feat: add facts to app projects for upsert (#746)

* feat: add container asset facts for CN-555

* fix: remove version

* fix: package-lock.json

* fix: update snapshots

* test: update snapshots

* test: update window snapshots

* feat: enforce size constraints

* fix: lint

* feat: generic truncation in res build

* feat: pluginwarning fact with truncation vals

* fix: update to skip dep graph

* fix: address comments

* fix: reduce truncation logic

* fix: update types to accept null values

* fix: update object nulls

* fix: add image labels tests

* fix: test multiple scan results trunc and fix import

* fix: update test to use real response builder

* fix: update all tests to check identiy fields and target

* fix: update test snapshots

* test: update windows snapshot

Author: kateeselius

.circleci/config.yml

@@ -207,7 +207,7 @@ jobs:
       - run: npm run build
       - run:
           name: Release on GitHub
-          command: npx semantic-release@19.0.5
+          command: npx semantic-release
 
 workflows:
   version: 2

lib/analyzer/static-analyzer.ts

@@ -160,6 +160,8 @@ export async function analyze(
     platform,
     imageLabels,
     imageCreationTime,
+    containerConfig,
+    history,
   } = await archiveExtractor.extractImageContent(
     imageType,
     imagePath,
@@ -314,6 +316,8 @@ export async function analyze(
     autoDetectedUserInstructions,
     imageLabels,
     imageCreationTime,
+    containerConfig,
+    history,
   };
 }
 

lib/analyzer/types.ts

@@ -82,6 +82,25 @@ export interface StaticAnalysis {
   manifestFiles: ManifestFile[];
   imageLabels?: { [key: string]: string };
   imageCreationTime?: string;
+  containerConfig?: {
+    User?: string | null;
+    ExposedPorts?: { [port: string]: object } | null;
+    Env?: string[] | null;
+    Entrypoint?: string[] | null;
+    Cmd?: string[] | null;
+    Volumes?: { [path: string]: object } | null;
+    WorkingDir?: string | null;
+    Labels?: { [key: string]: string };
+    StopSignal?: string | null;
+    ArgsEscaped?: boolean | null;
+  } | null;
+  history?: Array<{
+    created?: string | null;
+    author?: string | null;
+    created_by?: string | null;
+    comment?: string | null;
+    empty_layer?: boolean | null;
+  }> | null;
 }
 
 export interface StaticPackagesAnalysis extends StaticAnalysis {

lib/extractor/index.ts

@@ -148,7 +148,9 @@ export async function extractImageContent(
       archiveContent.imageConfig,
     ),
     platform: getPlatformFromConfig(archiveContent.imageConfig),
-    imageLabels: archiveContent.imageConfig.config.Labels,
+    imageLabels: archiveContent.imageConfig.config?.Labels,
+    containerConfig: archiveContent.imageConfig.config,
+    history: archiveContent.imageConfig.history,
   };
 }
 

lib/extractor/types.ts

@@ -34,6 +34,8 @@ export interface ExtractionResult {
   platform?: string;
   imageLabels?: { [key: string]: string };
   imageCreationTime?: string;
+  containerConfig?: ContainerConfig | null;
+  history?: HistoryEntry[] | null;
 }
 
 export interface ExtractedLayers {
@@ -54,14 +56,34 @@ export interface DockerArchiveManifest {
   Layers: string[];
 }
 
