integrationutils.go

//go:build integration

package main

import (
	"context"
	"fmt"
	"os"
	"strconv"
	"strings"
	"testing"
	"time"

	"github.com/go-git/go-git/v5"

	githttp "github.com/go-git/go-git/v5/plumbing/transport/http"
	"github.com/jfrog/froggit-go/vcsclient"
	"github.com/jfrog/froggit-go/vcsutils"
	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"

	"github.com/jfrog/frogbot/v3/scanpullrequest"
	"github.com/jfrog/frogbot/v3/scanrepository"
	"github.com/jfrog/frogbot/v3/utils"
	"github.com/jfrog/frogbot/v3/utils/outputwriter"
)

const (
	repoName                      = "frogbot-test"
	issuesBranch                  = "issues-branch"
	mainBranch                    = "main"
	gitUsername                   = "frogbot-e2e-test"
	expectedNumberOfIssues        = 10
	scanRepoTestBranchNamePrefix  = "frogbot-"
	scanPrTestAddedVulnDependency = "axios:0.21.1"
	cveCommentPrefix              = "CVE-"
)

type IntegrationTestDetails struct {
	RepoName         string
	RepoOwner        string
	GitToken         string
	GitCloneURL      string
	GitProvider      string
	GitProject       string
	GitUsername      string
	GitPushUsername  string
	ApiEndpoint      string
	PullRequestID    string
	CustomBranchName string
}

func (d *IntegrationTestDetails) gitPushUsername() string {
	if d.GitPushUsername != "" {
		return d.GitPushUsername
	}
	return d.GitUsername
}

func NewIntegrationTestDetails(token, gitProvider, gitCloneUrl, repoOwner string) *IntegrationTestDetails {
	return &IntegrationTestDetails{
		GitProject:  repoName,
		RepoOwner:   repoOwner,
		RepoName:    repoName,
		GitToken:    token,
		GitUsername: gitUsername,
		GitProvider: gitProvider,
		GitCloneURL: gitCloneUrl,
	}
}

func buildGitManager(t *testing.T, testDetails *IntegrationTestDetails) *utils.GitManager {
	gitManager, err := utils.NewGitManager().
		SetAuth(testDetails.gitPushUsername(), testDetails.GitToken).
		SetRemoteGitUrl(testDetails.GitCloneURL)
	assert.NoError(t, err)
	return gitManager
}

func getIssuesBranchName() string {
	return fmt.Sprintf("%s-%s", issuesBranch, getTimestamp())
}

func getTimestamp() string {
	return strconv.FormatInt(time.Now().Unix(), 10)
}

func setIntegrationTestEnvs(t *testing.T, testDetails *IntegrationTestDetails) func() {
	// Frogbot sanitizes all the environment variables that start with 'JF',
	// so we restore them at the end of the test to avoid collisions with other tests
	envRestoreFunc := getJfrogEnvRestoreFunc(t)
	unsetEnvs := utils.SetEnvsAndAssertWithCallback(t, map[string]string{
		utils.GitPullRequestIDEnv:     testDetails.PullRequestID,
		utils.GitProvider:             testDetails.GitProvider,
		utils.GitTokenEnv:             testDetails.GitToken,
		utils.GitRepoEnv:              testDetails.RepoName,
		utils.GitRepoOwnerEnv:         testDetails.RepoOwner,
		utils.GitApiEndpointEnv:       testDetails.ApiEndpoint,
		utils.GitAzureProjectEnv:      testDetails.GitProject,
		utils.GitBitBucketUsernameEnv: testDetails.GitUsername,
		utils.GitBaseBranchEnv:        mainBranch,
	})
	return func() {
		envRestoreFunc()
		unsetEnvs()
	}
}

func createAndCheckoutIssueBranch(t *testing.T, testDetails *IntegrationTestDetails, tmpDir, currentIssuesBranch string) func() {
	gitManager := buildGitManager(t, testDetails)
	// buildGitManager in an empty directory automatically creates a default .git folder, which prevents cloning.
	// So we remove the default .git and clone the repository with its .git content
	err := vcsutils.RemoveTempDir(".git")
	require.NoError(t, err)

	err = gitManager.Clone(tmpDir, issuesBranch)
	require.NoError(t, err)

	err = gitManager.CreateBranchAndCheckout(currentIssuesBranch, false)
	require.NoError(t, err)

