Feature [New SDK] [OCU-435] Convert PDF reporter to use the new SDK (#…

…708)

* new sdk for the pdf consumer - vendor changes

fix pdf vendor formatting

* convert the pdf consumer into the new SDK

new-components/docker-compose.yaml

@@ -1,5 +1,5 @@
 services:
-  reporter:
+  json-logger-reporter:
     build:
       context: .
       dockerfile: Dockerfile
@@ -12,6 +12,16 @@ services:
     depends_on:
       enricher:
         condition: service_completed_successfully
+  pdf-reporter:
+    build:
+      context: reporters/pdf
+      dockerfile: Dockerfile
+    platform: linux/amd64
+    env_file:
+      - reporters/pdf/.env
+    depends_on:
+      enricher:
+        condition: service_completed_successfully
   enricher:
     build:
       context: .

new-components/reporters/pdf/.env

@@ -0,0 +1,9 @@
+SMITHY_INSTANCE_ID=8d719c1c-c569-4078-87b3-4951bd4012ee
+SMITHY_LOG_LEVEL=debug
+AWS_ACCESS_KEY_ID=''
+AWS_SECRET_ACCESS_KEY=''
+BUCKET_NAME='pdf-consumer-test'
+BUCKET_REGION='eu-north-1'
+SKIP_S3_UPLOAD=false
+SMITHY_STORE_TYPE=postgresql
+SMITHY_REMOTE_STORE_POSTGRES_DSN="postgresql://smithy:smithy1234@findings-db:5432/findings-db?sslmode=disable&connect_timeout=10"

new-components/reporters/pdf/Dockerfile

@@ -0,0 +1,20 @@
+FROM golang:1.23.3 AS builder
+COPY . /workdir
+WORKDIR /workdir
+# Install Playwright CLI with the correct version
+RUN go install github.com/playwright-community/playwright-go/cmd/[email protected]
+# Build your Go application
+RUN GOOS=linux GOARCH=amd64 go build -o /bin/reporter cmd/main.go
+
+# Stage 3: Final image
+FROM ubuntu:22.04
+
+COPY --from=builder /bin/reporter /
+COPY --from=builder /go/ /go/
+
+RUN apt-get update
+RUN apt-get install -y ca-certificates tzdata
+RUN ./go/bin/playwright install chromium --with-deps
+RUN rm -rf /var/lib/apt/lists/*
+
+CMD ["/reporter"]

new-components/reporters/pdf/README.md

@@ -0,0 +1,39 @@
+# PDF
+
+This component implements
+a [reporter](https://github.com/smithy-security/smithy/blob/main/sdk/component/component.go)
+that prints vulnerability findings into a PDF and uploads it to an AWS
+S3 bucket.
+
+## Environment variables
+
+The component uses environment variables for configuration.
+
+It requires the component
+environment variables defined
+[here](https://github.com/smithy-security/smithy/blob/main/sdk/README.md#component)
+as the following:
+
+| Environment Variable  | Type   | Required | Default | Description                                                          |
+|-----------------------|--------|----------|---------|----------------------------------------------------------------------|
+| AWS\_ACCESS\_KEY\_ID     | string | yes      | -       | Your S3 access key ID for a user that has write access to the bucket |
+| AWS\_SECRET\_ACCESS\_KEY | string | yes      | -       | Your S3 access key for a user that has write access to the bucket    |
+| BUCKET\_NAME           | string | yes      | -       | Your S3 bucket name, e.g. "test-bucket"                              |
+| BUCKET\_REGION         | string | yes      | -       | Your S3 bucket region, e.g. "us-west-1"                              |
+
+On AWS, you will need a new IAM user with programmatic access and
+with write permissions for your S3 bucket.
+
+## How to run
+
+Execute:
+
+```shell
+docker-compose up --build --force-recreate --remove-orphans
+```
+
+Then shutdown with:
+
+```shell
+docker-compose down --rmi all
+```

new-components/reporters/pdf/cmd/main.go

@@ -0,0 +1,40 @@
+package main
+
+import (
+	"context"
+	"log"
+	"time"
+
+	"github.com/go-errors/errors"
+
+	"github.com/smithy-security/smithy/new-components/reporters/pdf/internal/reporter"
+	"github.com/smithy-security/smithy/sdk/component"
+)
+
+func main() {
+	ctx, cancel := context.WithTimeout(context.Background(), 1*time.Minute)
+	defer cancel()
+
+	if err := Main(ctx); err != nil {
+		log.Fatalf("unexpected error: %v", err)
+	}
+}
+
+func Main(ctx context.Context, opts ...component.RunnerOption) error {
+	conf, err := reporter.NewConf(nil)
+	if err != nil {
+		return errors.Errorf("could not create new configuration: %w", err)
+	}
+
+	opts = append(opts, component.RunnerWithComponentName("pdf"))
+
+	if err := component.RunReporter(
+		ctx,
+		reporter.NewReporter(conf),
+		opts...,
+	); err != nil {
+		return errors.Errorf("could not run reporter: %w", err)
+	}
+
+	return nil
+}

