Skip to content

Commit 5bb1912

Browse files
csaba-sagi-sonarsourcecsaba-sagi-sonarsource
authored
Invoke mend scan for sonar-text-dotnet (#105)
1 parent 9193e81 commit 5bb1912

File tree

5 files changed

+107
-5
lines changed

5 files changed

+107
-5
lines changed

‎.cirrus.yml

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -151,7 +151,8 @@ build_and_release_dotnet_task:
151151
BUILD_CONFIGURATION: "Release"
152152
PROJECT_DIR: ${CIRRUS_WORKING_DIR}\\sonar-text-dotnet
153153
PIPELINE_SCRIPTS_DIR: ${PROJECT_DIR}\\pipeline_scripts
154-
PROJECT_NAME: "sonar-secrets-dotnet"
154+
PROJECT_KEY: "sonar-secrets-dotnet"
155+
PROJECT_NAME: "sonar-text-dotnet"
155156
SNK_PATH: ${CIRRUS_WORKING_DIR}\\SonarSourceSecret.snk
156157
ENCODED_SONARSOURCE_SNK: VAULT[development/team/languages/kv/data/strong_named_key data.SonarSourceSecret_snk]
157158
ENCODED_SONARSOURCE_SNK_PATH: ${CIRRUS_WORKING_DIR}\\Encoded_SonarSourceSecret.snk
@@ -161,6 +162,8 @@ build_and_release_dotnet_task:
161162
ENCODED_PFX_CERT: VAULT[development/kv/data/sign/dotnet data.cert_pfx]
162163
ENCODED_PFX_CERT_PATH: ${CIRRUS_WORKING_DIR}\\Encoded_SonarSource-2021-2023.pfx
163164
ARTIFACTORY_BUILD_NAME: "sonar-text-dotnet" # artifactory dotnet build name
165+
WS_APIKEY: VAULT[development/kv/data/mend data.apikey]
166+
WS_PRODUCTNAME: "SonarSource/sonar-text"
164167
sign_cert_pfx_file:
165168
path: ${ENCODED_PFX_CERT_PATH}
166169
variable_name: ENCODED_PFX_CERT
@@ -185,6 +188,8 @@ build_and_release_dotnet_task:
185188
analysis_end_step_script:
186189
- cd $PROJECT_DIR
187190
- ps: SonarScanner.MSBuild.exe end /d:sonar.login="$env:SONAR_TOKEN"
191+
execute_mend_scan_script:
192+
- PowerShell -NonInteractive -NoProfile -File "${PIPELINE_SCRIPTS_DIR}\\mend_scan.ps1"
188193
promote_script:
189194
- source cirrus-env QA
190195
- PowerShell -NonInteractive -NoProfile -File "${PIPELINE_SCRIPTS_DIR}\\promote.ps1"

‎sonar-text-dotnet/pipeline_scripts/analysis_begin_step.ps1

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ Write-Host "Reading the Sonar project version from '${versionFilePath}' ..."
33

44
# Read the version from the file
55
[xml]$versionProps = Get-Content "$versionFilePath"
6-
$sonarProjectVersion = $versionProps.Project.PropertyGroup.Version
6+
$sonarProjectVersion = $versionProps.Project.PropertyGroup.Version[1] # Versions is an array of objects in powershell
77
Write-Host "Version: ${sonarProjectVersion}"
88

99
Set-Location $env:PROJECT_DIR
@@ -12,7 +12,7 @@ if ([string]::IsNullOrEmpty($env:CIRRUS_PR)) {
1212
Write-Host "Execute analysis begin step for master branch"
1313

1414
SonarScanner.MSBuild.exe begin `
15-
/k:$env:PROJECT_NAME `
15+
/k:$env:PROJECT_KEY `
1616
/n:$env:PROJECT_NAME `
1717
/v:$sonarProjectVersion `
1818
/d:sonar.host.url=$env:SONAR_HOST_URL `
@@ -23,7 +23,7 @@ else {
2323
Write-Host "Execute analysis begin step on branch $env:CIRRUS_BRANCH"
2424

2525
SonarScanner.MSBuild.exe begin `
26-
/k:$env:PROJECT_NAME `
26+
/k:$env:PROJECT_KEY `
2727
/n:$env:PROJECT_NAME `
2828
/v:$sonarProjectVersion `
2929
/d:sonar.host.url=$env:SONAR_HOST_URL `

