Add support for self-hosted SCM (#111)

hunter · morwn · web-flow · commit ea7d32de87f9 · 2022-11-24T11:19:41.000+02:00
* feat: SCM selection

Adds support for specifying an SCM for supporting self-hosted environments.

* fix: use path for GL repo name

Matches the escaped name used in Github

* chore: add results.json to gitignore

* docs: updated readme with scm flag

* fix: support for GH enterprise client

* chore: optional Gitlab client BaseURL for SaaS

* fix: change 'scm' flag to 'scm-platform'

* fix: incorrect GitlabPlatform case

Co-authored-by: Mor Weinberger &lt;morwnbrg@gmail.com&gt;

* fix: gitlab toRepository test

Co-authored-by: Mor Weinberger &lt;morwnbrg@gmail.com&gt;
diff --git a/.gitignore b/.gitignore
@@ -19,4 +19,5 @@
 /__debug_bin
 
 .DS_Store
-/chain-bench
+/chain-bench
+/results.json
diff --git a/README.md b/README.md
@@ -79,6 +79,14 @@ Get Chain-bench via your favorite installation method. See [installation] sectio
 chain-bench scan --repository-url <REPOSITORY_URL> --access-token <TOKEN> -o <OUTPUT_PATH>
 ```
 
+### Using Self-hosted or Dedicated SCM Platforms (with custom domains)
+
+```bash
+chain-bench scan --repository-url <REPOSITORY_URL> --scm-platform <SCM_PLATFORM> --access-token <TOKEN> -o <OUTPUT_PATH>
+```
+
+Supported options for `scm-platform` are `"github"` and `"gitlab"` (beta)
+
 ### Using docker
 
 ```bash
@@ -155,7 +163,7 @@ chain-bench-scanning:
     name: docker.io/aquasec/chain-bench
     entrypoint: [""]
   script:
-    - chain-bench scan --repository-url $CI_PROJECT_URL --access-token $CHAIN_BENCH_TOKEN -o results.json --template @/templates/gitlab_security_scanner.tpl
+    - chain-bench scan --repository-url $CI_PROJECT_URL --access-token $CHAIN_BENCH_TOKEN --scm-platform gitlab -o results.json --template @/templates/gitlab_security_scanner.tpl
   artifacts:
     reports:
       container_scanning: results.json
diff --git a/internal/commands/flags.go b/internal/commands/flags.go
@@ -47,11 +47,16 @@ var (
 	repositoryUrlFlagName  = "repository-url"
 	repositoryUrlShortFlag = "r"
 
-	// repositoryUrl the path to the repository to scan
+	// accessToken the access token to use for the repository
 	accessToken          string
 	accessTokenFlagName  = "access-token"
 	accessTokenShortFlag = "t"
 
+	// SCM platform for self-hosted/dedicated environments
+	scmPlatform          string
+	scmPlatformFlagName  = "scm-platform"
+	scmPlatformShortFlag = "s"
+
 	// branch the branch name to scan
 	branch          string
 	branchFlagName  = "branch"
diff --git a/internal/commands/scan.go b/internal/commands/scan.go
@@ -19,7 +19,8 @@ func NewScanCommand() *cobra.Command {
 		RunE: func(cmd *cobra.Command, args []string) error {
 			start := time.Now()
 			logger.Infof("%v	Fetch Starting", emoji.TriangularFlag)
-			assetsData, supportedChecks, err := clients.FetchClientData(accessToken, repositoryUrl, branch)
+
+			assetsData, supportedChecks, err := clients.FetchClientData(accessToken, repositoryUrl, scmPlatform, branch)
 			if err != nil {
 				logger.Error(err, "Failed to fetch client data")
 				return err
@@ -46,9 +47,13 @@ func NewScanCommand() *cobra.Command {
 		accessTokenFlagName, accessTokenShortFlag, "",
 		"the access token to use for the repository")
 
