Dynamic TeamID and PresetId at project creation time for Checkmarx

[de-jcup]

Situation

When a user starts a scan and a checkmarx project does not already exist, it will be created.
So far so good.

But it is always created with the default "preset". In some scenarios this is not very suitable - e.g. when creating many projects, we do not want to assign all presetIds manually to the project.
(A preset is something like a profile in Checkmarx where scope of scan can be defined at project level).

Wanted behaviour

We want to have dedicated "presets" automatically assigned to the new created checkmarx projects.

Solution

REST API

At
https://checkmarx.atlassian.net/wiki/spaces/KC/pages/223641776/Define+SAST+Scan+Settings+-+POST+sast+scanSettings+8.6.0
is described how to setup preset id on existing projects.

Introduction of ScanConfig

We want to have a solution which can be used in any product. There is always a need to provide some special profiles, identifiers etc. etc. by projects. So we orientate at the project names and introduce possibility to define namePatternIdProviders by an ID and entries for mapping from regular expressen name patterns to wanted identifiers.

An example scan configuration:

{
    "apiVersion": "1.0",
    "type" : "scanConfig",

    "namePatternIdProviders": {
        "checkmarx.newproject.presetid": [
            {
                "namePattern": "my-java-project-.*",
                "id": "100021"
            },
            {
                "namePattern": "a-go-project-.*",
                "id": "100031"
            },
            {
                "namePattern": ".*",
                "id": "100001"
            }
        ],
        "checkmarx.newproject.teamid": [
            {
                "namePattern": "my-java-project-.*",
                "id": "e2e4e8f4-ba17-453b-b194-c736c605700d"
            },
            {
                "namePattern": "a-go-project-.*",
                "id": "e2e4e8f4-ba17-453b-b194-d836c605700d"
            },
            {
                "namePattern": ".*",
                "id": "f2c4g8f4-ba17-453b-b194-c746c605700d"
            }
        ]
    }
}

Product executor side

Checkmarx install setup will use the ScanConfigService to provide presetId and teamId to adapter.
Adapter will use presetId (if defined) and teamId(mandatory as before) when project creation is necessary

Usage inside adapter

On lazy project creation time, depending on project name in sechub, after checkmarx project creation the project will automatically be assigned to the pattern specific presetId.

For example:
project named in sechub with my-java-project-marvelous1 will have preset id 100021 and will have teamId e2e4e8f4-ba17-453b-b194-c736c605700d.
project named in sechub with a-go-project-super-cli will have preset id 100031 and will have teamId e2e4e8f4-ba17-453b-b194-d836c605700d.
project named in sechub with something-elsewill have preset id 100001 and teamId f2c4g8f4-ba17-453b-b194-c746c605700d

First matching part will be used! So ordering is important.