all phases complete!

2026-04-19 22:52:02 -06:00
parent a9224a41c1
commit aa907060a4
5 changed files with 254 additions and 16 deletions
@@ -0,0 +1,66 @@
+{{- if .Values.pipeline.enabled }}
+apiVersion: argoproj.io/v1alpha1
+kind: ClusterWorkflowTemplate
+metadata:
+  name: amp-security-pipeline-v1.0.0
+spec:
+  templates:
+    - name: upload-defectdojo
+      container:
+        image: python:3.12-alpine
+        env:
+          - name: DEFECTDOJO_URL
+            valueFrom:
+              secretKeyRef:
+                name: amp-security-pipeline-secrets
+                key: DEFECTDOJO_URL
+          - name: DEFECTDOJO_API_TOKEN
+            valueFrom:
+              secretKeyRef:
+                name: amp-security-pipeline-secrets
+                key: DEFECTDOJO_API_TOKEN
+        command:
+          - sh
+          - -c
+        args:
+          - |
+            set -eu
+            python - <<'PY'
+            import json
+            import os
+            import pathlib
+            import urllib.request
+
+            base_url = os.environ["DEFECTDOJO_URL"].rstrip("/")
+            api_token = os.environ["DEFECTDOJO_API_TOKEN"]
+            product_name = os.environ.get("DEFECTDOJO_PRODUCT_NAME", "agentguard-ci")
+            scan_map = {
+                ".sarif": "SARIF",
+                ".json": "Generic Findings Import",
+            }
+            reports_dir = pathlib.Path("/workspace/reports")
+            for report in sorted(reports_dir.iterdir()):
+                if not report.is_file():
+                    continue
+                scan_type = scan_map.get(report.suffix)
+                if not scan_type:
+                    continue
+                req = urllib.request.Request(
+                    f"{base_url}/api/v2/import-scan/",
+                    data=json.dumps({
+                        "scan_type": scan_type,
+                        "product_name": product_name,
+                        "file_name": report.name,
+                    }).encode(),
+                    headers={
+                        "Authorization": f"Token {api_token}",
+                        "Content-Type": "application/json",
+                    },
+                    method="POST",
+                )
+                urllib.request.urlopen(req)
+            PY
+      volumeMounts:
+        - name: workspace
+          mountPath: /workspace
+{{- end }}