+	scanCommand.PersistentFlags().StringVarP(&scmPlatform,
+		scmPlatformFlagName, scmPlatformShortFlag, "",
+		"the SCM platform for self-hosted/dedicated environments (options: 'github', 'gitlab')")
+
 	scanCommand.PersistentFlags().StringVarP(&branch,
 		branchFlagName, branchShortFlag, "",
-		"the branch to scan branch protection for")
+		"the branch to scan for branch protection")
 
 	return scanCommand
 }
diff --git a/internal/scm-clients/adapter/adapter.go b/internal/scm-clients/adapter/adapter.go
@@ -8,7 +8,7 @@ import (
 )
 
 type ClientAdapter interface {
-	Init(client *http.Client, token string) error
+	Init(client *http.Client, token string, host string) error
 	ListSupportedChecksIDs() ([]string, error)
 	GetRepository(owner, repo, branchName string) (*models.Repository, error)
 	ListRepositoryBranches(owner, repo string) ([]*models.Branch, error)
diff --git a/internal/scm-clients/clients/clients.go b/internal/scm-clients/clients/clients.go
@@ -20,15 +20,25 @@ import (
 const (
 	GithubEndpoint = "github.com"
 	GitlabEndpoint = "gitlab.com"
+
+	GithubPlatform = "github"
+	GitlabPlatform = "gitlab"
 )
 
-func FetchClientData(accessToken string, repoUrl string, branch string) (*checkmodels.AssetsData, []string, error) {
-	scmName, orgName, repoName, err := getRepoInfo(repoUrl)
+func FetchClientData(accessToken string, repoUrl string, scmPlatform string, branch string) (*checkmodels.AssetsData, []string, error) {
+	host, orgName, repoName, err := getRepoInfo(repoUrl)
 	if err != nil {
 		return nil, nil, err
 	}
 
-	adapter, err := getClientAdapter(scmName, accessToken)
+	switch host {
+	case GithubEndpoint:
+		scmPlatform = GithubPlatform
+	case GitlabEndpoint:
+		scmPlatform = GitlabPlatform
+	}
+
+	adapter, err := getClientAdapter(scmPlatform, accessToken, host)
 	if err != nil {
 		return nil, nil, err
 	}
@@ -87,31 +97,31 @@ func getRepoInfo(repoFullUrl string) (string, string, string, error) {
 	if len(path) < 3 {
 		return "", "", "", fmt.Errorf("missing org/repo in the repository url: %s", repoFullUrl)
 	}
-	repo := path[len(path) - 1]
+	repo := path[len(path)-1]
 	namespace := strings.Split(u.Path, repo)[0]
 	trimedNamespace := namespace[1:(len(namespace) - 1)]
 
 	return u.Host, trimedNamespace, repo, nil
 }
 
-func getClientAdapter(scmName string, accessToken string) (adapter.ClientAdapter, error) {
+func getClientAdapter(scmPlatform string, accessToken string, host string) (adapter.ClientAdapter, error) {
 	var err error
 	var adapter adapter.ClientAdapter
 	httpClient := utils.GetHttpClient(accessToken)
 
-	switch scmName {
-	case GithubEndpoint:
-		err = github.Adapter.Init(httpClient, accessToken)
+	switch scmPlatform {
+	case GithubPlatform:
+		err = github.Adapter.Init(httpClient, accessToken, host)
 		adapter = &github.Adapter
-	case GitlabEndpoint:
-		err = gitlab.Adapter.Init(httpClient, accessToken)
+	case GitlabPlatform:
+		err = gitlab.Adapter.Init(httpClient, accessToken, host)
 		adapter = &gitlab.Adapter
 	default:
 		adapter = nil
 	}
 
 	if err != nil {
-		logger.Error(err, "error with github init client")
+		logger.Error(err, "error with SCM init client")
 		return &github.ClientAdapterImpl{}, nil
 	}
 	return adapter, err
diff --git a/internal/scm-clients/github/adapter.go b/internal/scm-clients/github/adapter.go
@@ -23,8 +23,8 @@ type ClientAdapterImpl struct {
 }
 
