git_test.go

package main

import (
	"fmt"
	"os/exec"
	"path/filepath"
	"testing"

	"github.com/stretchr/testify/assert"

	"github.com/jfrog/jfrog-cli-core/v2/common/format"
	"github.com/jfrog/jfrog-cli-core/v2/utils/coreutils"
	"github.com/jfrog/jfrog-cli-security/commands/git/contributors"
	"github.com/jfrog/jfrog-cli-security/policy"
	securityTests "github.com/jfrog/jfrog-cli-security/tests"
	securityTestUtils "github.com/jfrog/jfrog-cli-security/tests/utils"
	"github.com/jfrog/jfrog-cli-security/tests/utils/integration"
	"github.com/jfrog/jfrog-cli-security/tests/validations"
	securityUtils "github.com/jfrog/jfrog-cli-security/utils"
	"github.com/jfrog/jfrog-cli-security/utils/xray/scangraph"
	"github.com/jfrog/jfrog-client-go/utils/tests"
	"github.com/jfrog/jfrog-client-go/xray/services"
	xrayUtils "github.com/jfrog/jfrog-client-go/xray/services/utils"
	xscutils "github.com/jfrog/jfrog-client-go/xsc/services/utils"
)

func TestCountContributorsFlags(t *testing.T) {
	_, _, testCleanUp := integration.InitGitTest(t, "")
	defer testCleanUp()

	err := securityTests.PlatformCli.WithoutCredentials().Exec("git", "count-contributors", "--token", "token", "--owner", "owner", "--scm-api-url", "url")
	assert.ErrorContains(t, err, "The --scm-type option is mandatory")
	err = securityTests.PlatformCli.WithoutCredentials().Exec("git", "cc", "--scm-type", "github", "--owner", "owner", "--scm-api-url", "url")
	assert.ErrorContains(t, err, "Providing a token is mandatory")
	err = securityTests.PlatformCli.WithoutCredentials().Exec("git", "cc", "--scm-type", "gitlab", "--token", "token", "--scm-api-url", "url")
	assert.ErrorContains(t, err, "The --owner option is mandatory")
	err = securityTests.PlatformCli.WithoutCredentials().Exec("git", "cc", "--scm-type", "bitbucket", "--token", "token", "--owner", "owner")
	assert.ErrorContains(t, err, "The --scm-api-url option is mandatory")

	// Test token env variable
	bitbucketCallback := tests.SetEnvWithCallbackAndAssert(t, contributors.BitbucketTokenEnvVar, "token")
	err = securityTests.PlatformCli.WithoutCredentials().Exec("git", "count-contributors", "--scm-type", "bitbucket", "--owner", "owner", "--scm-api-url", "url")
	assert.NotContains(t, err.Error(), "Providing a token is mandatory")
	bitbucketCallback()
	gitlabCallback := tests.SetEnvWithCallbackAndAssert(t, contributors.GitlabTokenEnvVar, "token")
	err = securityTests.PlatformCli.WithoutCredentials().Exec("git", "count-contributors", "--scm-type", "gitlab", "--owner", "owner", "--scm-api-url", "url")
	assert.NotContains(t, err.Error(), "Providing a token is mandatory")
	gitlabCallback()
	githubCallback := tests.SetEnvWithCallbackAndAssert(t, contributors.GithubTokenEnvVar, "token")
	err = securityTests.PlatformCli.WithoutCredentials().Exec("git", "count-contributors", "--scm-type", "github", "--owner", "owner", "--scm-api-url", "url")
	assert.NotContains(t, err.Error(), "Providing a token is mandatory")
	githubCallback()

	// Test unsupported scm type
	err = securityTests.PlatformCli.WithoutCredentials().Exec("git", "cc", "--scm-type", "bad-type", "--token", "token", "--owner", "owner", "--scm-api-url", "url")
	assert.ErrorContains(t, err, "Unsupported SCM type")
}

type gitAuditCommandTestParams struct {
	auditCommandTestParams
	UseConfigProfile bool
	// Override the test project repo clone url
	OverrideRepoCloneUrl string
	OverrideCommitMsg    string
}

func testGitAuditCommand(t *testing.T, params gitAuditCommandTestParams) (string, error) {
	args := append([]string{"git"}, getAuditCmdArgs(params.auditCommandTestParams)...)
	args = append(args, fmt.Sprintf("--use-config-profile=%t", params.UseConfigProfile))
	return securityTests.PlatformCli.RunCliCmdWithOutputs(t, args...)
}

func getDummyGitRepoUrl() string {
	return fmt.Sprintf("https://test.git.provider.com/jfrog-tests/dummy-repo-url%s.git", securityTests.GetUniqueSuffix())
}

func getDummyCommitMsg(baseMsg string) string {
	return fmt.Sprintf("commit-message-%s-%s", baseMsg, securityTests.GetUniqueSuffix())
}

const (
	testGitUserName  = "jfrog-cli-security-test"
	testGitUserEmail = "jfrog-cli-security-test@jfrog.com"
)

