vulnerability_alerts.exs

Mix.install([
  {:jason, "~> 1.2"},
  {:neuron, "~> 5.0.0"},
  {:httpoison, "~> 1.8"}
])

defmodule VulnerabilityAlerts do

  # second naming is for easier local testing
  @github_token System.get_env("INPUT_GITHUB-TOKEN") || System.get_env("INPUT_GITHUB_TOKEN")
  @github_repository System.get_env("INPUT_GITHUB-REPOSITORY") || System.get_env("INPUT_GITHUB_REPOSITORY")
  @slack_token System.get_env("INPUT_SLACK-TOKEN") || System.get_env("INPUT_SLACK_TOKEN")
  @slack_channel System.get_env("INPUT_SLACK-CHANNEL") || System.get_env("INPUT_SLACK_CHANNEL")

  def run do
    @github_repository
    |> build_query()
    |> request()
    |> handle_response()
    |> post_to_slack()
  end

  defp build_query(full_name) do
    [owner, name] = String.split(full_name, "/")

    """
    {
      repository(owner: "#{owner}", name: "#{name}") {
        nameWithOwner
        vulnerabilityAlerts(first: 100, states: OPEN) {
          nodes {
            fixedAt
            dismissedAt
            state
            vulnerableRequirements
            securityVulnerability {
              advisory {
                severity
                summary
                notificationsPermalink
              }
              package {
                name
                ecosystem
              }
              firstPatchedVersion {
                identifier
              }
            }
          }
        }
      }
    }
    """
  end

  defp request(query) do
    Neuron.query(query, %{},
      url: "https://api.github.com/graphql",
      headers: [Accept: "application/vnd.github.hawkgirl-preview+json", authorization: "Bearer #{@github_token}"]
    )
  end

  defp handle_response({:ok, %Neuron.Response{body: body}}) do
    full_name = body["data"]["repository"]["nameWithOwner"]
    body["data"]["repository"]["vulnerabilityAlerts"]["nodes"]
    |> Enum.reduce([], fn vulnerability_alert, acc ->
      va = %{
        package: %{name: vulnerability_alert["securityVulnerability"]["package"]["name"], ecosystem: vulnerability_alert["securityVulnerability"]["package"]["ecosystem"]},
        vulnerable_requirements: vulnerability_alert["vulnerableRequirements"],
        notifications_permalink: vulnerability_alert["securityVulnerability"]["advisory"]["notificationsPermalink"],
        summary: vulnerability_alert["securityVulnerability"]["advisory"]["summary"],
        severity: vulnerability_alert["securityVulnerability"]["advisory"]["severity"],
        first_patched_version: vulnerability_alert["securityVulnerability"]["firstPatchedVersion"]["identifier"],
        resolve_issue_url: resolve_issue_url(full_name, vulnerability_alert["securityVulnerability"]["package"]),
        dismissed_at: parse_datetime(vulnerability_alert["dismissedAt"]),
        fixed_at: parse_datetime(vulnerability_alert["fixedAt"]),
        state: vulnerability_alert["state"]
      }
      [va | acc]
    end)
  end

  defp resolve_issue_url(full_name, %{"ecosystem" => "RUBYGEMS", "name" => name}) do
    "https://github.com/#{full_name}/security/dependabot/Gemfile.lock/#{name}/open"
  end

  defp resolve_issue_url(full_name, %{"ecosystem" => "NPM", "name" => name}) do
    "https://github.com/#{full_name}/security/dependabot/yarn.lock/#{name}/open"
  end

  defp resolve_issue_url(_full_name, _package), do: nil

  defp post_to_slack([]), do: IO.puts("Great, no vulnerabilities! Nothing to do here.")

  defp post_to_slack(vulnerabilities) do
    vulnerabilities
    |> slack_message_text()
    |> do_post_to_slack()
  end

  defp do_post_to_slack(text) do
    {:ok, _} = HTTPoison.post("https://slack.com/api/chat.postMessage", Jason.encode!(%{channel: @slack_channel, text: text, type: "mrkdwn"}), [{"Authorization","Bearer #{@slack_token}"}, {"Content-Type", "application/json"}])
  end

  defp slack_message_text(vulnerabilities) do
    vulnerabilities
    |> Enum.group_by(& &1.package.name)
    |> Enum.reduce(["⚠️ Vulnerability alert!\nI found some vulnerabilities in <https://github.com/#{@github_repository}|*#{@github_repository}*>. Please resolve when you have time.\n\n"], fn {package_name, group}, acc ->
      [vulnerability | _] = group

      message = "<#{vulnerability.resolve_issue_url}|*#{package_name}*>: " <> "#{number_of_vulnerabilities(length(group))}" <> " with severity: #{severities(group)}\n"
      message = message <> "ecosystem: #{String.downcase(vulnerability.package.ecosystem || "")}\n"

      acc ++ [message]
    end)
    |> Enum.join("\n")
  end

  defp number_of_vulnerabilities(size) when size == 0, do: "no vulnerabilities"
  defp number_of_vulnerabilities(size) when size == 1, do: "1 vulnerability"
  defp number_of_vulnerabilities(size) when size > 1, do: "#{size} vulnerabilities"

  defp severities(group) do
    group
    |> Enum.map(& &1.severity)
    |> Enum.uniq()
    |> Enum.join(", ")
  end

  defp parse_datetime(nil), do: nil
  defp parse_datetime(""), do: nil
  defp parse_datetime(datetime_str) do
    case DateTime.from_iso8601(datetime_str) do
      {:ok, dt, _offset} -> dt
      {:error, _} -> datetime_str
    end
  end

end

VulnerabilityAlerts.run()