new-components/reporters/pdf/docker-compose.yaml

@@ -0,0 +1,11 @@
+services:
+  reporter:
+    build:
+      context: .
+      dockerfile: Dockerfile
+      args:
+        - COMPONENT_PATH=reporters/pdf
+        - COMPONENT_BINARY_SOURCE_PATH=cmd/main.go
+    platform: linux/amd64
+    env_file:
+      - .env

new-components/reporters/pdf/go.mod

@@ -0,0 +1,70 @@
+module github.com/smithy-security/smithy/new-components/reporters/pdf
+
+go 1.23.3
+
+require (
+	github.com/go-errors/errors v1.5.1
+	github.com/smithy-security/pkg/env v0.0.1
+	github.com/smithy-security/smithy v0.59.2
+	github.com/smithy-security/smithy/sdk v0.0.4-alpha
+	github.com/stretchr/testify v1.9.0
+	google.golang.org/protobuf v1.36.3
+)
+
+require (
+	ariga.io/atlas v0.29.0 // indirect
+	github.com/Masterminds/goutils v1.1.1 // indirect
+	github.com/Masterminds/semver/v3 v3.2.1 // indirect
+	github.com/Masterminds/sprig/v3 v3.2.3 // indirect
+	github.com/abice/go-enum v0.6.0 // indirect
+	github.com/agext/levenshtein v1.2.3 // indirect
+	github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
+	github.com/aws/aws-sdk-go v1.17.7 // indirect
+	github.com/bmatcuk/doublestar v1.3.4 // indirect
+	github.com/cpuguy83/go-md2man/v2 v2.0.3 // indirect
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/deckarep/golang-set/v2 v2.7.0 // indirect
+	github.com/go-jose/go-jose/v3 v3.0.3 // indirect
+	github.com/go-openapi/inflect v0.19.0 // indirect
+	github.com/go-stack/stack v1.8.1 // indirect
+	github.com/golang/mock v1.6.0 // indirect
+	github.com/google/go-cmp v0.6.0 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/hashicorp/hcl/v2 v2.18.1 // indirect
+	github.com/huandu/xstrings v1.4.0 // indirect
+	github.com/imdario/mergo v0.3.13 // indirect
+	github.com/jackc/pgpassfile v1.0.0 // indirect
+	github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a // indirect
+	github.com/jackc/pgx/v5 v5.6.0 // indirect
+	github.com/jmespath/go-jmespath v0.4.0 // indirect
+	github.com/jonboulle/clockwork v0.4.0 // indirect
+	github.com/labstack/gommon v0.4.1 // indirect
+	github.com/mattn/go-colorable v0.1.13 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-sqlite3 v1.14.24 // indirect
+	github.com/mattn/goveralls v0.0.12 // indirect
+	github.com/mitchellh/copystructure v1.2.0 // indirect
+	github.com/mitchellh/go-wordwrap v1.0.1 // indirect
+	github.com/mitchellh/reflectwalk v1.0.2 // indirect
+	github.com/playwright-community/playwright-go v0.4901.0 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/russross/blackfriday/v2 v2.1.0 // indirect
+	github.com/shopspring/decimal v1.3.1 // indirect
+	github.com/spf13/cast v1.5.0 // indirect
+	github.com/sqlc-dev/sqlc v1.27.0 // indirect
+	github.com/urfave/cli/v2 v2.26.0 // indirect
+	github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673 // indirect
+	github.com/zclconf/go-cty v1.14.4 // indirect
+	go.uber.org/mock v0.5.0 // indirect
+	golang.org/x/crypto v0.24.0 // indirect
+	golang.org/x/mod v0.18.0 // indirect
+	golang.org/x/net v0.26.0 // indirect
+	golang.org/x/sync v0.8.0 // indirect
+	golang.org/x/sys v0.22.0 // indirect
+	golang.org/x/text v0.16.0 // indirect
+	golang.org/x/tools v0.22.0 // indirect
+	golang.org/x/tools/cmd/cover v0.1.0-deprecated // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20240528184218-531527333157 // indirect
+	google.golang.org/grpc v1.65.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+)