// amendHeadCommitForTest amends HEAD with a unique message and timestamp.
// CI runners and some dev machines have no global git user.identity; -c supplies a local identity.
func amendHeadCommitForTest(t *testing.T, message string) {
	t.Helper()
	cmd := exec.Command("git", "-c", "user.name="+testGitUserName, "-c", "user.email="+testGitUserEmail,
		"commit", "--amend", "--date=now", "-m", message)
	out, err := cmd.CombinedOutput()
	assert.NoError(t, err, "Failed to set dummy commit msg: %s", string(out))
}

func createTestProjectRunGitAuditAndValidate(t *testing.T, projectPath string, gitAuditParams gitAuditCommandTestParams, xrayVersion, xscVersion, expectError string, validationParams validations.ValidationParams) {
	// Create the project to scan
	_, cleanUpProject := securityTestUtils.CreateTestProjectFromZipAndChdir(t, projectPath)
	defer cleanUpProject()
	cleanUp := integration.UseTestHomeWithDefaultXrayConfig(t)
	defer cleanUp()
	if gitAuditParams.OverrideRepoCloneUrl != "" {
		// Override the git remote url to a dummy one to avoid flaky tests due to collisions in policy/watch created for the same repo.
		assert.NoError(t, exec.Command("git", "remote", "set-url", "origin", gitAuditParams.OverrideRepoCloneUrl).Run(), "Failed to set dummy git remote url")
	}
	if gitAuditParams.OverrideCommitMsg != "" {
		amendHeadCommitForTest(t, gitAuditParams.OverrideCommitMsg)
	}
	// Run the audit command with git repo and verify violations are reported to the platform.
	output, err := testGitAuditCommand(t, gitAuditParams)
	if expectError != "" {
		assert.ErrorContains(t, err, expectError)
	} else {
		assert.NoError(t, err)
	}
	validations.VerifySimpleJsonResults(t, output, validationParams)
	if !gitAuditParams.WithStaticSca {
		validateAnalyticsBasicEvent(t, xrayVersion, xscVersion, output)
	}
}

func TestGitAuditSimpleJson(t *testing.T) {
	xrayVersion, xscVersion, testCleanUp := integration.InitGitTest(t, scangraph.GraphScanMinXrayVersion)
	defer testCleanUp()
	createTestProjectRunGitAuditAndValidate(t,
		filepath.Join(filepath.FromSlash(securityTests.GetTestResourcesPath()), "git", "projects", "gitlab"),
		gitAuditCommandTestParams{auditCommandTestParams: auditCommandTestParams{Format: format.SimpleJson, WithLicense: true, WithVuln: true}},
		xrayVersion, xscVersion, "",
		validations.ValidationParams{
			Total:           &validations.TotalCount{Licenses: 3, Vulnerabilities: 2},
			Vulnerabilities: &validations.VulnerabilityCount{ValidateScan: &validations.ScanCount{Sca: 2}},
		},
	)
}

func TestGitAuditStaticScaSimpleJson(t *testing.T) {
	// XRAY-136444 will be fixed in 3.141.7
	integration.InitAuditNewScaTests(t, "3.141.7")
	securityTestUtils.SkipTestIfDurationNotPassed(t, "01-10-2026", 60, "Bug in Xray Server, should be fixed at XRAY-138919")
	if coreutils.IsWindows() {
		// On windows tests are failing due to the bug in Xray Server, should be fixed at XRAY-138079
		securityTestUtils.SkipTestIfDurationNotPassed(t, "01-10-2026", 60, "Bug in Xray Server, should be fixed at XRAY-138079")
	}

	xrayVersion := integration.GetAndValidateXrayVersion(t, securityUtils.StaticScanMinVersion)

	projectPath := filepath.Join(filepath.FromSlash(securityTests.GetTestResourcesPath()), "git", "projects", "issues")
	// Tests are running in parallel for multiple OSes and environments, so we need to generate a unique repo clone URL to avoid conflicts.
	dummyCloneUrl := getDummyGitRepoUrl()

