diff --git a/go.mod b/go.mod index 07bc8bf2c..450d833d6 100644 --- a/go.mod +++ b/go.mod @@ -102,7 +102,7 @@ require ( github.com/testcontainers/testcontainers-go v0.44.0 github.com/vektah/gqlparser/v2 v2.5.60 github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 - gitlab.com/gitlab-org/security-products/analyzers/report/v5 v5.13.1 + gitlab.com/gitlab-org/security-products/analyzers/report/v7 v7.3.0 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.72.0 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.72.0 go.opentelemetry.io/otel v1.47.0 diff --git a/go.sum b/go.sum index 5a8662185..c9d6b13e5 100644 --- a/go.sum +++ b/go.sum @@ -1342,8 +1342,8 @@ gitlab.com/gitlab-org/api/client-go v1.46.0 h1:YxBWFZIFYKcGESCb9fpkwzouo+apyB9pr gitlab.com/gitlab-org/api/client-go v1.46.0/go.mod h1:FtgyU6g2HS5+fMhw6nLK96GBEEBx5MzntOiJWfIaiN8= gitlab.com/gitlab-org/security-products/analyzers/common/v3 v3.4.0 h1:+1k1NQiBSVeLDePX82ec3nHdrOsDvhMmA09LL25omTk= gitlab.com/gitlab-org/security-products/analyzers/common/v3 v3.4.0/go.mod h1:VEhMaykRqWmiLS7uWGKAVfsFmAqeHp1q1K1s24d37Ig= -gitlab.com/gitlab-org/security-products/analyzers/report/v5 v5.13.1 h1:936hBRBYfrLjQp5LGrSsP6vet2EawSI1zyUppoHOj/I= -gitlab.com/gitlab-org/security-products/analyzers/report/v5 v5.13.1/go.mod h1:89AMh07hABjE8V9JFl6UYmjXYaBrsAlQCR7FGWD/aIQ= +gitlab.com/gitlab-org/security-products/analyzers/report/v7 v7.3.0 h1:jAbRipqripmOdrN3oea0LGkUA48DdzXARNrf3YE7ZrI= +gitlab.com/gitlab-org/security-products/analyzers/report/v7 v7.3.0/go.mod h1:sSgZy0JXQUfMPPUIdxN7KNNjM6uboLeTnpQAfkDLllU= gitlab.com/gitlab-org/security-products/analyzers/ruleset/v3 v3.3.2 h1:dvJgv4yfy+B2DcPtc9cE23sHdm8bcETeprTcD0pHfJA= gitlab.com/gitlab-org/security-products/analyzers/ruleset/v3 v3.3.2/go.mod h1:hHFwTR6EqMt2J0b5U18oMxU/yG0h/j7vVboqIszwCrA= go.etcd.io/bbolt v1.3.3/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU= diff --git a/pkg/attestation/crafter/materials/gitlab.go b/pkg/attestation/crafter/materials/gitlab.go index 9f51e619d..1349c4dfc 100644 --- a/pkg/attestation/crafter/materials/gitlab.go +++ b/pkg/attestation/crafter/materials/gitlab.go @@ -26,7 +26,7 @@ import ( api "github.com/chainloop-dev/chainloop/pkg/attestation/crafter/api/attestation/v1" "github.com/chainloop-dev/chainloop/pkg/casclient" "github.com/rs/zerolog" - "gitlab.com/gitlab-org/security-products/analyzers/report/v5" + "gitlab.com/gitlab-org/security-products/analyzers/report/v7" ) var supportedTypes = []string{"sast", "dast", "api_fuzzing", "coverage_fuzzing", "secret_detection", "dependency_scanning", "container_scanning", "container_scanning_for_registry", "cluster_image_scanning"} diff --git a/pkg/attestation/crafter/materials/gitlab_test.go b/pkg/attestation/crafter/materials/gitlab_test.go index 673d20a1a..2cf357db1 100644 --- a/pkg/attestation/crafter/materials/gitlab_test.go +++ b/pkg/attestation/crafter/materials/gitlab_test.go @@ -109,6 +109,14 @@ func TestGitlabCrafter_Craft(t *testing.T) { "chainloop.material.tool.version": ":SKIP:", }, }, + { + name: "secret detection report with observability events", + filePath: "./testdata/gl-secret-detection-report-observability.json", + annotations: map[string]string{ + "chainloop.material.tool.name": "Gitleaks", + "chainloop.material.tool.version": "8.29.1", + }, + }, { name: "sonarqube report", filePath: "./testdata/gl-sonarqube-report.json", diff --git a/pkg/attestation/crafter/materials/testdata/gl-secret-detection-report-observability.json b/pkg/attestation/crafter/materials/testdata/gl-secret-detection-report-observability.json new file mode 100644 index 000000000..0e6ae5ef8 --- /dev/null +++ b/pkg/attestation/crafter/materials/testdata/gl-secret-detection-report-observability.json @@ -0,0 +1,71 @@ +{ + "version": "15.2.4", + "vulnerabilities": [ + { + "id": "cc927200-b884-4fb7-8fcc-df8b667404c9", + "category": "secret_detection", + "name": "Generic API Key", + "description": "Generic API Key", + "cve": "app/config.yaml:3a3436765885cdf2edc179512c22dd4c4259410f0d18f391cbc8d83a837c678e:generic-api-key", + "severity": "Critical", + "confidence": "Unknown", + "raw_source_code_extract": "example-not-a-real-secret", + "scanner": { + "id": "gitleaks", + "name": "Gitleaks" + }, + "location": { + "file": "app/config.yaml", + "commit": { + "sha": "0000000" + }, + "start_line": 3 + }, + "identifiers": [ + { + "type": "gitleaks_rule_id", + "name": "Gitleaks rule ID generic-api-key", + "value": "generic-api-key" + } + ] + } + ], + "scan": { + "analyzer": { + "id": "secrets", + "name": "secrets", + "url": "https://gitlab.com/gitlab-org/security-products/analyzers/secrets", + "vendor": { + "name": "GitLab" + }, + "version": "7.24.1" + }, + "scanner": { + "id": "gitleaks", + "name": "Gitleaks", + "url": "https://github.com/gitleaks/gitleaks", + "vendor": { + "name": "GitLab" + }, + "version": "8.29.1" + }, + "type": "secret_detection", + "start_time": "2025-01-01T00:00:00", + "end_time": "2025-01-01T00:00:02", + "status": "success", + "observability": { + "events": [ + { + "event": "collect_secrets_analyzer_scan_metrics_from_pipeline", + "time_s": 1.5, + "exit_code": 0, + "bytes_scanned": 2048 + }, + { + "event": "example_unregistered_event", + "value": 1 + } + ] + } + } +}