 // Init implements clients.ClientAdapter
-func (*ClientAdapterImpl) Init(client *http.Client, token string) error {
-	ghClient, err := InitClient(client, token)
+func (*ClientAdapterImpl) Init(client *http.Client, token string, host string) error {
+	ghClient, err := InitClient(client, token, host)
 	Adapter = ClientAdapterImpl{client: ghClient}
 	return err
 }
diff --git a/internal/scm-clients/github/client_mocks.go b/internal/scm-clients/github/client_mocks.go
@@ -12,7 +12,7 @@ func MockGetRepo(repo *github.Repository) *GithubClient {
 			*repo,
 		),
 	)
-	gc, _ := InitClient(mockedHTTPClient,"")
+	gc, _ := InitClient(mockedHTTPClient, "", "github.com")
 	return &gc
 }
 
@@ -23,7 +23,7 @@ func MockGetBranchProtections(protection *github.Protection) *GithubClient {
 			*protection,
 		),
 	)
-	gc, _ := InitClient(mockedHTTPClient, "")
+	gc, _ := InitClient(mockedHTTPClient, "", "github.com")
 	return &gc
 }
 
@@ -34,7 +34,7 @@ func MockGetSignaturesOfProtectedBranch(signedCommits *github.SignaturesProtecte
 			*signedCommits,
 		),
 	)
-	gc, _ := InitClient(mockedHTTPClient, "")
+	gc, _ := InitClient(mockedHTTPClient, "", "github.com")
 	return &gc
 }
 
@@ -45,7 +45,7 @@ func MockGetOrganization(org *github.Organization) *GithubClient {
 			*org,
 		),
 	)
-	gc, _ := InitClient(mockedHTTPClient, "")
+	gc, _ := InitClient(mockedHTTPClient, "", "github.com")
 	return &gc
 }
 
@@ -56,7 +56,7 @@ func MockGetOrganizationMembers(users []*github.User) *GithubClient {
 			users,
 		),
 	)
-	gc, _ := InitClient(mockedHTTPClient, "")
+	gc, _ := InitClient(mockedHTTPClient, "", "github.com")
 	return &gc
 }
 
@@ -67,7 +67,7 @@ func MockGetWorkflows(workflows *github.Workflows) *GithubClient {
 			workflows,
 		),
 	)
-	gc, _ := InitClient(mockedHTTPClient, "")
+	gc, _ := InitClient(mockedHTTPClient, "", "github.com")
 	return &gc
 }
 
@@ -78,7 +78,7 @@ func MockGetContent(content *github.RepositoryContent) *GithubClient {
 			content,
 		),
 	)
-	gc, _ := InitClient(mockedHTTPClient, "")
+	gc, _ := InitClient(mockedHTTPClient, "", "github.com")
 	return &gc
 }
 
@@ -89,7 +89,7 @@ func MockGetOrganizationWebhooks(hooks []*github.Hook) *GithubClient {
 			hooks,
 		),
 	)
-	gc, _ := InitClient(mockedHTTPClient, "")
+	gc, _ := InitClient(mockedHTTPClient, "", "github.com")
 	return &gc
 }
 
@@ -100,7 +100,7 @@ func MockGetRepositoryWebhooks(hooks []*github.Hook) *GithubClient {
 			hooks,
 		),
 	)
-	gc, _ := InitClient(mockedHTTPClient, "")
+	gc, _ := InitClient(mockedHTTPClient, "", "github.com")
 	return &gc
 }
 
@@ -111,7 +111,7 @@ func MockListCommits(commits []*github.RepositoryCommit) *GithubClient {
 			commits,
 		),
 	)
-	gc, _ := InitClient(mockedHTTPClient, "")
+	gc, _ := InitClient(mockedHTTPClient, "", "github.com")
 	return &gc
 }
 
@@ -122,6 +122,6 @@ func MockListOrganizationPackages(packages []*github.Package) *GithubClient {
 			packages,
 		),
 	)
-	gc, _ := InitClient(mockedHTTPClient, "")
+	gc, _ := InitClient(mockedHTTPClient, "", "github.com")
 	return &gc
 }
diff --git a/internal/scm-clients/github/github.go b/internal/scm-clients/github/github.go
@@ -2,6 +2,7 @@ package github
 
 import (
 	"context"
+	"fmt"
 	"net/http"
 
 	"github.com/aquasecurity/chain-bench/internal/utils"
@@ -42,8 +43,14 @@ type GithubClientImpl struct {
 
 var _ GithubClient = (*GithubClientImpl)(nil) // Verify that *GithubClientImpl implements GithubClient.
 