	// This step is necessary because GitHub limits the number of pull requests from the same commit of the source branch
	_, err = os.Create("emptyfile.txt")
	assert.NoError(t, err)
	err = gitManager.AddAllAndCommit("emptyfile added", "")
	assert.NoError(t, err)

	err = gitManager.Push(false, currentIssuesBranch)
	require.NoError(t, err)
	return func() {
		// Remove the branch from remote
		err := gitManager.RemoveRemoteBranch(currentIssuesBranch)
		assert.NoError(t, err)
	}
}

func findRelevantPrID(pullRequests []vcsclient.PullRequestInfo, branch string) (prId int) {
	for _, pr := range pullRequests {
		if pr.Source.Name == branch && pr.Target.Name == mainBranch {
			prId = int(pr.ID)
			return
		}
	}
	return
}

func findRelevantPrIDByBranchPrefix(pullRequests []vcsclient.PullRequestInfo, branchPrefix string, preExistingPrIDs map[int]bool) (prId int, branchName string) {
	for _, pr := range pullRequests {
		if strings.HasPrefix(pr.Source.Name, branchPrefix) && pr.Target.Name == mainBranch && !preExistingPrIDs[int(pr.ID)] {
			return int(pr.ID), pr.Source.Name
		}
	}
	return 0, ""
}

func getOpenPullRequests(t *testing.T, client vcsclient.VcsClient, testDetails *IntegrationTestDetails) []vcsclient.PullRequestInfo {
	ctx := context.Background()
	pullRequests, err := client.ListOpenPullRequests(ctx, testDetails.RepoOwner, testDetails.RepoName)
	require.NoError(t, err)
	return pullRequests
}

func runScanPullRequestCmd(t *testing.T, client vcsclient.VcsClient, testDetails *IntegrationTestDetails) {
	// Change working dir to temp dir for cloning and branch checkout
	tmpDir, restoreFunc := utils.ChangeToTempDirWithCallback(t)
	defer func() {
		assert.NoError(t, restoreFunc())
	}()

	// Get a timestamp based issues-branch
	currentIssuesBranch := getIssuesBranchName()
	removeBranchFunc := createAndCheckoutIssueBranch(t, testDetails, tmpDir, currentIssuesBranch)
	defer removeBranchFunc()

	ctx := context.Background()
	// Create a pull request from the timestamp based issue branch against the main branch
	err := client.CreatePullRequest(ctx, testDetails.RepoOwner, testDetails.RepoName, currentIssuesBranch, mainBranch, "scan pull request integration test", "")
	require.NoError(t, err)

	// Find the relevant pull request id
	pullRequests := getOpenPullRequests(t, client, testDetails)
	prId := findRelevantPrID(pullRequests, currentIssuesBranch)
	testDetails.PullRequestID = strconv.Itoa(prId)
	defer func() {
		if prId != 0 {
			closePullRequest(t, client, testDetails, prId)
		}
	}()
	require.NotZero(t, prId)

	// Set the required environment variables for the scan-pull-request command
	unsetEnvs := setIntegrationTestEnvs(t, testDetails)
	defer unsetEnvs()

	err = Exec(&scanpullrequest.ScanPullRequestCmd{}, utils.ScanPullRequest)
	// Validate that no error is returned
	require.NoError(t, err)

	validateResults(t, ctx, client, testDetails, prId)
}

func runScanRepositoryCmd(t *testing.T, client vcsclient.VcsClient, testDetails *IntegrationTestDetails) {
	testTempDir, restoreFunc := utils.ChangeToTempDirWithCallback(t)
	defer func() {
		assert.NoError(t, restoreFunc())
	}()

	cloneOptions := &git.CloneOptions{
		URL: testDetails.GitCloneURL,
		Auth: &githttp.BasicAuth{
			Username: testDetails.gitPushUsername(),
			Password: testDetails.GitToken,
		},
		RemoteName:    "origin",
		ReferenceName: utils.GetFullBranchName("main"),
		SingleBranch:  true,
		Depth:         1,
		Tags:          git.NoTags,
	}
	_, err := git.PlainClone(testTempDir, false, cloneOptions)
	require.NoError(t, err)

