diff --git a/assets/plugin-icons/ic-plugin-snyk-scan.png b/assets/plugin-icons/ic-plugin-snyk-scan.png new file mode 100644 index 0000000000..57260b9acd Binary files /dev/null and b/assets/plugin-icons/ic-plugin-snyk-scan.png differ diff --git a/scripts/sql/31302600_snyk_plugin.down.sql b/scripts/sql/31302600_snyk_plugin.down.sql new file mode 100644 index 0000000000..00684e70eb --- /dev/null +++ b/scripts/sql/31302600_snyk_plugin.down.sql @@ -0,0 +1,7 @@ +DELETE FROM plugin_step_variable WHERE plugin_step_id =(SELECT ps.id FROM plugin_metadata p inner JOIN plugin_step ps on ps.plugin_id=p.id WHERE p.plugin_version='1.0.0' and p.name='Code Scan from Snyk' and p.deleted=false and ps."index"=1 and ps.deleted=false); +DELETE FROM plugin_step WHERE plugin_id = (SELECT id FROM plugin_metadata WHERE plugin_version='1.0.0' and name='Code Scan from Snyk' and deleted=false); +DELETE FROM plugin_stage_mapping WHERE plugin_id =(SELECT id FROM plugin_metadata WHERE plugin_version='1.0.0' and name='Code Scan from Snyk' and deleted=false); +DELETE FROM pipeline_stage_step where ref_plugin_id in (SELECT id from plugin_metadata WHERE plugin_version='1.0.0' and name ='Code Scan from Snyk' and deleted=false); +DELETE from plugin_pipeline_script where id = (SELECT script_id from plugin_step WHERE plugin_id=(SELECT id FROM plugin_metadata WHERE plugin_version='1.0.0' and name='Code Scan from Snyk' and deleted=false)); +DELETE FROM plugin_metadata WHERE plugin_version='1.0.0' and name ='Code Scan from Snyk' and deleted=false; +DELETE FROM plugin_parent_metadata WHERE identifier ='snyk-scan'; \ No newline at end of file diff --git a/scripts/sql/31302600_snyk_plugin.up.sql b/scripts/sql/31302600_snyk_plugin.up.sql new file mode 100644 index 0000000000..034a6f6080 --- /dev/null +++ b/scripts/sql/31302600_snyk_plugin.up.sql @@ -0,0 +1,64 @@ +INSERT INTO "plugin_parent_metadata" ("id", "name","identifier", "description","type","icon","deleted", "created_on", "created_by", "updated_on", "updated_by") +VALUES (nextval('id_seq_plugin_parent_metadata'), 'Code Scan from Snyk','snyk-scan','Scans the code for the vulnerabilities','PRESET','https://raw.githubusercontent.com/devtron-labs/devtron/main/assets/plugin-icons/ic-plugin-snyk-scan.png','f', 'now()', 1, 'now()', 1); + + +UPDATE plugin_metadata SET is_latest = false WHERE id = (SELECT id FROM plugin_metadata WHERE name= 'Code Scan from Snyk' and is_latest= true); + + +INSERT INTO "plugin_metadata" ("id", "name", "description","deleted", "created_on", "created_by", "updated_on", "updated_by","plugin_parent_metadata_id","plugin_version","is_deprecated","is_latest") +VALUES (nextval('id_seq_plugin_metadata'), 'Code Scan from Snyk','Update the configurations for the environment','f', 'now()', 1, 'now()', 1, (SELECT id FROM plugin_parent_metadata WHERE identifier='snyk-scan'),'1.0.0', false, true); + + +INSERT INTO "plugin_stage_mapping" ("plugin_id","stage_type","created_on", "created_by", "updated_on", "updated_by") +VALUES ((SELECT id FROM plugin_metadata WHERE plugin_version='1.0.0' and name='Code Scan from Snyk' and deleted= false),3,'now()', 1, 'now()', 1); + +INSERT INTO "plugin_pipeline_script" ("id", "script","type","deleted","created_on", "created_by", "updated_on", "updated_by")VALUES ( + nextval('id_seq_plugin_pipeline_script'), + E'#!