-func InitClient(client *http.Client, token string) (GithubClient, error) {
-	gc := github.NewClient(client)
+func InitClient(client *http.Client, token string, host string) (GithubClient, error) {
+	var gc *github.Client
+	if host == "github.com" {
+		gc = github.NewClient(client)
+	} else {
+		gc, _ = github.NewEnterpriseClient(fmt.Sprintf("https://%s/api/v3/", host), fmt.Sprintf("https://%s/api/uploads/", host), client)
+	}
+
 	Client = &GithubClientImpl{ctx: context.TODO(), client: gc}
 	return Client, nil
 }
@@ -116,17 +123,17 @@ func (gca *GithubClientImpl) GetContent(owner, repo, filepath, ref string) (file
 	return gca.client.Repositories.GetContents(gca.ctx, owner, repo, filepath, &github.RepositoryContentGetOptions{Ref: ref})
 }
 
-//need admin:repo_hook->read:repo_hook
+// need admin:repo_hook->read:repo_hook
 func (gca *GithubClientImpl) ListRepositoryHooks(owner, repo string) (hooks []*github.Hook, resp *github.Response, err error) {
 	return gca.client.Repositories.ListHooks(gca.ctx, owner, repo, nil)
 }
 
-//need admin:org_hook
+// need admin:org_hook
 func (gca *GithubClientImpl) ListOrganizationHooks(owner string) (hooks []*github.Hook, resp *github.Response, err error) {
 	return gca.client.Organizations.ListHooks(gca.ctx, owner, nil)
 }
 
-//need read:packages
+// need read:packages
 func (gca *GithubClientImpl) ListOrganizationPackages(owner string, packageType string) ([]*github.Package, *github.Response, error) {
 	return gca.client.Organizations.ListPackages(gca.ctx, owner, &github.PackageListOptions{State: utils.GetPtr("active"), PackageType: &packageType})
 }
diff --git a/internal/scm-clients/gitlab/adapter.go b/internal/scm-clients/gitlab/adapter.go
@@ -19,8 +19,8 @@ type ClientAdapterImpl struct {
 	client GitlabClient
 }
 
-func (*ClientAdapterImpl) Init(client *http.Client, token string) error {
-	glClient, err := InitClient(client, token)
+func (*ClientAdapterImpl) Init(client *http.Client, token string, host string) error {
+	glClient, err := InitClient(client, token, host)
 	Adapter = ClientAdapterImpl{client: glClient}
 	return err
 }
diff --git a/internal/scm-clients/gitlab/gitlab.go b/internal/scm-clients/gitlab/gitlab.go
@@ -30,12 +30,16 @@ type GitlabClientImpl struct {
 
 var _ GitlabClient = (*GitlabClientImpl)(nil) // Verify that *GitlabClientImpl implements gitlabClient.
 
-func InitClient(client *http.Client, token string) (GitlabClient, error) {
-	gc, _ := gitlab.NewClient(token, gitlab.WithHTTPClient(client))
+func InitClient(client *http.Client, token string, host string) (GitlabClient, error) {
+	var gc *gitlab.Client
+	if host == "gitlab.com" {
+		gc, _ = gitlab.NewClient(token, gitlab.WithHTTPClient(client))
+	} else {
+		gc, _ = gitlab.NewClient(token, gitlab.WithHTTPClient(client), gitlab.WithBaseURL(fmt.Sprintf("https://%s/api/v4", host)))
+	}
 	Client = &GitlabClientImpl{ctx: context.TODO(), client: gc}
 	return Client, nil
 }
-
 func (gca *GitlabClientImpl) GetAuthorizedUser() (*gitlab.User, *gitlab.Response, error) {
 	return gca.client.Users.GetUser(1, gitlab.GetUsersOptions{})
 }
diff --git a/internal/scm-clients/gitlab/mapper.go b/internal/scm-clients/gitlab/mapper.go
@@ -46,7 +46,7 @@ func toRepository(repo *gitlab.Project, branches []*models.Branch, collaborators
 		r = &models.Repository{
 			ID:                   utils.GetPtr(int64(repo.ID)),
 			Owner:                &models.User{Type: utils.GetPtr("Organization")},
-			Name:                 &repo.Name,
+			Name:                 &repo.Path,
 			Description:          &repo.Description,
 			DefaultBranch:        &repo.DefaultBranch,
 			CreatedAt:            &utils.Timestamp{Time: utils.GetValue(repo.CreatedAt)},
diff --git a/internal/scm-clients/gitlab/mapper_test.go b/internal/scm-clients/gitlab/mapper_test.go
@@ -55,7 +55,7 @@ func TestToRepository(t *testing.T) {
 