	// Set the required environment variables for the scan-repository command
	unsetEnvs := setIntegrationTestEnvs(t, testDetails)
	defer unsetEnvs()

	gitManager := buildGitManager(t, testDetails)
	defer cleanupLeftoverFrogbotPRs(t, client, testDetails, gitManager)

	preExistingPrIDs := make(map[int]bool)
	for _, pr := range getOpenPullRequests(t, client, testDetails) {
		preExistingPrIDs[int(pr.ID)] = true
	}

	err = Exec(&scanrepository.ScanRepositoryCmd{}, utils.ScanRepository)
	require.NoError(t, err)

	pullRequests := getOpenPullRequests(t, client, testDetails)

	expectedFixPackages := []string{"snyk", "lodash", "minimist"}
	for _, pkg := range expectedFixPackages {
		branchPrefix := scanRepoTestBranchNamePrefix + pkg + "-"
		prId, branchName := findRelevantPrIDByBranchPrefix(pullRequests, branchPrefix, preExistingPrIDs)
		assert.NotZero(t, prId, "Expected to find PR for package %s", pkg)
		if prId != 0 {
			closePullRequest(t, client, testDetails, prId)
			assert.NoError(t, gitManager.RemoveRemoteBranch(branchName))
		}
	}
}

func cleanupLeftoverFrogbotPRs(t *testing.T, client vcsclient.VcsClient, testDetails *IntegrationTestDetails, gitManager *utils.GitManager) {
	remainingPRs := getOpenPullRequests(t, client, testDetails)
	for _, pr := range remainingPRs {
		if strings.HasPrefix(pr.Source.Name, scanRepoTestBranchNamePrefix) {
			t.Logf("Cleaning up leftover frogbot PR: %s (ID: %d)", pr.Source.Name, pr.ID)
			closePullRequest(t, client, testDetails, int(pr.ID))
			if err := gitManager.RemoveRemoteBranch(pr.Source.Name); err != nil {
				t.Logf("Warning: failed to remove leftover branch %s: %v", pr.Source.Name, err)
			}
		}
	}
}

// A safety-net sweep, run as a separate CI step regardless of test outcome, and removes every branch and closes every open PR in the test repo,
// except the default branch and the 'issues-branch' baseline.
func cleanupIntegrationArtifacts(t *testing.T, client vcsclient.VcsClient, testDetails *IntegrationTestDetails) {
	ctx := context.Background()

	// buildGitManager reads the remote URL from the current directory's existing .git if one is
	// present (e.g. this job's own checkout of the frogbot repo), so we must clone the fixture repo
	// into a fresh directory first - otherwise branch removal silently targets the wrong remote.
	tmpDir, restoreFunc := utils.ChangeToTempDirWithCallback(t)
	defer func() {
		assert.NoError(t, restoreFunc())
	}()

	cloneOptions := &git.CloneOptions{
		URL: testDetails.GitCloneURL,
		Auth: &githttp.BasicAuth{
			Username: testDetails.gitPushUsername(),
			Password: testDetails.GitToken,
		},
		RemoteName:    "origin",
		ReferenceName: utils.GetFullBranchName(mainBranch),
		SingleBranch:  true,
		Depth:         1,
		Tags:          git.NoTags,
	}
	_, err := git.PlainClone(tmpDir, false, cloneOptions)
	require.NoError(t, err)

	gitManager := buildGitManager(t, testDetails)

	branches, err := client.ListBranches(ctx, testDetails.RepoOwner, testDetails.RepoName)
	require.NoError(t, err)
	for _, branch := range branches {
		if branch == mainBranch || branch == issuesBranch {
			continue
		}
		t.Logf("Cleanup: removing leftover branch %s", branch)
		if err := gitManager.RemoveRemoteBranch(branch); err != nil {
			t.Logf("Warning: failed to remove leftover branch %s: %v", branch, err)
		}
	}

	for _, pr := range getOpenPullRequests(t, client, testDetails) {
		if pr.Source.Name == issuesBranch {
			continue
		}
		t.Logf("Cleanup: closing leftover PR %s (ID: %d)", pr.Source.Name, pr.ID)
		closePullRequest(t, client, testDetails, int(pr.ID))
	}
}

func validateResults(t *testing.T, ctx context.Context, client vcsclient.VcsClient, testDetails *IntegrationTestDetails, prID int) {
	comments, err := client.ListPullRequestComments(ctx, testDetails.RepoOwner, testDetails.RepoName, prID)
	require.NoError(t, err)

	switch client.(type) {
	case *vcsclient.GitHubClient:
		validateGitHubComments(t, comments)
	case *vcsclient.AzureReposClient:
		validateAzureComments(t, comments)
	case *vcsclient.BitbucketServerClient:
		validateBitbucketServerComments(t, comments)
	case *vcsclient.BitbucketCloudClient:
		validateBitbucketCloudComments(t, comments)
	case *vcsclient.GitLabClient:
		validateGitLabComments(t, comments)
	}
}

