SIGINT-2714: ADO: create SARIF with .sarif format for ADO

Author: kiranblackduck

blackduck-security-task/dist/index.js

@@ -302,7 +302,7 @@ exports.BRIDGECLI_INSTALL_DIRECTORY_KEY = "bridgecli_install_directory";
 exports.BRIDGECLI_INSTALL_DIRECTORY_KEY_CLASSIC_EDITOR = "bridgeCliInstallDirectory";
 exports.UPLOAD_FOLDER_ARTIFACT_NAME = "bridge_cli_diagnostics";
 exports.BRIDGE_CLI_LOCAL_DIRECTORY = ".bridge";
-exports.SARIF_DEFAULT_FILE_NAME = "report.sarif.json";
+exports.SARIF_DEFAULT_FILE_NAME = "report.sarif.sarif";
 exports.DEFAULT_BLACKDUCK_SARIF_GENERATOR_DIRECTORY = "Blackduck SCA SARIF Generator";
 exports.DEFAULT_POLARIS_SARIF_GENERATOR_DIRECTORY = "Polaris SARIF Generator";
 exports.SARIF_UPLOAD_FOLDER_ARTIFACT_NAME = "sarif_report";
@@ -2013,6 +2013,8 @@ class BridgeCliToolsParameter {
             if ((0, utility_1.parseToBoolean)(inputs.POLARIS_REPORTS_SARIF_CREATE)) {
                 if (!isPullRequest) {
                     polData.data.polaris.reports = this.setSarifReportsInputsForPolaris();
+                    polData.data.azure = this.setAzureData("", input_1.AZURE_TOKEN, "", "", "", "", "");
+                    polData.data.azure.sarifExtension = "sarif";
                 }
                 else {
                     console.info("Polaris SARIF report create/upload is ignored for pull request scan");
@@ -2133,6 +2135,10 @@ class BridgeCliToolsParameter {
                 if (!isPullRequest) {
                     blackduckData.data.blackducksca.reports =
                         this.setSarifReportsInputsForBlackduck();
+                    blackduckData.data.azure = azureData;
+                    if (blackduckData.data.azure) {
+                        blackduckData.data.azure.sarifExtension = "sarif";
+                    }
                 }
                 else {
                     console.info("Black Duck SCA SARIF report create/upload is ignored for pull request scan");
@@ -2488,6 +2494,7 @@ class BridgeCliToolsParameter {
                 },
                 pull: {},
             },
+            sarifExtension: "sarif",
         };
         if (azurePullRequestNumber != null) {
             azureData.repository.pull.number = Number(azurePullRequestNumber);

blackduck-security-task/dist/index.js.map

@@ -430,7 +430,7 @@ export const BRIDGECLI_INSTALL_DIRECTORY_KEY_CLASSIC_EDITOR =
 
 export const UPLOAD_FOLDER_ARTIFACT_NAME = "bridge_cli_diagnostics";
 export const BRIDGE_CLI_LOCAL_DIRECTORY = ".bridge";
-export const SARIF_DEFAULT_FILE_NAME = "report.sarif.json";
+export const SARIF_DEFAULT_FILE_NAME = "report.sarif.sarif";
 export const DEFAULT_BLACKDUCK_SARIF_GENERATOR_DIRECTORY =
   "Blackduck SCA SARIF Generator";
 export const DEFAULT_POLARIS_SARIF_GENERATOR_DIRECTORY =

blackduck-security-task/src/blackduck-security-task/application-constant.ts

@@ -6,6 +6,7 @@ export interface AzureData {
   organization: Organization;
   project: Project;
   repository: Repository;
+  sarifExtension: string;
 }
 
 export interface Api {

blackduck-security-task/src/blackduck-security-task/model/azure.ts

@@ -228,6 +228,16 @@ export class BridgeCliToolsParameter {
     if (parseToBoolean(inputs.POLARIS_REPORTS_SARIF_CREATE)) {
       if (!isPullRequest) {
         polData.data.polaris.reports = this.setSarifReportsInputsForPolaris();
+        polData.data.azure = this.setAzureData(
+          "",
+          AZURE_TOKEN,
+          "",
+          "",
+          "",
+          "",
+          ""
+        );
+        polData.data.azure.sarifExtension = "sarif";
       } else {
         console.info(
           "Polaris SARIF report create/upload is ignored for pull request scan"
@@ -396,6 +406,10 @@ export class BridgeCliToolsParameter {
       if (!isPullRequest) {
         blackduckData.data.blackducksca.reports =
           this.setSarifReportsInputsForBlackduck();
+        blackduckData.data.azure = azureData;
+        if (blackduckData.data.azure) {
+          blackduckData.data.azure.sarifExtension = "sarif";
+        }
       } else {
         console.info(
           "Black Duck SCA SARIF report create/upload is ignored for pull request scan"
@@ -908,6 +922,7 @@ export class BridgeCliToolsParameter {
         },
         pull: {},
       },
+      sarifExtension: "sarif",
     };
 
     if (azurePullRequestNumber != null) {

blackduck-security-task/src/blackduck-security-task/tools-parameter.ts

@@ -54,6 +54,7 @@ describe("getPullRequestIdForClassicEditorFlow", () => {
                 },
                 pull: {},
             },
+            sarifExtension:"sarif"
         };
 
 

blackduck-security-task/test/unit/blackduck-security-task/azure-service-client.spec.ts

@@ -1364,6 +1364,7 @@ describe("Bridge CLI Tools Parameter test", () => {
             expect(jsonData.data.blackducksca.reports.sarif.file.path).to.be.equals('test-path');
             expect(jsonData.data.blackducksca.reports.sarif.severities).to.be.contains('CRITICAL');
             expect(jsonData.data.blackducksca.reports.sarif.groupSCAIssues).to.be.equals(false);
+            expect(jsonData.data.azure.sarifExtension).to.be.equals("sarif")
             expect(formattedCommand).contains('--stage blackducksca');
 
             blackduckStateFile = '"'.concat(blackduckStateFile).concat('"');