 	actual := toRepository(
 		&gitlab.Project{
-			Name:  repoName,
+			Path:  repoName,
 			ID:    433,
 			Owner: &gitlab.User{},
 		},

Original file line number	Diff line number	Diff line change
`@@ -8,7 +8,7 @@ import (`
`8`	`8`	`)`
`9`	`9`
`10`	`10`	`type ClientAdapter interface {`
`11`		`- Init(client *http.Client, token string) error`
	`11`	`+ Init(client *http.Client, token string, host string) error`
`12`	`12`	`ListSupportedChecksIDs() ([]string, error)`
`13`	`13`	`GetRepository(owner, repo, branchName string) (*models.Repository, error)`
`14`	`14`	`ListRepositoryBranches(owner, repo string) ([]*models.Branch, error)`
Original file line number	Diff line number	Diff line change
`@@ -23,8 +23,8 @@ type ClientAdapterImpl struct {`
`23`	`23`	`}`
`24`	`24`
`25`	`25`	`// Init implements clients.ClientAdapter`
`26`		`-func (ClientAdapterImpl) Init(client http.Client, token string) error {`
`27`		`- ghClient, err := InitClient(client, token)`
	`26`	`+func (ClientAdapterImpl) Init(client http.Client, token string, host string) error {`
	`27`	`+ ghClient, err := InitClient(client, token, host)`
`28`	`28`	`Adapter = ClientAdapterImpl{client: ghClient}`
`29`	`29`	`return err`
`30`	`30`	`}`
Original file line number	Diff line number	Diff line change
`@@ -12,7 +12,7 @@ func MockGetRepo(repo github.Repository) GithubClient {`
`12`	`12`	`*repo,`
`13`	`13`	`),`
`14`	`14`	`)`
`15`		`- gc, _ := InitClient(mockedHTTPClient,"")`
	`15`	`+ gc, _ := InitClient(mockedHTTPClient, "", "github.com")`
`16`	`16`	`return &gc`
`17`	`17`	`}`
`18`	`18`
`@@ -23,7 +23,7 @@ func MockGetBranchProtections(protection github.Protection) GithubClient {`
`23`	`23`	`*protection,`
`24`	`24`	`),`
`25`	`25`	`)`
`26`		`- gc, _ := InitClient(mockedHTTPClient, "")`
	`26`	`+ gc, _ := InitClient(mockedHTTPClient, "", "github.com")`
`27`	`27`	`return &gc`
`28`	`28`	`}`
`29`	`29`
`@@ -34,7 +34,7 @@ func MockGetSignaturesOfProtectedBranch(signedCommits *github.SignaturesProtecte`
`34`	`34`	`*signedCommits,`
`35`	`35`	`),`
`36`	`36`	`)`
`37`		`- gc, _ := InitClient(mockedHTTPClient, "")`
	`37`	`+ gc, _ := InitClient(mockedHTTPClient, "", "github.com")`
`38`	`38`	`return &gc`
`39`	`39`	`}`
`40`	`40`
`@@ -45,7 +45,7 @@ func MockGetOrganization(org github.Organization) GithubClient {`
`45`	`45`	`*org,`
`46`	`46`	`),`
`47`	`47`	`)`
`48`		`- gc, _ := InitClient(mockedHTTPClient, "")`
	`48`	`+ gc, _ := InitClient(mockedHTTPClient, "", "github.com")`
`49`	`49`	`return &gc`
`50`	`50`	`}`
`51`	`51`
`@@ -56,7 +56,7 @@ func MockGetOrganizationMembers(users []github.User) GithubClient {`
`56`	`56`	`users,`