func validateGitHubComments(t *testing.T, comments []vcsclient.CommentInfo) {
	assert.True(t, containsCommentMentioning(comments, string(outputwriter.VulnerabilitiesPrBannerSource)),
		"expected a PR comment containing the Frogbot banner")
	assert.True(t, containsCommentMentioning(comments, scanPrTestAddedVulnDependency),
		"expected a PR comment mentioning the vulnerable dependency "+scanPrTestAddedVulnDependency)
	assert.True(t, containsCommentMentioning(comments, cveCommentPrefix),
		"expected a PR comment with CVE findings")
}

func containsCommentMentioning(comments []vcsclient.CommentInfo, text string) bool {
	for _, c := range comments {
		if strings.Contains(c.Content, text) {
			return true
		}
	}
	return false
}

func validateAzureComments(t *testing.T, comments []vcsclient.CommentInfo) {
	assert.GreaterOrEqual(t, len(comments), expectedNumberOfIssues)
	assertBannerExists(t, comments, string(outputwriter.VulnerabilitiesPrBannerSource))
}

func validateBitbucketServerComments(t *testing.T, comments []vcsclient.CommentInfo) {
	assert.GreaterOrEqual(t, len(comments), expectedNumberOfIssues)
	assertBannerExists(t, comments, outputwriter.GetSimplifiedTitle(outputwriter.VulnerabilitiesPrBannerSource))
}

func validateBitbucketCloudComments(t *testing.T, comments []vcsclient.CommentInfo) {
	assert.True(t, containsCommentMentioning(comments, outputwriter.GetSimplifiedTitle(outputwriter.VulnerabilitiesPrBannerSource)),
		"expected a PR comment containing the Frogbot banner")
	assert.True(t, containsCommentMentioning(comments, scanPrTestAddedVulnDependency),
		"expected a PR comment mentioning the vulnerable dependency "+scanPrTestAddedVulnDependency)
	assert.True(t, containsCommentMentioning(comments, cveCommentPrefix),
		"expected a PR comment with CVE findings")
}

func validateGitLabComments(t *testing.T, comments []vcsclient.CommentInfo) {
	assert.True(t, containsCommentMentioning(comments, string(outputwriter.VulnerabilitiesMrBannerSource)),
		"expected a MR comment containing the Frogbot banner")
	assert.True(t, containsCommentMentioning(comments, scanPrTestAddedVulnDependency),
		"expected a MR comment mentioning the vulnerable dependency "+scanPrTestAddedVulnDependency)
	assert.True(t, containsCommentMentioning(comments, cveCommentPrefix),
		"expected a MR comment with CVE findings")
}

func getJfrogEnvRestoreFunc(t *testing.T) func() {
	jfrogEnvs := make(map[string]string)
	for _, env := range os.Environ() {
		envSplit := strings.Split(env, "=")
		key := envSplit[0]
		val := envSplit[1]
		if strings.HasPrefix(key, "JF_") {
			jfrogEnvs[key] = val
		}
	}

	return func() {
		for key, val := range jfrogEnvs {
			assert.NoError(t, os.Setenv(key, val))
		}
	}
}

// This function retrieves the relevant VCS provider access token based on the corresponding environment variable.
// If the environment variable is empty, the test is skipped.
func getIntegrationToken(t *testing.T, tokenEnv string) string {
	integrationRepoToken := os.Getenv(tokenEnv)
	if integrationRepoToken == "" {
		t.Skipf("%s is not set, skipping integration test", tokenEnv)
	}
	return integrationRepoToken
}

func assertBannerExists(t *testing.T, comments []vcsclient.CommentInfo, banner string) {
	var isContains bool
	var occurrences int
	for _, c := range comments {
		if strings.Contains(c.Content, banner) {
			isContains = true
			occurrences++
		}
	}

	assert.True(t, isContains)
	assert.Equal(t, 1, occurrences)
}

func closePullRequest(t *testing.T, client vcsclient.VcsClient, testDetails *IntegrationTestDetails, prID int) {
	targetBranch := mainBranch
	if _, isAzureClient := client.(*vcsclient.AzureReposClient); isAzureClient {
		// The Azure API requires not adding parameters that won't be updated, so we omit the targetBranch in that case
		targetBranch = ""
	}
	err := client.UpdatePullRequest(context.Background(), testDetails.RepoOwner, testDetails.RepoName, "integration test finished", "", targetBranch, prID, vcsutils.Closed)
	assert.NoError(t, err)
}