quality_gate.py - master - Art86/DefectDojo-DevSecOps

quality_gate.py
110 строк4 KB
Art
Добавлен безопасный пайплайн с SAST/DAST
31 мар 2026, 13:04
31 мар 2026, 13:04184278e
#!/usr/bin/env python

import argparse
import json
import sys

def load_json(path):
    try:
        with open(path, 'r', encoding='utf-8') as f:
            return json.load(f)
    except FileNotFoundError:
        print(f"⚠️ Warning: Report file not found ({path}). Skipping.")
        return None
    except Exception as e:
        print(f"❌ Error loading {path}: {e}")
        sys.exit(1)

def count_bandit_issues(data):
    if not data or 'results' not in data:
        return 0
    return len(data['results'])

def count_dast_issues(data):
    if not data or 'site' not in data or not data['site']:
        return {'total': 0, 'high_medium': 0}
    
    alerts = data['site'][0].get('alerts', [])
    high_medium_alerts = [a for a in alerts if a.get('riskcode', '0') in ('1', '2')]
    
    return {
        'total': len(alerts),
        'high_medium': len(high_medium_alerts)
    }

def count_trivy_issues(data):
    if not data or 'Results' not in data:
        return []
    
    issues = []
    for result in data['Results']:
        for vuln in result.get('Vulnerabilities', []):
            sev = vuln.get('Severity')
            if sev in ('CRITICAL', 'HIGH'):
                issues.append(vuln)
                print(f"   [Trivy] {vuln.get('VulnerabilityID')} ({sev}): {vuln.get('Title')}")
            elif sev == 'MEDIUM':
                print(f"   [Trivy] {vuln.get('VulnerabilityID')} ({sev}): {vuln.get('Title')}")
            elif sev == 'LOW':
                print(f"   [Trivy] {vuln.get('VulnerabilityID')} ({sev}): {vuln.get('Title')}")
            elif sev == 'UNKNOWN':
                print(f"   [Trivy] {vuln.get('VulnerabilityID')} ({sev}): {vuln.get('Title')}")
            else:
                print(f"   [Trivy] {vuln.get('VulnerabilityID')} ({sev}): {vuln.get('Title')}")
                
    return issues

def main():
    parser = argparse.ArgumentParser(description='Quality Gate for DefectDojo')
    
    parser.add_argument('--bandit', required=True, help='Path to bandit-report.json')
    parser.add_argument('--dast', required=True, help='Path to dast-report.json')
    parser.add_argument('--trivy', required=True, help='Path to trivy-report.json')
    parser.add_argument('--gitleaks', required=True, help='Path to gitleaks-report.json')
    parser.add_argument('--checkov', required=True, help='Path to checkov-report.json')
    
    parser.add_argument('--critical_threshold', type=int, default=0, help='Max allowed CRITICAL issues')
    parser.add_argument('--high_threshold', type=int, default=0, help='Max allowed HIGH issues')
    
    args = parser.parse_args()
    
    print("\n--- Running Quality Gate ---")
    
    bandit_data = load_json(args.bandit)
    dast_data = load_json(args.dast)
    trivy_data = load_json(args.trivy)
    
    trivy_issues = count_trivy_issues(trivy_data)
    
    total_critical = len([i for i in trivy_issues if i.get('Severity') == 'CRITICAL'])
    total_high = len([i for i in trivy_issues if i.get('Severity') == 'HIGH'])
    
    dast_counts = count_dast_issues(dast_data)
    
    print(f"\n📊 Summary:")
    print(f"Trivy CRITICAL issues found: {total_critical}")
    print(f"Trivy HIGH issues found: {total_high}")
    
    if dast_counts['total'] > 0 or dast_counts['high_medium'] > 0:
        print(f"DAST Total alerts found: {dast_counts['total']}")
        print(f"DAST High/Medium alerts found: {dast_counts['high_medium']}")
        
     # Проверка порогов (логика Quality Gate)
     fail = False

     if total_critical > args.critical_threshold:
         print(f"\n❌ FAIL: CRITICAL vulnerabilities threshold exceeded! ({total_critical} > {args.critical_threshold})")
         fail = True

     if total_high > args.high_threshold:
         print(f"\n❌ FAIL: HIGH vulnerabilities threshold exceeded! ({total_high} > {args.high_threshold})")
         fail = True

     if fail:
         sys.exit(1)
     else:
         print("\n✅ Quality gate passed. All thresholds met.")
         sys.exit(0)
 
if __name__ == "__main__":
     main()