70 lines
2.8 KiB
Bash
70 lines
2.8 KiB
Bash
#!/usr/bin/env bash
|
|
set -uo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
source "$SCRIPT_DIR/casan-paths.sh"
|
|
ROOT="$CASAN_APP_ROOT"
|
|
MANIFEST_TOOL="$SCRIPT_DIR/project_manifest.py"
|
|
PASS=0 FAIL=0 SKIP=0
|
|
|
|
manifest_args=(--root "$ROOT")
|
|
[[ -n "${CASAN_PROJECT_MANIFEST:-}" ]] && manifest_args+=(--manifest "$CASAN_PROJECT_MANIFEST")
|
|
[[ -n "${CASAN_PROJECT_ID:-}" ]] && manifest_args+=(--project "$CASAN_PROJECT_ID")
|
|
|
|
run() {
|
|
local name="$1"; shift
|
|
echo "==> $name"
|
|
if "$@"; then
|
|
echo "PROJECT_GATE_PASS $name"; PASS=$((PASS + 1))
|
|
else
|
|
echo "PROJECT_GATE_FAIL $name" >&2; FAIL=$((FAIL + 1))
|
|
fi
|
|
}
|
|
|
|
run "manifest" python3 "$MANIFEST_TOOL" validate "${manifest_args[@]}"
|
|
if [[ "$FAIL" -ne 0 ]]; then
|
|
echo "PROJECT_GATE_SUMMARY PASS=$PASS FAIL=$FAIL SKIP=$SKIP"
|
|
exit 1
|
|
fi
|
|
|
|
project_id="$(python3 "$MANIFEST_TOOL" get "${manifest_args[@]}" --field project_id)"
|
|
requirements="$(python3 "$MANIFEST_TOOL" get "${manifest_args[@]}" --field requirements)"
|
|
architecture="$(python3 "$MANIFEST_TOOL" get "${manifest_args[@]}" --field architecture)"
|
|
domain_root="$(python3 "$MANIFEST_TOOL" domain-root "${manifest_args[@]}")"
|
|
evidence_dir="$ROOT/docs/output/casan/$project_id/project-gate"
|
|
mkdir -p "$evidence_dir"
|
|
|
|
run "requirement-security" bash "$SCRIPT_DIR/artifact-scan.sh" "$ROOT/$requirements" "$project_id-requirements"
|
|
run "architecture-security" bash "$SCRIPT_DIR/artifact-scan.sh" "$ROOT/$architecture" "$project_id-architecture"
|
|
if [[ "${CASAN_PROJECT_GATE_RUN_CORPUS:-1}" == "1" ]]; then
|
|
run "corpus-quality" env CASAN_DOMAIN_ROOT="$domain_root" bash "$SCRIPT_DIR/benign-fp-report.sh" "$evidence_dir/benign-fp-report.json"
|
|
else
|
|
echo "PROJECT_GATE_SKIP corpus-quality"; SKIP=$((SKIP + 1))
|
|
fi
|
|
run "traceability" python3 "$SCRIPT_DIR/traceability-matrix.py" \
|
|
--requirements "$ROOT/$requirements" \
|
|
--map "$domain_root/traceability-map.json" \
|
|
--out "$evidence_dir/traceability-matrix.json" --gate
|
|
|
|
if [[ "${CASAN_PROJECT_GATE_RUN_BUILD:-1}" == "1" ]]; then
|
|
run "build" python3 "$MANIFEST_TOOL" run "${manifest_args[@]}" --kind build
|
|
else
|
|
echo "PROJECT_GATE_SKIP build"; SKIP=$((SKIP + 1))
|
|
fi
|
|
if [[ "${CASAN_PROJECT_GATE_RUN_TEST:-1}" == "1" ]]; then
|
|
run "test" python3 "$MANIFEST_TOOL" run "${manifest_args[@]}" --kind test
|
|
else
|
|
echo "PROJECT_GATE_SKIP test"; SKIP=$((SKIP + 1))
|
|
fi
|
|
|
|
python3 - "$evidence_dir/summary.json" "$project_id" "$PASS" "$FAIL" "$SKIP" <<'PY'
|
|
import json, sys
|
|
path, project, passed, failed, skipped = sys.argv[1:]
|
|
with open(path, "w", encoding="utf-8") as handle:
|
|
json.dump({"project_id": project, "pass": int(passed), "fail": int(failed), "skip": int(skipped), "accepted": int(failed) == 0}, handle, indent=2)
|
|
handle.write("\n")
|
|
PY
|
|
|
|
echo "PROJECT_GATE_SUMMARY project=$project_id PASS=$PASS FAIL=$FAIL SKIP=$SKIP evidence=$evidence_dir"
|
|
[[ "$FAIL" -eq 0 ]]
|