+export interface ContainerConfig {
+  User?: string | null;
+  ExposedPorts?: { [port: string]: object } | null;
+  Env?: string[] | null;
+  Entrypoint?: string[] | null;
+  Cmd?: string[] | null;
+  Volumes?: { [path: string]: object } | null;
+  WorkingDir?: string | null;
+  Labels?: { [key: string]: string };
+  StopSignal?: string | null;
+  ArgsEscaped?: boolean | null;
+}
+
+export interface HistoryEntry {
+  created?: string | null;
+  author?: string | null;
+  created_by?: string | null;
+  comment?: string | null;
+  empty_layer?: boolean | null;
+}
+
 export interface ImageConfig {
   architecture: string;
   os: string;
   rootfs: { diff_ids: string[] };
-  config: {
-    Labels: { [key: string]: string };
-  };
+  config: ContainerConfig | null;
   created: string;
+  history?: HistoryEntry[] | null;
 }
 
 export interface OciArchiveLayer {

lib/facts.ts

@@ -103,3 +103,51 @@ export interface OCIDistributionMetadataFact {
   type: "ociDistributionMetadata";
   data: OCIDistributionMetadata;
 }
+
+export interface PlatformFact {
+  type: "platform";
+  data: string;
+}
+
+export interface PluginVersionFact {
+  type: "pluginVersion";
+  data: string;
+}
+
+export interface ContainerConfigFact {
+  type: "containerConfig";
+  data: {
+    user?: string | null;
+    exposedPorts?: string[] | null;
+    env?: string[] | null;
+    entrypoint?: string[] | null;
+    cmd?: string[] | null;
+    volumes?: string[] | null;
+    workingDir?: string | null;
+    stopSignal?: string | null;
+    argsEscaped?: boolean | null;
+  };
+}
+
+export interface HistoryFact {
+  type: "history";
+  data: Array<{
+    created?: string | null;
+    author?: string | null;
+    createdBy?: string | null;
+    comment?: string | null;
+    emptyLayer?: boolean | null;
+  }>;
+}
+
+export interface PluginWarningsFact {
+  type: "pluginWarnings";
+  data: {
+    truncatedFacts: {
+      [key: string]: {
+        type: "array" | "string";
+        countAboveLimit: number;
+      };
+    };
+  };
+}

lib/response-builder.ts

@@ -7,7 +7,10 @@ import * as facts from "./facts";
 import { instructionDigest } from "./dockerfile";
 import { DockerFileAnalysis, DockerFilePackages } from "./dockerfile/types";
 import { OCIDistributionMetadata } from "./extractor/oci-distribution-metadata";
+
 import * as types from "./types";
+import { truncateAdditionalFacts } from "./utils";
+import { PLUGIN_VERSION } from "./version";
 
 export { buildResponse };
 
@@ -81,6 +84,62 @@ async function buildResponse(
     additionalFacts.push(imageLabels);
   }
 
+  if (depsAnalysis.containerConfig) {
+    const containerConfigFact: facts.ContainerConfigFact = {
+      type: "containerConfig",
+      data: {
+        ...(depsAnalysis.containerConfig.User !== undefined && {
+          user: depsAnalysis.containerConfig.User,
+        }),
+        ...(depsAnalysis.containerConfig.ExposedPorts !== undefined && {
+          exposedPorts: depsAnalysis.containerConfig.ExposedPorts
+            ? Object.keys(depsAnalysis.containerConfig.ExposedPorts)
+            : null,
+        }),
+        ...(depsAnalysis.containerConfig.Env !== undefined && {
+          env: depsAnalysis.containerConfig.Env,
+        }),
+        ...(depsAnalysis.containerConfig.Entrypoint !== undefined && {
+          entrypoint: depsAnalysis.containerConfig.Entrypoint,
+        }),
+        ...(depsAnalysis.containerConfig.Cmd !== undefined && {
+          cmd: depsAnalysis.containerConfig.Cmd,
+        }),
+        ...(depsAnalysis.containerConfig.Volumes !== undefined && {
+          volumes: depsAnalysis.containerConfig.Volumes
+            ? Object.keys(depsAnalysis.containerConfig.Volumes)
+            : null,
+        }),
+        ...(depsAnalysis.containerConfig.WorkingDir !== undefined && {
+          workingDir: depsAnalysis.containerConfig.WorkingDir,
+        }),
+        ...(depsAnalysis.containerConfig.StopSignal !== undefined && {
+          stopSignal: depsAnalysis.containerConfig.StopSignal,
+        }),
+        ...(depsAnalysis.containerConfig.ArgsEscaped !== undefined && {
+          argsEscaped: depsAnalysis.containerConfig.ArgsEscaped,
+        }),
+      },
+    };
+    additionalFacts.push(containerConfigFact);
+  }
+
+  if (depsAnalysis.history && depsAnalysis.history.length > 0) {
+    const historyFact: facts.HistoryFact = {
+      type: "history",
+      data: depsAnalysis.history.map((entry) => ({
+        ...(entry.created !== undefined && { created: entry.created }),
+        ...(entry.author !== undefined && { author: entry.author }),
+        ...(entry.created_by !== undefined && { createdBy: entry.created_by }),
+        ...(entry.comment !== undefined && { comment: entry.comment }),
+        ...(entry.empty_layer !== undefined && {
+          emptyLayer: entry.empty_layer,
+        }),
+      })),
+    };
+    additionalFacts.push(historyFact);
+  }
+
   if (depsAnalysis.imageCreationTime) {
     const imageCreationTimeFact: facts.ImageCreationTimeFact = {
       type: "imageCreationTime",
@@ -158,6 +217,28 @@ async function buildResponse(
       appDepsScanResult.facts.push(imageIdFact);
     }
 
