sast-snyk-check: increased version to 0.3

[jperezdealgaba]

Resolves: https://issues.redhat.com/browse/OSH-737

In this version, the severity-threshold argument is introduced and enabled by default to high and the results are parsed with csgrep to be uploaded with the fingerprint. This MR needs to be merged after this one: konflux-ci/konflux-test#292

All changes have been discussed in the provided Jira tracker.

@konflux-team , we created this as a draft PR in order to gather feedback from you. Would this be acceptable? Is something else needed? ...

Before you complete this pull request ...

Look for any open pull requests in the repository with the title "e2e-tests update" and
see if there are recent e2e-tests updates that will be applicable to your change.

[jperezdealgaba]

@jsztuka Would you mind giving a review for this?

[jperezdealgaba]

@jsztuka Does the 👍🏻 mean that it looks good and nothind needs to be modified?

[jsztuka]

lgtm

[kdudka]

@jsztuka Could you please approve the 6 workflows that are awaiting approval?

[jperezdealgaba]

Will update lint problems in following commit adding false positives filtering...

[jperezdealgaba]

Although the MR is finished, I will look for ProdSec feedback before taking this out from draft.

[kdudka]

@jperezdealgaba I can see that we still print the full SARIF file into the CI log, which is not much user-friendly and it will cause problems on tasks that produce too much results. I would suggest to invoke csgrep --mode=evtstat instead to provide a useful summary for end users. In case we are filtering false positives we can run the command twice to record the number of findings that were excluded from the results.

[jperezdealgaba]

@jperezdealgaba I can see that we still print the full SARIF file into the CI log, which is not much user-friendly and it will cause problems on tasks that produce too much results. I would suggest to invoke csgrep --mode=evtstat instead to provide a useful summary for end users. In case we are filtering false positives we can run the command twice to record the number of findings that were excluded from the results.

@kdudka The SARIF output is no longer shown and the results are shown in evtstat mode. Before and after filtering. Example pipeline is here: https://konflux.apps.stone-prod-p02.hjvn.p1.openshiftapps.com/application-pipeline/workspaces/jperezde/applications/test-coverity/pipelineruns/osh-cli-container-konflux-test-2-on-pull-request-7l7nj (Note: Installation of packages is only for testing until the image contains csdiff)

[jperezdealgaba]

@kdudka I updated the container image, I added the PROJECT_NVR and RECORD_EXCLUDED and updated the upload task

[kdudka]

I think the extra step with csgrep --prepend-path-prefix=... is unnecessary. It should be sufficient to run csgrep --embed-context=... in the correct directory:

(cd "$SOURCE_CODE_DIR" && csgrep --mode=json --embed-context=3 sast_snyk_check_out.json) \
    csgrep --mode=json --strip-path-prefix="source/"  \
    > sast_snyk_check_out_all_findings.json

[jperezdealgaba]

Modified

[jperezdealgaba]

Just in case, the path of the sast_snyk_check_out.json file was modified as it couldn't be found after we executed the commands on the SOURCE_CODE_DIR

[kdudka]

Right. I should have used an absolute path to the input file in my example.

[jperezdealgaba]

This doesn't match the description from the task parameter. I will update it in a bit...