Report changes and reporting cleanup
* removing .bat (again?)
* adding docs, groovy unit test, linter fixes
* Started adding tests maybe 15% covered
* fix(checkmarxOne): test cases for pkg and reporting
* fix(checkmarxOne):fix formatting
* feat(checkmarxone): update interface with missing method
* feat(checkmarxone):change runStep signature to be able to inject dependency
* feat(checkmarxone): add tests for step (wip)
* Adding a bit more coverage
* feat(checkmarxOne): fix code review
* feat(checkmarxOne): fix code review
* feat(checkmarxOne): fix code review
* feat(checkmarxOne): fix integration test PR
* adding scan-summary bug workaround, reportgen fail
* enforceThresholds fix when no results passed in
* fixed gap when preset empty in yaml & project conf
* fixed another gap in preset selection
* fix 0-result panic
* fail when no preset is set anywhere
* removed comment
* initial project-under-app support
* fixing sarif reportgen
* some cleanup of error messages
* post-merge test fixes
* revert previous upstream merge
* adding "incremental" to "full" triggers
* wrong boolean
* project-in-application api change prep
* Fixing SARIF report without preset access
* fix sarif deeplink
* removing comments
* fix(cxone):formatting
* fix(cxone):formatting
* small sarif fixes
* fixed merge
* attempt at pulling git source repo branch
* fix(cxone):new endpoint for project creation
---------
Co-authored-by: thtri <trinhthanhhai@gmail.com>
Co-authored-by: Thanh-Hai Trinh <thanh.hai.trinh@sap.com>
* Run artifactPrepareVersion inside a docker container when build tool is CAP
* Run artifactPrepareVersion inside a docker container for CAP apps
* Run artifactPrepareVersion inside a docker container for CAP apps
* Update yaml
* feat(artifactPrepareVersion): Introduce build tool CAP
* feat(artifactPrepareVersion): Introduce build tool CAP
* Add CAPVersioningPreference to versioning.Options
* Include CAP to allowed build tool list
* Update go.mod
* Include CAP to allowed build tool list
* Delete CAP from additionalTargetTools
* Delete CAP from additionalTargetTools
* Fix test
* Update comment
* Update comment
* Add param description
* Add param description
* updated text of scope parameter
* go generate all yaml files
---------
Co-authored-by: Sarat Krishnan <78093145+sarat-krk@users.noreply.github.com>
Co-authored-by: Oliver Feldmann <oliver.feldmann@sap.com>
This change allows usage of `stashNoDefaultExcludes` parameter,
as otherwise I think it it impossible to stash back the .git repository.
It should not affect anything if `stashNoDefaultExcludes` is not used.
* fixes `go build` on windows
cmd\cnbBuild.go:589:3: unknown field Credential in struct literal of
type "syscall".SysProcAttr
cmd\cnbBuild.go:589:24: undefined: syscall.Credential
* Update cnbBuildAttr.go
* Update cnbBuildAttr_windows.go
* go fmt
* fix some typos and markdown issues
* originHash
* analysis output
* first shot
* add cert logon to piper http client
* allow initial user/pw for certificate logon
* credentials -> parameters
* encode user cert in pem
* key as well
* fix unit tests after merge
* other aakaas steps
* 2nd conn in register packages
* Add minor explanation of cvssSeverityLimit in whitesource
The cvssSeverityLimit parameter is helpful to ensure overall compliance. The documentation of the parameter's behavior is not sufficient to understand the implications of the default value and therefore I suggest this small addition.
* Update whitesourceExecuteScan_generated.go
---------
Co-authored-by: Andrei Kireev <andrei.kireev@sap.com>
* adding requirements file path param
* adding installation of requirements.txt via pip
* changing long description
* removing trailing spaces for long description
* running go generate
* new Piper step abapEnvironmentUpdateAddOnProduct
* modified entity json format and some minor function changes
* modified groovy file for pipelineStageIntTests and addonDescriptor to be mandatory in yaml file
* sync with fork branch ranliii/abap-environment-update-addon-product
* added generated file
* fail the step as long as addon update not successful and unit tests
* added docu for the new step
* tried to fix groovy unit test
* tried to fix groovy unit test 2
* for test
* fixed error
* fixed error 2
* tried to fix groovy unit test error
* added groovy unit test for new Piper step
* tried to fix groovy unit test error
* tried to fix groovy unit test error 2
* changes after first review
* remove .DS_Store
* for test
* revert test relevant changes
* try to fix groovy test error
* try to fix groovy error
* 3rd try to fix groovy test error
* rewrite the failed groovy test
* small changes and try with timeout as well as poll interval
* changes for test
* revert test-related changes
* try to fix errors
* Revert "Merge branch 'master' into abap-environment-update-addon-product"
This reverts commit 1ee0bcd80dd8ec58102ece31cacbe08bfd669ba1, reversing
changes made to 3c4a99dfb027ad561f0a52e888acaffb7be0053f.
* try to fix error
* try to fix error 2
* try to fix error 3
* align go.mod with master branch
* revert go.mod to commit 3c4a99d
* for test
* revert test changes
* new unit test
* Revert "Revert "Merge branch 'master' into abap-environment-update-addon-product""
This reverts commit 363c0380011e148231273d3f180dcec4d5cba88f.
* go generate after merging master
---------
Co-authored-by: Jk1484 <35270240+Jk1484@users.noreply.github.com>
Co-authored-by: Ran Li <ran.li01@sap.com>
Co-authored-by: tiloKo <70266685+tiloKo@users.noreply.github.com>
feat(detectExecuteScan): Also scan images that are in the cpe
Signed-off-by: Ralf Pannemans <ralf.pannemans@sap.com>
Signed-off-by: Johannes Dillmann <j.dillmann@sap.com>
Signed-off-by: Pavel Busko <pavel.busko@sap.com>
Co-authored-by: Johannes Dillmann <j.dillmann@sap.com>
Co-authored-by: Pavel Busko <pavel.busko@sap.com>