+    if (names && names.length > 0) {
+      const imageNamesFact: facts.ImageNamesFact = {
+        type: "imageNames",
+        data: { names },
+      };
+      appDepsScanResult.facts.push(imageNamesFact);
+    }
+
+    if (ociDistributionMetadata) {
+      const metadataFact: facts.OCIDistributionMetadataFact = {
+        type: "ociDistributionMetadata",
+        data: ociDistributionMetadata,
+      };
+      appDepsScanResult.facts.push(metadataFact);
+    }
+
+    const appPluginVersionFact: facts.PluginVersionFact = {
+      type: "pluginVersion",
+      data: PLUGIN_VERSION,
+    };
+    appDepsScanResult.facts.push(appPluginVersionFact);
+
     return {
       ...appDepsScanResult,
       target: {
@@ -199,6 +280,20 @@ async function buildResponse(
     additionalFacts.push(metadataFact);
   }
 
+  if (depsAnalysis.platform) {
+    const platformFact: facts.PlatformFact = {
+      type: "platform",
+      data: depsAnalysis.platform,
+    };
+    additionalFacts.push(platformFact);
+  }
+
+  const pluginVersionFact: facts.PluginVersionFact = {
+    type: "pluginVersion",
+    data: PLUGIN_VERSION,
+  };
+  additionalFacts.push(pluginVersionFact);
+
   const scanResults: types.ScanResult[] = [
     {
       facts: [depGraphFact, ...additionalFacts],
@@ -217,8 +312,13 @@ async function buildResponse(
     ...applicationDependenciesScanResults,
   ];
 
+  const truncatedScanResults = scanResults.map((result) => ({
+    ...result,
+    facts: truncateAdditionalFacts(result.facts || []),
+  }));
+
   return {
-    scanResults,
+    scanResults: truncatedScanResults,
   };
 }
 

lib/types.ts

@@ -55,6 +55,7 @@ export type FactType =
   | "autoDetectedUserInstructions"
   | "depGraph"
   | "dockerfileAnalysis"
+  | "history"
   | "imageCreationTime"
   | "imageId"
   | "imageLabels"
@@ -71,6 +72,10 @@ export type FactType =
   | "keyBinariesHashes"
   | "loadedPackages"
   | "ociDistributionMetadata"
+  | "containerConfig"
+  | "platform"
+  | "pluginVersion"
+  | "pluginWarnings"
   | "rootFs"
   // Used for application dependencies scanning; shows which files were used in the analysis of the dependencies.
   | "testedFiles"