sast-snyk-check: increased version to 0.3

[jperezdealgaba]

Resolves: https://issues.redhat.com/browse/OSH-737

In this version, the severity-threshold argument is introduced and enabled by default to high and the results are parsed with csgrep to be uploaded with the fingerprint. This MR needs to be merged after this one: konflux-ci/konflux-test#292

All changes have been discussed in the provided Jira tracker.

@konflux-team , we created this as a draft PR in order to gather feedback from you. Would this be acceptable? Is something else needed? ...

Before you complete this pull request ...

Look for any open pull requests in the repository with the title "e2e-tests update" and
see if there are recent e2e-tests updates that will be applicable to your change.

[jperezdealgaba]

@jsztuka Would you mind giving a review for this?

[jperezdealgaba]

@jsztuka Does the 👍🏻 mean that it looks good and nothind needs to be modified?

[jsztuka]

lgtm

[kdudka]

@jsztuka Could you please approve the 6 workflows that are awaiting approval?

[jperezdealgaba]

Will update lint problems in following commit adding false positives filtering...

[jperezdealgaba]

Although the MR is finished, I will look for ProdSec feedback before taking this out from draft.

[kdudka]

@jperezdealgaba I can see that we still print the full SARIF file into the CI log, which is not much user-friendly and it will cause problems on tasks that produce too much results. I would suggest to invoke csgrep --mode=evtstat instead to provide a useful summary for end users. In case we are filtering false positives we can run the command twice to record the number of findings that were excluded from the results.

[jperezdealgaba]

@jperezdealgaba I can see that we still print the full SARIF file into the CI log, which is not much user-friendly and it will cause problems on tasks that produce too much results. I would suggest to invoke csgrep --mode=evtstat instead to provide a useful summary for end users. In case we are filtering false positives we can run the command twice to record the number of findings that were excluded from the results.

@kdudka The SARIF output is no longer shown and the results are shown in evtstat mode. Before and after filtering. Example pipeline is here: https://konflux.apps.stone-prod-p02.hjvn.p1.openshiftapps.com/application-pipeline/workspaces/jperezde/applications/test-coverity/pipelineruns/osh-cli-container-konflux-test-2-on-pull-request-7l7nj (Note: Installation of packages is only for testing until the image contains csdiff)

[jperezdealgaba]

@kdudka I updated the container image, I added the PROJECT_NVR and RECORD_EXCLUDED and updated the upload task

[kdudka]

@jperezdealgaba The latest changes look good.

[jperezdealgaba]

@kdudka FYI: The missing space in this line is being introduced by the *-ta CI pipeline. It seems that some cases are not covered by the script.

[kdudka]

@jperezdealgaba @lcarva @zregvart Why do we maintain two copies of the task description?

• build-definitions/task/sast-snyk-check/0.2/sast-snyk-check.yaml

  Line 12 in 3234271

  Scans source code for security vulnerabilities, including common issues such as SQL injection, cross-site scripting (XSS), and code injection attacks using Snyk Code, a Static Application Security Testing (SAST) tool.

• build-definitions/task/sast-snyk-check-oci-ta/0.2/recipe.yaml

  Line 6 in 3234271

  description: >-

The first paragraph is identical (although formatted differently). The steps to obtain Snyk token and Snyk binary are in the -oci-ta variant of the task only. This does not make any sense because the additional information is related to Snyk itself rather than the -oci-ta variant. Cannot we use the extended description in the base task and remove the override from recipe.yaml completely?

diff --git a/task/sast-snyk-check-oci-ta/0.3/recipe.yaml b/task/sast-snyk-check-oci-ta/0.3/recipe.yaml
index 4a6e4544..afec045d 100644
--- a/task/sast-snyk-check-oci-ta/0.3/recipe.yaml
+++ b/task/sast-snyk-check-oci-ta/0.3/recipe.yaml
@@ -3,23 +3,6 @@ base: ../../sast-snyk-check/0.3/sast-snyk-check.yaml
 add:
   - use-source
   - use-cachi2
-description: >-
-  Scans source code for security vulnerabilities, including common issues such as SQL injection,
-  cross-site scripting (XSS), and code injection attacks using Snyk Code, a Static Application
-  Security Testing (SAST) tool.
-
-
-  Follow the steps given
-  [here](https://redhat-appstudio.github.io/docs.appstudio.io/Documentation/main/how-to-guides/testing_applications/enable_snyk_check_for_a_product/)
-  to obtain a snyk-token and to enable the snyk task in a Pipeline.
-
-
-  The snyk binary used in this Task comes from a container image defined in
-  https://github.com/konflux-ci/konflux-test
-
-
-  See https://snyk.io/product/snyk-code/ and https://snyk.io/ for more information about the snyk
-  tool.
 preferStepTemplate: true
 removeWorkspaces:
   - workspace
diff --git a/task/sast-snyk-check/0.3/sast-snyk-check.yaml b/task/sast-snyk-check/0.3/sast-snyk-check.yaml
index ad0ee3ec..cd82225c 100644
--- a/task/sast-snyk-check/0.3/sast-snyk-check.yaml
+++ b/task/sast-snyk-check/0.3/sast-snyk-check.yaml
@@ -9,7 +9,22 @@ metadata:
   name: sast-snyk-check
 spec:
   description: >-
-    Scans source code for security vulnerabilities, including common issues such as SQL injection, cross-site scripting (XSS), and code injection attacks using Snyk Code, a Static Application Security Testing (SAST) tool.
+    Scans source code for security vulnerabilities, including common issues such as SQL injection,
+    cross-site scripting (XSS), and code injection attacks using Snyk Code, a Static Application
+    Security Testing (SAST) tool.
+
+
+    Follow the steps given
+    [here](https://redhat-appstudio.github.io/docs.appstudio.io/Documentation/main/how-to-guides/testing_applications/enable_snyk_check_for_a_product/)
+    to obtain a snyk-token and to enable the snyk task in a Pipeline.
+
+
+    The snyk binary used in this Task comes from a container image defined in
+    https://github.com/konflux-ci/konflux-test
+
+
+    See https://snyk.io/product/snyk-code/ and https://snyk.io/ for more information about the snyk
+    tool.
   results:
     - description: Tekton task test output.
       name: TEST_OUTPUT

[jperezdealgaba]

@kdudka Just tested it and technically it is possible. It would be one small change to the recipe.yaml. Will wait for an official confirmation to make sure there is not any other reason why this is being handled like that at the moment

[zregvart]

@jperezdealgaba @lcarva @zregvart Why do we maintain two copies of the task description?

@kdudka because the descriptions often differ, if you do not need to modify the description don't specify it in the recipe.yaml and it will be copied from the base task.

[kdudka]

@zregvart Thanks for confirmation! That is exactly what the above patch does.

@jperezdealgaba Could you please apply it in this pull request?

[jperezdealgaba]

@jperezdealgaba Could you please apply it in this pull request?

The changes have been added

[dirgim]

LGTM

[jperezdealgaba]

Just rebased the branch

[jsztuka]

Now is your chance, you can merge it.

[jperezdealgaba]

@jsztuka I tried to merge it but it seems that I don't have access.
P.S.: I rebased again