‎sonar-text-dotnet/pipeline_scripts/mend_scan.ps1

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
function Get-Version {
2+
$versionFilePath = Join-Path $env:PROJECT_DIR "Directory.Build.props"
3+
Write-Host "Reading the Sonar project version from '${versionFilePath}' ..."
4+
# Read the version from the file
5+
[xml]$versionProps = Get-Content "$versionFilePath"
6+
return $versionProps.Project.PropertyGroup.Version[1] # Versions is an array of objects in powershell
7+
}
8+
9+
if ("$env:CIRRUS_BRANCH" -ne "master" -and (-not ("$env:CIRRUS_BRANCH".startsWith("branch-"))))
10+
{
11+
Exit 0
12+
}
13+
14+
Set-Location $env:PROJECT_DIR
15+
Write-host "Create tools directory"
16+
$toolsPath = "C:\tools"
17+
if (-Not [System.IO.Directory]::Exists($toolsPath)){
18+
New-Item -Path "C:\" -Name "tools" -ItemType "directory"
19+
}
20+
21+
$NUM_RETRIES = 5
22+
for ($num = 1 ; $num -le $NUM_RETRIES ; $num++)
23+
{
24+
try
25+
{
26+
Write-host "Download Mend tool, attempt $num/$NUM_RETRIES"
27+
$MendAgentPath = Join-Path $toolsPath "wss-unified-agent.jar"
28+
Invoke-WebRequest -Uri https://unified-agent.s3.amazonaws.com/wss-unified-agent.jar -OutFile $MendAgentPath
29+
break
30+
}
31+
catch
32+
{
33+
if ([System.IO.File]::Exists($MendAgentPath))
34+
{
35+
Remove-Item -Path $MendAgentPath
36+
}
37+
Write-host "Download failed with error: $_"
38+
39+
if($num -lt $NUM_RETRIES)
40+
{
41+
Write-host "Will wait 5s before retry."
42+
Start-Sleep -Seconds 5
43+
}
44+
}
45+
}
46+
47+
Write-Host "Validating Mend agent jar signature..."
48+
& "$env:JAVA_HOME\bin\jarsigner.exe" -verify -strict -verbose $MendAgentPath
49+
if (-Not $?) # if result is "jar is unsigned" exit code is false, otherwise it's true.
50+
{
51+
Write-Host "wss-unified-agent.jar signature verification failed."
52+
exit 1
53+
}
54+
55+
Write-Host "Download wss-unified-agent.jar.sha256 file"
56+
$shaPath = Join-Path $toolsPath "wss-unified-agent.jar.sha256"
57+
Invoke-WebRequest -Uri https://unified-agent.s3.amazonaws.com/wss-unified-agent.jar.sha256 -OutFile $shaPath
58+
if (-Not (Test-Path -Path $shaPath)){
59+
Write-Host "wss-unified-agent.jar.sha256 file does not exist - cannot complete signature verification."
60+
exit 1
61+
}
62+
63+
Write-Host "Validating Mend agent jar hash..."
64+
if (-Not (Get-Content $shaPath).split(" ")[0] -eq (Get-FileHash $MendAgentPath).Hash)
65+
{
66+
Write-Host "Failed to verify jar hash".
67+
exit 1
68+
}
69+
70+
# Mend agent needs the following environment variables:
71+
# - WS_APIKEY
72+
# - WS_PRODUCTNAME
73+
# - WS_PROJECTNAME
74+
75+
$env:WS_PROJECTNAME = "SonarSource/$env:PROJECT_NAME $(Get-Version)"
76+
77+
Write-Host "Running the Mend unified agent for $env:WS_PROJECTNAME..."
78+
& "$env:JAVA_HOME\bin\java.exe" -jar $MendAgentPath -c "$PSScriptRoot\wss-unified-agent.config"

‎sonar-text-dotnet/pipeline_scripts/wss-unified-agent.config

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# Mend config for the .NET secrets implementation.
2+
# Documentation: https://docs.mend.io/bundle/unified_agent/page/unified_agent_configuration_parameters.html
3+
4+
# Exclude tests - only scan product code
5+
excludes=src/IntegrationTests/** src/SonarLint.Secrets.DotNet.UnitTests/**
6+
fileSystemScan=False
7+
resolveAllDependencies=True
8+
9+
nuget.resolvePackagesConfigFiles=True
10+
nuget.resolveDependencies=True
11+
nuget.preferredEnvironment=nuget
12+
nuget.runPreStep=True
13+
14+
wss.url=https://saas-eu.whitesourcesoftware.com/agent
15+
16+
updateEmptyProject=True
17+
forceUpdate=True
18+
checkPolicies=True
19+
forceUpdate.failBuildOnPolicyViolation=True

‎wss-unified-agent.config

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# WhiteSource documentation https://whitesource.atlassian.net/wiki/spaces/WD/pages/1544880156/Unified+Agent+Configuration+Parameters
22

3-
excludes=**/*sources.jar **/*javadoc.jar its/projects/**
3+
excludes=**/*sources.jar **/*javadoc.jar its/projects/** sonar-secrets-dotnet/**
44
fileSystemScan=False
55
resolveAllDependencies=False
66

0 commit comments

Comments
 (0)