GitLab パイプラインからのセキュリティスキャン結果を処理するように handleEvent メソッドを変更します。GitLab パイプラインのセキュリティステージ名が、handleEvent メソッドの VERACODE_STAGE_NAME、CMARX_ONE_STAGE_NAME、または CMARX_SAST_STAGE_NAME 変数で更新した名前と同じであることを確認します。handleEvent メソッドのコードを次のコードスニペットに置き換えます。 handleEvent: function(eventGr) {
try {
var renameHandler = new sn_devops.DevOpsPipelineRenameHandler(this.refTable, this.appContext, this.relatedRecord);
renameHandler.handlePipelineRename(eventGr);
var payload = JSON.parse(eventGr.getValue("original_payload"));
this._logger.debug("typeof payload >>" + typeof payload);
if (!gs.nil(payload) && typeof payload === 'object') {
var status = this.getTaskExecutionStatus(payload);
this._logger.debug("Task Execution status -> " + status);
if (gs.nil(status))
this.updateInboundEvent(eventGr, {
processing_details: gs.getMessage('Task execution status [{0}] is not handled', payload.build_status),
state: sn_devops.DevOpsCommonConstants.INBOUND_EVENT_STATE_IGNORED
});
else {
// create fake start event for cancelled job
if (status == 'cancelled') {
this.createFakeEvent(eventGr, payload, 'running');
}
var normalizedObject = {};
normalizedObject.taskExecution = this.getTaskExecutionObject(eventGr, payload, status);
normalizedObject.orchestrationTask = this.getOrchestrationTaskObject(normalizedObject.taskExecution, payload);
normalizedObject.callback = this.getCallbackObject(normalizedObject.taskExecution, payload);
var devopsUtil = new sn_devops.DevOpsUtil(this.refTable, this.appContext, this.relatedRecord);
normalizedObject = devopsUtil.schemaValidationForTransformedPayload(normalizedObject);
var VERACODE_STAGE_NAME = 'SN_VERACODE';
var CMARX_ONE_STAGE_NAME = 'SN_CMARX_ONE_STAGE_NAME';
var CMARX_SAST_STAGE_NAME = 'SN_CMARX_SAST_STAGE_NAME';
if (!gs.nil(payload.build_stage) &&
(
payload.build_stage == VERACODE_STAGE_NAME ||
payload.build_stage == CMARX_ONE_STAGE_NAME ||
payload.build_stage == CMARX_SAST_STAGE_NAME
)
&& this.isCompleted(normalizedObject.taskExecution)) {
var queryParams = sn_devops.DevOpsQueryParamsHelper.convertToSingular(JSON.parse(eventGr.getValue('query_params')));
if (gs.nil(normalizedObject.taskExecution.securityScan)) {
normalizedObject.taskExecution.securityScan = {
securityScanSummaryCount: 0
};
}
normalizedObject.taskExecution.securityScan.securityScanSummaryCount += 1;
}
this._logger.debug("Normalized Object: " + JSON.stringify(normalizedObject));
return JSON.stringify(normalizedObject);
}
} else
this.updateInboundEvent(eventGr, {
processing_details: gs.getMessage('Payload is missing or invalid'),
state: sn_devops.DevOpsCommonConstants.INBOUND_EVENT_STATE_ERROR
});
} catch (error) {
throw sn_devops.DevOpsErrorHelper.createDevOpsScriptIncludeError(error, sn_devops_ints.DevOpsIntegrationsCommonMessages.GITLAB_INBOUND_EVENT_PROCESS_ISSUE, "DevOpsGitLabIntegrationHandler.handleEvent", "handleEvent");
}
},
次の例では、GitLab パイプラインは、セキュリティステージ名がそれぞれ handleEvent メソッドの VERACODE_STAGE_NAME、CMARX_ONE_STAGE_NAME、または CMARX_SAST_STAGE_NAME 変数と同じであることを示しています。
VERACODE_STAGE_NAME は Veracode 用です。
image: maven:latest
stages:
- build
- SN_VERACODE
- Deploy
build_1:
stage: build
tags:
- local-runner1
script:
- echo "build"
security_test:
stage: SN_VERACODE
tags:
- local-runner1
script:
- |
curl "https://<instance>.service-now.com/api/sn_devops/v1/devops/tool/security?toolId=<gitlab_tool_sys_id> " \
--request POST \
--header "Accept:application/json" \
--header "Content-Type:application/json" \
--data "{
\"pipelineInfo\": {
\"buildNumber\": \"${CI_JOB_ID}\",
\"taskExecutionUrl\": \"${CI_JOB_URL}/\"
},
\"securityResultAttributes\": {
\"scanner\": \"Veracode\",
\"applicationName\": \"Application\"
}
}" \
--user 'devops.system':’password’
CMARX_ONE_STAGE_NAMEはCheckmarx One用です。
image: maven:latest
stages:
- build
- SN_CMARX_ONE_STAGE_NAME
- Deploy
build_1:
stage: build
tags:
- local-runner1
script:
- echo "build"
security_test:
stage: SN_CMARX_ONE_STAGE_NAME
tags:
- local-runner1
script:
- |
curl "https://<instance>.service-now.com/api/sn_devops/v1/devops/tool/security?toolId=<gitlab_tool_sys_id> " \
--request POST \
--header "Accept:application/json" \
--header "Content-Type:application/json" \
--data "{
\"pipelineInfo\": {
\"buildNumber\": \"${CI_JOB_ID}\",
\"taskExecutionUrl\": \"${CI_JOB_URL}/\"
},
\"securityResultAttributes\": {
\"scanner\": \"Checkmarx One\",
\"projectId\": \"projectId\",
\"scanId\": \"scanId\",
}
}" \
--user 'devops.system':’password’
CMARX_SAST_STAGE_NAMEはCheckmarx SASTの略です。
image: maven:latest
stages:
- build
- SN_CMARX_SAST_STAGE_NAME
- Deploy
build_1:
stage: build
tags:
- local-runner1
script:
- echo "build"
security_test:
stage: SN_CMARX_SAST_STAGE_NAME
tags:
- local-runner1
script:
- |
curl "https://<instance>.service-now.com/api/sn_devops/v1/devops/tool/security?toolId=<gitlab_tool_sys_id> " \
--request POST \
--header "Accept:application/json" \
--header "Content-Type:application/json" \
--data "{
\"pipelineInfo\": {
\"buildNumber\": \"${CI_JOB_ID}\",
\"taskExecutionUrl\": \"${CI_JOB_URL}/\"
},
\"securityResultAttributes\": {
\"scanner\": \"Checkmarx\",
\"projectId\": \"projectId\"
}
}" \
--user 'devops.system':’password’