Frogbot improvements (#6)

* Handle Xray context params

* Update severities icons

* Update vulnerabilities banners

* Update Frogbot.yml according to the new env vars

* Fix error message

Author: talarian1

Diff for: .github/workflows/frogbot.yml

@@ -22,15 +22,14 @@ jobs:
 
       - name: Scan Pull Request
         env:
-          FROGBOT_JF_USER: ${{ secrets.FROGBOT_JF_USER }}
-          FROGBOT_JF_URL: ${{ secrets.FROGBOT_JF_XRAY_URL }}
-          FROGBOT_JF_XRAY_URL: ${{ secrets.FROGBOT_JF_URL }}
-          FROGBOT_JF_ARTIFACTORY_URL: ${{ secrets.FROGBOT_JF_ARTIFACTORY_URL }}
-          FROGBOT_JF_PASSWORD: ${{ secrets.FROGBOT_JF_PASSWORD }}
-          FROGBOT_GIT_OWNER: ${{ github.repository_owner }}
-          FROGBOT_GIT_REPO: ${{ github.event.repository.name }}
-          FROGBOT_GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          FROGBOT_GIT_BASE_BRANCH: ${{ github.base_ref}}
-          FROGBOT_PR: ${{ github.event.number }}
-          JFROG_CLI_LOG_LEVEL: DEBUG
-        run: ./frogbot scan-pull-request
+          JF_USER: ${{ secrets.JF_USER }}
+          JF_URL: ${{ secrets.JF_XRAY_URL }}
+          JF_XRAY_URL: ${{ secrets.JF_URL }}
+          JF_ARTIFACTORY_URL: ${{ secrets.JF_ARTIFACTORY_URL }}
+          JF_PASSWORD: ${{ secrets.JF_PASSWORD }}
+          JF_GIT_OWNER: ${{ github.repository_owner }}
+          JF_GIT_REPO: ${{ github.event.repository.name }}
+          JF_GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          JF_GIT_BASE_BRANCH: ${{ github.base_ref}}
+          JF_GIT_PULL_REQUEST_ID: ${{ github.event.number }}
+        run: ./frogbot scan-pull-request

Diff for: icons/iconsmanager.go

@@ -8,7 +8,8 @@ import (
 type imageSource string
 
 const (
-	baseResourceUrl                         = "https://raw.githubusercontent.com/jfrog/frogbot/master/resources/"
+	// TODO - Change back to master branch. 
+	baseResourceUrl                         = "https://raw.githubusercontent.com/jfrog/frogbot/dev/resources/"
 	NoVulnerabilityBannerSource imageSource = "noVulnerabilityBanner.png"
 	VulnerabilitiesBannerSource imageSource = "vulnerabilitiesBanner.png"
 	criticalSeveritySource      imageSource = "criticalSeverity.png"

Diff for: main.go

@@ -6,6 +6,7 @@ import (
 	"os"
 	"path"
 	"strconv"
+	"strings"
 
 	"github.com/jfrog/frogbot/icons"
 	"github.com/jfrog/froggit-go/vcsclient"
@@ -24,17 +25,20 @@ import (
 const (
 	frogbotVersion = "0.0.0"
 	// Env
-	jfrogUser           = "FROGBOT_JF_USER"
-	jfrogUrl            = "FROGBOT_JF_URL"
-	jfrogXrayUrl        = "FROGBOT_JF_XRAY_URL"
-	jfrogArtifactoryUrl = "FROGBOT_JF_ARTIFACTORY_URL"
-	jfrogPassword       = "FROGBOT_JF_PASSWORD"
-	jfrogToken          = "FROGBOT_JF_TOKEN"
-	gitRepoOwner        = "FROGBOT_GIT_OWNER"
-	gitRepo             = "FROGBOT_GIT_REPO"
-	gitToken            = "FROGBOT_GIT_TOKEN"
-	gitBaseBranch       = "FROGBOT_GIT_BASE_BRANCH"
-	prID                = "FROGBOT_PR"
+	jfrogUser           = "JF_USER"
+	jfrogUrl            = "JF_URL"
+	jfrogXrayUrl        = "JF_XRAY_URL"
+	jfrogArtifactoryUrl = "JF_ARTIFACTORY_URL"
+	jfrogPassword       = "JF_PASSWORD"
+	jfrogToken          = "JF_TOKEN"
+	jfrogWatches        = "JF_WATCHES"
+	watchesDelimiter    = ","
+	jfrogProject        = "JF_PROJECT"
+	gitRepoOwner        = "JF_GIT_OWNER"
+	gitRepo             = "JF_GIT_REPO"
+	gitToken            = "JF_GIT_TOKEN"
+	gitBaseBranch       = "JF_GIT_BASE_BRANCH"
+	gitPullRequestID    = "JF_GIT_PULL_REQUEST_ID"
 )
 
 func main() {
@@ -71,7 +75,7 @@ func getCommands() []*clitool.Command {
 }
 
 func scanPullRequest(c *clitool.Context) error {
-	server, repoOwner, token, repo, baseBranch, pullRequestID, err := extractParamsFromEnv()
+	server, repoOwner, token, repo, baseBranch, watches, project, pullRequestID, err := extractParamsFromEnv()
 	if err != nil {
 		return err
 	}
@@ -81,8 +85,7 @@ func scanPullRequest(c *clitool.Context) error {
 	}
 