	// Create policy and watch for the git repo so we will also get violations (unknown = all vulnerabilities will be reported as violations)
	policyName, cleanUpPolicy := securityTestUtils.CreateTestSecurityPolicy(t, "git-repo-static-sca-policy", xrayUtils.Unknown, true, false)
	defer cleanUpPolicy()
	watchName, cleanUpWatch := securityTestUtils.CreateWatchOnGitResources(t, policyName, "git-repo-static-sca-watch", xrayUtils.Security, xscutils.GetGitRepoUrlKey(dummyCloneUrl))
	defer cleanUpWatch()

	// Run the audit command with git repo and verify violations are reported to the platform.
	createTestProjectRunGitAuditAndValidate(t, projectPath,
		gitAuditCommandTestParams{
			auditCommandTestParams: auditCommandTestParams{
				Format:        format.SimpleJson,
				WithStaticSca: true,
				WithLicense:   true,
				WithVuln:      true,
				Watches:       []string{watchName},
			},
			OverrideRepoCloneUrl: dummyCloneUrl,
			OverrideCommitMsg:    getDummyCommitMsg("git-audit-static-sca-simple-json"),
		},
		xrayVersion, "", "One or more of the detected violations are configured to fail the build that including them",
		validations.ValidationParams{
			Total: &validations.TotalCount{Licenses: 85, Violations: 12 + 4, Vulnerabilities: 16 + 4},
			Vulnerabilities: &validations.VulnerabilityCount{
				ValidateScan: &validations.ScanCount{Sca: 8, Sast: 2, Iac: 4, Secrets: 2, Services: 4},
			},
			// Check that we have at least one violation for each scan type. (IAC is not supported yet)
			Violations: &validations.ViolationCount{ValidateScan: &validations.ScanCount{Sca: 8, Sast: 2, Secrets: 2, Services: 4}},
		},
	)
}

func TestGitAuditViolationsWithIgnoreRule(t *testing.T) {
	xrayVersion, xscVersion, testCleanUp := integration.InitGitTest(t, services.MinXrayVersionGitRepoKey)
	defer testCleanUp()

	projectPath := filepath.Join(filepath.FromSlash(securityTests.GetTestResourcesPath()), "git", "projects", "issues")
	// Tests are running in parallel for multiple OSes and environments, so we need to generate a unique repo clone URL to avoid conflicts.
	dummyCloneUrl := getDummyGitRepoUrl()

	// Create policy and watch for the git repo so we will also get violations (unknown = all vulnerabilities will be reported as violations)
	policyName, cleanUpPolicy := securityTestUtils.CreateTestSecurityPolicy(t, "git-repo-ignore-rule-policy", xrayUtils.Unknown, true, false)
	defer cleanUpPolicy()
	watchName, cleanUpWatch := securityTestUtils.CreateWatchOnGitResources(t, policyName, "git-repo-ignore-rule-watch", xrayUtils.Security, xscutils.GetGitRepoUrlKey(dummyCloneUrl))
	defer cleanUpWatch()

	// Run the audit command with git repo and verify violations are reported to the platform.
	createTestProjectRunGitAuditAndValidate(t, projectPath,
		gitAuditCommandTestParams{
			auditCommandTestParams: auditCommandTestParams{Format: format.SimpleJson, WithLicense: true, WithVuln: true},
			OverrideRepoCloneUrl:   dummyCloneUrl,
			OverrideCommitMsg:      getDummyCommitMsg("git-audit-violations-with-ignore-rule-before"),
		},
		xrayVersion, xscVersion, "One or more of the detected violations are configured to fail the build that including them",
		validations.ValidationParams{
			Total: &validations.TotalCount{Licenses: 3, Violations: 18, Vulnerabilities: 18},
			// Check that we have at least one violation for each scan type. (IAC and Services are not supported in old flows)
			Violations: &validations.ViolationCount{ValidateScan: &validations.ScanCount{Sca: 1, Sast: 1, Secrets: 1}},
		},
	)