`57`	`57`	`),`
`58`	`58`	`)`
`59`		`- gc, _ := InitClient(mockedHTTPClient, "")`
	`59`	`+ gc, _ := InitClient(mockedHTTPClient, "", "github.com")`
`60`	`60`	`return &gc`
`61`	`61`	`}`
`62`	`62`
`@@ -67,7 +67,7 @@ func MockGetWorkflows(workflows github.Workflows) GithubClient {`
`67`	`67`	`workflows,`
`68`	`68`	`),`
`69`	`69`	`)`
`70`		`- gc, _ := InitClient(mockedHTTPClient, "")`
	`70`	`+ gc, _ := InitClient(mockedHTTPClient, "", "github.com")`
`71`	`71`	`return &gc`
`72`	`72`	`}`
`73`	`73`
`@@ -78,7 +78,7 @@ func MockGetContent(content github.RepositoryContent) GithubClient {`
`78`	`78`	`content,`
`79`	`79`	`),`
`80`	`80`	`)`
`81`		`- gc, _ := InitClient(mockedHTTPClient, "")`
	`81`	`+ gc, _ := InitClient(mockedHTTPClient, "", "github.com")`
`82`	`82`	`return &gc`
`83`	`83`	`}`
`84`	`84`
`@@ -89,7 +89,7 @@ func MockGetOrganizationWebhooks(hooks []github.Hook) GithubClient {`
`89`	`89`	`hooks,`
`90`	`90`	`),`
`91`	`91`	`)`
`92`		`- gc, _ := InitClient(mockedHTTPClient, "")`
	`92`	`+ gc, _ := InitClient(mockedHTTPClient, "", "github.com")`
`93`	`93`	`return &gc`
`94`	`94`	`}`
`95`	`95`
`@@ -100,7 +100,7 @@ func MockGetRepositoryWebhooks(hooks []github.Hook) GithubClient {`
`100`	`100`	`hooks,`
`101`	`101`	`),`
`102`	`102`	`)`
`103`		`- gc, _ := InitClient(mockedHTTPClient, "")`
	`103`	`+ gc, _ := InitClient(mockedHTTPClient, "", "github.com")`
`104`	`104`	`return &gc`
`105`	`105`	`}`
`106`	`106`
`@@ -111,7 +111,7 @@ func MockListCommits(commits []github.RepositoryCommit) GithubClient {`
`111`	`111`	`commits,`
`112`	`112`	`),`
`113`	`113`	`)`
`114`		`- gc, _ := InitClient(mockedHTTPClient, "")`
	`114`	`+ gc, _ := InitClient(mockedHTTPClient, "", "github.com")`
`115`	`115`	`return &gc`
`116`	`116`	`}`
`117`	`117`
`@@ -122,6 +122,6 @@ func MockListOrganizationPackages(packages []github.Package) GithubClient {`
`122`	`122`	`packages,`
`123`	`123`	`),`
`124`	`124`	`)`
`125`		`- gc, _ := InitClient(mockedHTTPClient, "")`
	`125`	`+ gc, _ := InitClient(mockedHTTPClient, "", "github.com")`
`126`	`126`	`return &gc`
`127`	`127`	`}`
Original file line number	Diff line number	Diff line change
`@@ -19,8 +19,8 @@ type ClientAdapterImpl struct {`
`19`	`19`	`client GitlabClient`
`20`	`20`	`}`
`21`	`21`
`22`		`-func (ClientAdapterImpl) Init(client http.Client, token string) error {`
`23`		`- glClient, err := InitClient(client, token)`
	`22`	`+func (ClientAdapterImpl) Init(client http.Client, token string, host string) error {`
	`23`	`+ glClient, err := InitClient(client, token, host)`
`24`	`24`	`Adapter = ClientAdapterImpl{client: glClient}`
`25`	`25`	`return err`
`26`	`26`	`}`