/bin/sh +pipeline_type=$(echo $CI_CD_EVENT | jq -r \'.type\') +if [ $pipeline_type != "CI" ]; then + echo "Plugin only works in Post CI" + exit 1 +fi +if [ -z "$ScanContext" ];then + build_context=$(echo "$CI_CD_EVENT" | jq -r ".commonWorkflowRequest.ciBuildConfig.dockerBuildConfig.buildContext") + if [ -z "$build_context" ];then + build_context="."; + fi +else + build_context=$ScanContext +fi + + +cd $build_context; +echo "Scan context is $PWD" +docker run --rm --env SNYK_TOKEN=$ApiKey -v $PWD:/app $ImageTag +exit_code=$? +if [ "$AbortBuildOnVulnerableCode" = true ];then + if [ $exit_code = 1 ];then + exit $exit_code + fi +else + if [ $exit_code = 1 ] || [ $exit_code = 0 ];then + continue; + else + exit $exit_code + fi +fi', + 'SHELL', + 'f', + 'now()', + 1, + 'now()', + 1 +); + +INSERT INTO "plugin_step" ("id", "plugin_id","name","description","index","step_type","script_id","deleted", "created_on", "created_by", "updated_on", "updated_by") +VALUES (nextval('id_seq_plugin_step'),(SELECT id FROM plugin_metadata WHERE plugin_version='1.0.0' and name='Code Scan from Snyk' and deleted= false),'Step 1','Step 1 - Scanning the code','1','INLINE',(SELECT last_value FROM id_seq_plugin_pipeline_script),'f','now()', 1, 'now()', 1); + + +INSERT INTO "plugin_step_variable" ("id", "plugin_step_id", "name", "format", "description", "is_exposed", "allow_empty_value", "variable_type", "value_type", "variable_step_index", "deleted", "created_on", "created_by", "updated_on", "updated_by","default_value") +VALUES (nextval('id_seq_plugin_step_variable'), (SELECT ps.id FROM plugin_metadata p inner JOIN plugin_step ps on ps.plugin_id=p.id WHERE p.plugin_version='1.0.0' and p.name='Code Scan from Snyk' and p.deleted=false and ps."index"=1 and ps.deleted=false), 'ApiKey','STRING','Provide Snyk API Key of your organization',true,false,'INPUT','NEW',1 ,'f','now()', 1, 'now()', 1, null), +(nextval('id_seq_plugin_step_variable'), (SELECT ps.id FROM plugin_metadata p inner JOIN plugin_step ps on ps.plugin_id=p.id WHERE p.plugin_version='1.0.0' and p.name='Code Scan from Snyk' and p.deleted=false and ps."index"=1 and ps.deleted=false), 'ImageTag','STRING','Specify the image tag of the snyk tool to be used while scanning',true,false,'INPUT','NEW',1 ,'f','now()', 1, 'now()', 1,null), +(nextval('id_seq_plugin_step_variable'), (SELECT ps.id FROM plugin_metadata p inner JOIN plugin_step ps on ps.plugin_id=p.id WHERE p.plugin_version='1.0.0' and p.name='Code Scan from Snyk' and p.deleted=false and ps."index"=1 and ps.deleted=false), 'AbortBuildOnVulnerableCode','STRING','If set true it will abort the build if scanning found some vulnerabilities in code.',true,true,'INPUT','NEW',1 ,'f','now()', 1, 'now()', 1,'false'), +(nextval('id_seq_plugin_step_variable'), (SELECT ps.id FROM plugin_metadata p inner JOIN plugin_step ps on ps.plugin_id=p.id WHERE p.plugin_version='1.0.0' and p.name='Code Scan from Snyk' and p.deleted=false and ps."index"=1 and ps.deleted=false), 'ScanContext','STRING','Specify the context to scan. Default is same as build context',true,true,'INPUT','NEW',1 ,'f','now()', 1, 'now()', 1,null);