 	// Audit PR code
-	// TODO - fill contex according to env/flags
-	xrayScanParams := services.XrayGraphScanParams{IncludeVulnerabilities: true}
+	xrayScanParams := createXrayScanParams(watches, project)
 	wd, err := os.Getwd()
 	if err != nil {
 		return err
@@ -100,19 +103,20 @@ func scanPullRequest(c *clitool.Context) error {
 	}
 	// Get only the new issues added by this PR
 	var vulnerabilitiesRows []xrayutils.VulnerabilityRow
-	// TODO - handle array of scan results!
-	if len(currentScan[0].Violations) > 0 {
-		vulnerabilitiesRows = getNewViolations(previousScan[0], currentScan[0])
-	} else if len(currentScan[0].Vulnerabilities) > 0 {
-		vulnerabilitiesRows = getNewVulnerabilities(previousScan[0], currentScan[0])
+	for i := 0; i < len(currentScan); i += 1 {
+		if len(currentScan[i].Violations) > 0 {
+			vulnerabilitiesRows = append(vulnerabilitiesRows, getNewViolations(previousScan[i], currentScan[i])...)
+		} else if len(currentScan[i].Vulnerabilities) > 0 {
+			vulnerabilitiesRows = append(vulnerabilitiesRows, getNewVulnerabilities(previousScan[i], currentScan[i])...)
+		}
 	}
 	// Comment frogbot message on the PR
 	message := createPullRequestMessage(vulnerabilitiesRows)
 	return client.AddPullRequestComment(context.Background(), repoOwner, repo, message, pullRequestID)
 
 }
 
-func extractParamsFromEnv() (server coreconfig.ServerDetails, repoOwner, token, repo, baseBranch string, pullRequestID int, err error) {
+func extractParamsFromEnv() (server coreconfig.ServerDetails, repoOwner, token, repo, baseBranch, project, watches string, pullRequestID int, err error) {
 	url := os.Getenv(jfrogUrl)
 	xrUrl := os.Getenv(jfrogXrayUrl)
 	rtUrl := os.Getenv(jfrogArtifactoryUrl)
@@ -121,7 +125,7 @@ func extractParamsFromEnv() (server coreconfig.ServerDetails, repoOwner, token,
 		server.ArtifactoryUrl = rtUrl
 	} else {
 		if url == "" {
-			err = fmt.Errorf("%s or %s and %s are missing", url, xrUrl, rtUrl)
+			err = fmt.Errorf("%s or %s and %s are missing", jfrogUrl, jfrogXrayUrl, jfrogArtifactoryUrl)
 			return
 		}
 		server.Url = url
@@ -156,15 +160,36 @@ func extractParamsFromEnv() (server coreconfig.ServerDetails, repoOwner, token,
 		err = fmt.Errorf("%s is missing", gitBaseBranch)
 		return
 	}
-	pullRequestIDString := os.Getenv(prID)
+	pullRequestIDString := os.Getenv(gitPullRequestID)
 	if pullRequestIDString == "" {
-		err = fmt.Errorf("%s is missing", prID)
+		err = fmt.Errorf("%s is missing", gitPullRequestID)
 		return
 	}
 	pullRequestID, err = strconv.Atoi(pullRequestIDString)
 	if err != nil {
 		return
 	}
+
+	// No mandatory Xray context params
+	watches = os.Getenv(jfrogWatches)
+	project = os.Getenv(jfrogProject)
+
+	return
+}
+
+func createXrayScanParams(watches, project string) (params services.XrayGraphScanParams) {
+	params.ScanType = services.Dependency
+	params.IncludeLicenses = false
+	if watches != "" {
+		params.Watches = strings.Split(watches, watchesDelimiter)
+		return
+	}
+	if project != "" {
+		params.ProjectKey = project
+		return
+	}
+	// No context was supplied, request from Xray to return all known vulnerabilities.
+	params.IncludeVulnerabilities = true
 	return
 }
 
@@ -260,7 +285,7 @@ func createPullRequestMessage(vulnerabilitiesRows []xrayutils.VulnerabilityRow)
 		":--: | -- | -- | -- | -- | :--: | --"
 	var tableContent string
 	for _, vulnerability := range vulnerabilitiesRows {
-		tableContent += fmt.Sprintf("\n| %s | %s | %s | %s | %s | %s | %s ", icons.GetIconTag(icons.GetIconSource(vulnerability.Severity)), vulnerability.ImpactedPackageName,
+		tableContent += fmt.Sprintf("\n| %s | %s | %s | %s | %s | %s | %s ", icons.GetIconTag(icons.GetIconSource(vulnerability.Severity))+" "+vulnerability.Severity, vulnerability.ImpactedPackageName,
 			vulnerability.ImpactedPackageVersion, vulnerability.FixedVersions, vulnerability.Components[0].Name, vulnerability.Components[0].Version, vulnerability.Cves[0].Id)
 	}
 	return icons.GetIconTag(icons.VulnerabilitiesBannerSource) + tableHeder + tableContent