	// Create an ignore rules for the git repo
	cleanUpCveIgnoreRule := securityTestUtils.CreateTestIgnoreRules(t, "security cli tests - Sca ignore rule", xrayUtils.IgnoreFilters{
		GitRepositories: []string{xscutils.GetGitRepoUrlKey(dummyCloneUrl)},
		CVEs:            []string{"any"}, Licenses: []string{"any"},
		Watches: []string{watchName},
	})
	defer cleanUpCveIgnoreRule()
	cleanUpExposureIgnoreRule := securityTestUtils.CreateTestIgnoreRules(t, "security cli tests - Exposure ignore rule", xrayUtils.IgnoreFilters{
		GitRepositories: []string{xscutils.GetGitRepoUrlKey(dummyCloneUrl)},
		Exposures:       &xrayUtils.ExposuresFilterName{Categories: []xrayUtils.ExposureType{xrayUtils.SecretExposureType, xrayUtils.IacExposureType, xrayUtils.ServicesExposureType}},
		Watches:         []string{watchName},
	})
	defer cleanUpExposureIgnoreRule()
	cleanSastUpIgnoreRule := securityTestUtils.CreateTestIgnoreRules(t, "security cli tests - Sast ignore rule", xrayUtils.IgnoreFilters{
		GitRepositories: []string{xscutils.GetGitRepoUrlKey(dummyCloneUrl)},
		Sast:            &xrayUtils.SastFilterName{Rule: []string{"any"}},
		Watches:         []string{watchName},
	})
	defer cleanSastUpIgnoreRule()

	createTestProjectRunGitAuditAndValidate(t, projectPath,
		gitAuditCommandTestParams{
			auditCommandTestParams: auditCommandTestParams{Format: format.SimpleJson},
			OverrideRepoCloneUrl:   dummyCloneUrl,
			OverrideCommitMsg:      getDummyCommitMsg("git-audit-violations-with-ignore-rule-after"),
		},
		xrayVersion, xscVersion, "",
		// No Violations should be reported since all violations are ignored.
		validations.ValidationParams{ExactResultsMatch: true, Total: &validations.TotalCount{}, Violations: &validations.ViolationCount{ValidateScan: &validations.ScanCount{}}},
	)
}

func TestGitAuditJasViolationsProjectKeySimpleJson(t *testing.T) {
	xrayVersion, xscVersion, testCleanUp := integration.InitGitTest(t, services.MinXrayVersionGitRepoKey)
	defer testCleanUp()

	if *securityTests.JfrogTestProjectKey == "" {
		t.Skipf("skipping test. %s is not set.", securityTests.TestJfrogPlatformProjectKeyEnvVar)
	}

	// Create policy and watch for the project so we will get violations (unknown = all vulnerabilities will be reported as violations)
	policyName, cleanUpPolicy := securityTestUtils.CreateTestSecurityPolicy(t, "project-key-jas-violations-policy", xrayUtils.Unknown, true, false)
	defer cleanUpPolicy()
	_, cleanUpWatch := securityTestUtils.CreateWatchOnProjectBuilds(t, policyName, "project-key-jas-violations-watch", xrayUtils.Security, *securityTests.JfrogTestProjectKey)
	defer cleanUpWatch()

	// Run the audit command with git repo and verify violations are reported to the platform.
	createTestProjectRunGitAuditAndValidate(t,
		filepath.Join(filepath.FromSlash(securityTests.GetTestResourcesPath()), "git", "projects", "issues"),
		gitAuditCommandTestParams{auditCommandTestParams: auditCommandTestParams{Format: format.SimpleJson, ProjectKey: *securityTests.JfrogTestProjectKey, WithVuln: true}},
		xrayVersion, xscVersion, policy.NewFailBuildError().Error(),
		validations.ValidationParams{
			Total: &validations.TotalCount{Vulnerabilities: 18, Violations: 18},
			// Validate we have vulnerabilities for each scan type (to make sure if violations are issue when fail or not related and issue from other places before)
			Vulnerabilities: &validations.VulnerabilityCount{ValidateScan: &validations.ScanCount{Sca: 1, Sast: 1, Secrets: 1}},
			// Check that we have at least one violation for each scan type. (IAC and Services are not supported in old flows)
			Violations: &validations.ViolationCount{ValidateScan: &validations.ScanCount{Sca: 1, Sast: 1, Secrets: 1}},
		},
	)
}

// Applicability counts below (NotApplicable/NotCovered/Sca) reflect the live Xray/JAS applicability determination
// for this fixture's indirect CVEs; they were last verified against CI and may drift again as vulnerability
// content or scanner heuristics evolve independently of this repo's code.
func TestGitAuditJasSkipNotApplicableCvesViolations(t *testing.T) {
	xrayVersion, xscVersion, testCleanUp := integration.InitGitTest(t, securityUtils.GitRepoKeyAnalyticsMinXrayVersion)
	defer testCleanUp()
	// TODO: investigate why "issues" npm project causes flaky tests XRAY-145258
	projectPath := filepath.Join(filepath.FromSlash(securityTests.GetTestResourcesPath()), "git", "projects", "issues-mvn")
	// Tests are running in parallel for multiple OSes and environments, so we need to generate a unique repo clone URL to avoid conflicts.
	dummyCloneUrl := getDummyGitRepoUrl()

