refactor: split code into a clean architecture (#89)

Author: tembleking

.github/workflows/ci-scan.yaml

@@ -168,7 +168,7 @@ jobs:
         with:
           sysdig-secure-token: ${{ secrets.KUBELAB_SECURE_API_TOKEN }}
           mode: iac
-          iac-scan-path: ./iac_scan_examples
+          iac-scan-path: ./tests/fixtures/iac/
           # Note: This test assumes these policies exist in the target Sysdig Secure account.
           use-policies: '"All Posture Findings", "MITRE DEFEND"'
 

.gitignore

@@ -233,7 +233,6 @@ out
 
 # Nuxt.js build / generate output
 .nuxt
-dist
 
 # Gatsby files
 .cache/

dist/index.js

@@ -1,114 +1,35 @@
 import * as core from '@actions/core';
-import fs from 'fs';
-import { generateSARIFReport } from './src/sarif';
-import { cliScannerName, cliScannerResult, cliScannerURL, executeScan, pullScanner, ScanExecutionResult, ScanMode } from './src/scanner';
-import { ActionInputs, defaultSecureEndpoint } from './src/action';
-import { generateSummary } from './src/summary';
-import { Report, FilterOptions, Severity } from './src/report';
-
-function parseCsvList(str?: string): string[] {
-  if (!str) return [];
-  return str.split(",").map(s => s.trim()).filter(s => !!s);
-}
-
-export class ExecutionError extends Error {
-  constructor(stdout: string, stderr: string) {
-    super("execution error\n\nstdout: " + stdout + "\n\nstderr: " + stderr);
-  }
-}
-
-function writeReport(reportData: string) {
-  fs.writeFileSync("./report.json", reportData);
-  core.setOutput("scanReport", "./report.json");
-}
-
-export async function run() {
-
+import { RunScanUseCase } from './src/application/use-cases/RunScanUseCase';
+import { GitHubActionsInputProvider } from './src/infrastructure/github/GitHubActionsInputProvider';
+import { SysdigCliScanner } from './src/infrastructure/sysdig/SysdigCliScanner';
+import { SarifReportPresenter } from './src/infrastructure/github/SarifReportPresenter';
+import { SummaryReportPresenter } from './src/infrastructure/github/SummaryReportPresenter';
+import { IReportPresenter } from './src/application/ports/IReportPresenter';
+
+async function run(): Promise<void> {
   try {
-    let opts = ActionInputs.parseActionInputs();
-    opts.printOptions();
-    let scanFlags = opts.composeFlags();
+    const inputProvider = new GitHubActionsInputProvider();
+    const config = inputProvider.getInputs();
 
-    let scanResult: ScanExecutionResult;
-    // Download CLI Scanner from 'cliScannerURL'
-    let retCode = await pullScanner(opts.cliScannerURL);
-    if (retCode == 0) {
-      // Execute Scanner
-      scanResult = await executeScan(scanFlags);
-
-      retCode = scanResult.ReturnCode;
-      if (retCode == 0 || retCode == 1) {
-        // Transform Scan Results to other formats such as SARIF
-        if (opts.mode == ScanMode.vm) {
-          await processScanResult(scanResult, opts);
-        }
-      } else {
-        core.error("Terminating scan. Scanner couldn't be executed.")
-      }
-    } else {
-      core.error("Terminating scan. Scanner couldn't be pulled.")
-    }
+    const scanner = new SysdigCliScanner();
 
-    if (opts.stopOnFailedPolicyEval && retCode == 1) {
-      core.setFailed(`Stopping because Policy Evaluation was FAILED.`);
-    } else if (opts.standalone && retCode == 0) {
-      core.info("Policy Evaluation was OMITTED.");
-    } else if (retCode == 0) {
-      core.info("Policy Evaluation was PASSED.");
-    } else if (opts.stopOnProcessingError && retCode > 1) {
-      core.setFailed(`Stopping because the scanner terminated with an error.`);
-    } // else: Don't stop regardless the outcome.
+    const presenters: IReportPresenter[] = [
+      new SarifReportPresenter(),
+    ];
 
-  } catch (error) {
-    if (core.getInput('stop-on-processing-error') == 'true') {
-      core.setFailed(`Unexpected error: ${error instanceof Error ? error.stack : String(error)}`);
+    if (!config.skipSummary) {
+      presenters.push(new SummaryReportPresenter());
     }
-    core.error(`Unexpected error: ${error instanceof Error ? error.stack : String(error)}`);
-  }
-}
 
-export async function processScanResult(result: ScanExecutionResult, opts: ActionInputs) {
-  writeReport(result.Output);
-
-  let report: Report;
-  try {
-    report = JSON.parse(result.Output);
-  } catch (error) {
-    core.error("Error parsing analysis JSON report: " + error + ". Output was: " + result.Output);
-    throw new ExecutionError(result.Output, result.Error);
-  }
-
-  if (report) {
-    const filters: FilterOptions = {
-      minSeverity: (opts.severityAtLeast && opts.severityAtLeast.toLowerCase() !== "any")
-        ? opts.severityAtLeast.toLowerCase() as Severity
-        : undefined,
-      packageTypes: parseCsvList(opts.packageTypes),
-      notPackageTypes: parseCsvList(opts.notPackageTypes),
-      excludeAccepted: opts.excludeAccepted,
-    };
-
-    core.info("Generating SARIF Report...")
-    generateSARIFReport(report, opts.groupByPackage, filters);
-
-    if (!opts.skipSummary) {
-      core.info("Generating Summary...")
-      await generateSummary(opts, report, filters);
+  const useCase = new RunScanUseCase(scanner, presenters, inputProvider);
+  await useCase.execute();
+} catch (error) {
+    if (error instanceof Error) {
+      core.setFailed(error.message);
     } else {
-      core.info("Skipping Summary...")
+      core.setFailed(`Unknown error: ${error}`);
     }
   }
 }
 
-export {
-  cliScannerURL,
-  defaultSecureEndpoint,
-  pullScanner,
-  cliScannerName,
-  executeScan,
-  cliScannerResult,
-};
-
-if (require.main === module) {
-  run();
-}
+run();

dist/index.js.map

@@ -0,0 +1,6 @@
+export class ReportParsingError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "ReportParsingError";
+  }
+}

index.ts

@@ -0,0 +1,6 @@
+export class ScanExecutionError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "ScanExecutionError";
+  }
+}

src/application/errors/ReportParsingError.ts

@@ -0,0 +1,6 @@
+export class ScannerPullError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "ScannerPullError";
+  }
+}

src/application/errors/ScanExecutionError.ts

@@ -0,0 +1,5 @@
+import { ScanConfig } from "./ScanConfig";
+
+export interface IInputProvider {
+  getInputs(): ScanConfig;
+}

src/application/errors/ScannerPullError.ts

@@ -0,0 +1,6 @@
+import { FilterOptions } from "../../domain/services/filtering";
+import { ScanResult } from "../../domain/scanresult";
+
+export interface IReportPresenter {
+  generateReport(data: ScanResult, groupByPackage: boolean, filters?: FilterOptions): void;
+}