	// Create policy and watch for the git repo so we will also get violations - This watch DO NOT skip not-applicable results
	var firstPolicyCleaned, firstWatchCleaned bool
	policyName, cleanUpPolicy := securityTestUtils.CreateTestSecurityPolicy(t, "without-skip-non-applicable-policy", xrayUtils.Low, false, false)
	defer func() {
		if !firstPolicyCleaned {
			cleanUpPolicy()
		}
	}()
	watchName, cleanUpWatch := securityTestUtils.CreateWatchOnGitResources(t, policyName, "without-skip-not-applicable-watch", xrayUtils.Security, xscutils.GetGitRepoUrlKey(dummyCloneUrl))
	defer func() {
		if !firstWatchCleaned {
			cleanUpWatch()
		}
	}()

	// Services scan is not supported in old flows, so we don't include it in the onlyScan list
	onlyScan := []securityUtils.SubScanType{securityUtils.SecretsScan, securityUtils.ScaScan, securityUtils.SastScan, securityUtils.IacScan}

	// Run the git audit command and verify violations are reported to the platform.
	createTestProjectRunGitAuditAndValidate(t, projectPath,
		gitAuditCommandTestParams{
			auditCommandTestParams: auditCommandTestParams{
				Format:                       format.SimpleJson,
				Watches:                      []string{watchName},
				DisableFailOnFailedBuildFlag: true,
				OnlyScan:                     onlyScan,
				ValidateSecrets:              true,
			},
			OverrideRepoCloneUrl: dummyCloneUrl,
			OverrideCommitMsg:    getDummyCommitMsg("git-audit-jas-skip-not-applicable-cves-violations-before"),
		},
		xrayVersion, xscVersion, "",
		validations.ValidationParams{
			Violations: &validations.ViolationCount{
				ValidateScan:                &validations.ScanCount{Sca: 77, Sast: 5, Secrets: 4},
				ValidateApplicabilityStatus: &validations.ApplicabilityStatusCount{NotApplicable: 65, NotCovered: 10, MissingContext: 2, Inactive: 1},
			},
			ExactResultsMatch: true,
		},
	)

	// We clean the initially created Policy and Watch that are related to the Git Repo resource, because we must have all related policies with skipNotApplicable=true
	cleanUpWatch()
	firstWatchCleaned = true
	cleanUpPolicy()
	firstPolicyCleaned = true

	// Create policy and watch for the git repo so we will also get violations - This watch SKIP not-applicable results
	skipPolicyName, skipCleanUpPolicy := securityTestUtils.CreateTestSecurityPolicy(t, "skip-non-applicable-policy", xrayUtils.Low, false, true)
	defer skipCleanUpPolicy()
	skipWatchName, skipCleanUpWatch := securityTestUtils.CreateWatchOnGitResources(t, skipPolicyName, "skip-not-applicable-watch", xrayUtils.Security, xscutils.GetGitRepoUrlKey(dummyCloneUrl))
	defer skipCleanUpWatch()

	// Run the audit command with git repo and verify violations are reported to the platform and not applicable issues are skipped.
	createTestProjectRunGitAuditAndValidate(t, projectPath,
		gitAuditCommandTestParams{
			auditCommandTestParams: auditCommandTestParams{
				Format:                       format.SimpleJson,
				Watches:                      []string{skipWatchName},
				DisableFailOnFailedBuildFlag: true,
				ValidateSecrets:              true,
				OnlyScan:                     onlyScan,
			},
			OverrideRepoCloneUrl: dummyCloneUrl,
			OverrideCommitMsg:    getDummyCommitMsg("git-audit-jas-skip-not-applicable-cves-violations-after"),
		},
		xrayVersion, xscVersion, "",
		validations.ValidationParams{
			Violations: &validations.ViolationCount{
				ValidateScan:                &validations.ScanCount{Sca: 12, Sast: 5, Secrets: 4},
				ValidateApplicabilityStatus: &validations.ApplicabilityStatusCount{NotCovered: 10, MissingContext: 2, Inactive: 1},
			},
			ExactResultsMatch: true,
		},
	)
}