Build a CodeMender remediation pipeline on Cloud Build

# Install: gcloud  https://cloud.google.com/sdk/docs/install
#          gh      https://cli.github.com     git  https://git-scm.com
gcloud auth login
gh auth login              # GitHub.com -> HTTPS -> grant the 'repo' scope
git --version && gh --version && gcloud --version | head -1

gh repo fork juice-shop/juice-shop --clone --fork-name juice-shop
cd juice-shop
git remote -v      # origin -> your fork; upstream -> juice-shop

gh auth status
git config --global user.name  "Your Name"
git config --global user.email "you@example.com"

export PROJECT_ID=your-gcp-project
export REGION=us-central1
gcloud config set project "$PROJECT_ID"

# Cloud Build runs the pipeline; Secret Manager holds the token; GCS holds CM state
gcloud services enable \
  cloudbuild.googleapis.com secretmanager.googleapis.com storage.googleapis.com

export CM_STATE_BUCKET="${PROJECT_ID}-cm-state"
gcloud storage buckets create "gs://$CM_STATE_BUCKET" \
  --location="$REGION" --uniform-bucket-level-access

read -rs GH_PAT
printf '%s' "$GH_PAT" | gcloud secrets create gh-pat --data-file=-
unset GH_PAT

gh auth login            # GitHub.com -> HTTPS -> grant 'repo' scope
gh auth status           # confirm the account that owns your fork is active
gh auth token | gcloud secrets create gh-pat --data-file=-

export PROJECT_NUMBER=$(gcloud projects describe "$PROJECT_ID" --format='value(projectNumber)')
export CB_LEGACY="${PROJECT_NUMBER}@cloudbuild.gserviceaccount.com"
export CB_COMPUTE="${PROJECT_NUMBER}-compute@developer.gserviceaccount.com"

for SA in "$CB_LEGACY" "$CB_COMPUTE"; do
  # read the GitHub token
  gcloud secrets add-iam-policy-binding gh-pat \
    --member="serviceAccount:$SA" --role="roles/secretmanager.secretAccessor"
  # read/write CodeMender state in the bucket
  gcloud storage buckets add-iam-policy-binding "gs://$CM_STATE_BUCKET" \
    --member="serviceAccount:$SA" --role="roles/storage.objectAdmin"
done
# Image access is already granted org-wide by your facilitator - nothing to send.

#!/usr/bin/env bash
#
# cm-env.sh — shared setup, sourced by find.sh / verify.sh / fix.sh.
#
# CodeMender keeps its state (config, Ed25519 identity, findings SQLite DB,
# session logs, generated patches) under $HOME/.codemender. In this pipeline
# each phase runs as a SEPARATE Cloud Build step — a fresh container — so that
# state would normally be lost between find, verify, and fix.
#
# To persist it we mount a GCS bucket with gcsfuse and point $HOME at a
# per-run folder inside it. `cm init` writes there once; every later step
# re-mounts the same bucket and finds the identity + findings DB already there.
set -euo pipefail

: "${CM_STATE_BUCKET:?set CM_STATE_BUCKET (GCS bucket for CodeMender state)}"
: "${STATE_ID:?set STATE_ID (per-run isolation, e.g. the Cloud Build \$BUILD_ID)}"

export WORKSPACE="${WORKSPACE:-/workspace}"
export REPO_DIR="${REPO_DIR:-$WORKSPACE/repo}"
export HOME="/mnt/cmstate/${STATE_ID}"          # cm writes ~/.codemender here

# --- Mount the state bucket (once per step/container) ------------------------
mkdir -p /mnt/cmstate
if ! mount | grep -q ' /mnt/cmstate '; then
  echo "🗄️  mounting gs://${CM_STATE_BUCKET} at /mnt/cmstate (gcsfuse)"
  gcsfuse --implicit-dirs "${CM_STATE_BUCKET}" /mnt/cmstate
fi
mkdir -p "$HOME"

# --- One-time CodeMender init for this run ----------------------------------
if [[ ! -f "$HOME/.codemender/config.yaml" ]]; then
  echo "⚙️  cm init (state → gs://${CM_STATE_BUCKET}/${STATE_ID})"
  cm init
  # CI-friendly config: git VCS, no interactive prompts, fresh scans.
  cat > "$HOME/.codemender/config.yaml" <<'YAML'
server: {}
scan:
  extensions:
    include: [".ts", ".js"]
    exclude: [".min.js", ".spec.ts", ".test.ts"]
  incremental: false
output:
  format: table
tools:
  confirm_commands: false
  confirm_writes: false
vcs:
  type: git
build:
  command: ""
YAML
fi

# --- Helper: highest-severity finding UUID from `cm report` (empty if none) --
# This is the "grep the results for the next command" glue: parse the findings
# CodeMender stored and hand the top one to verify / fix.
top_finding_id() {
  cm report -f json 2>/dev/null | jq -r '
    (if type=="array" then . else [] end)
    | sort_by({CRITICAL:4, HIGH:3, MEDIUM:2, LOW:1}[(.Severity|ascii_upcase)] // 0)
    | reverse | (.[0].FindingID // "")'
}

#!/usr/bin/env bash
#
# find.sh — STEP 1: scan one file with CodeMender and record the findings.
# State (findings DB) is written to the gcsfuse-mounted bucket so the verify
# and fix steps can read it.
source "$(dirname "$0")/cm-env.sh"

: "${SCAN_PATH:?set SCAN_PATH (file to scan, relative to the repo)}"
cd "$REPO_DIR"

echo "🔍 cm find ${SCAN_PATH}"
cm find "${SCAN_PATH}" -y

echo "── findings ──────────────────────────────────────────"
cm report                                   # human-readable table in the log
cm report -f json > "$WORKSPACE/cm-findings.json" || echo 'null' > "$WORKSPACE/cm-findings.json"

FID=$(top_finding_id)
if [[ -z "$FID" ]]; then
  echo "No findings — the verify/fix steps will no-op."
else
  echo "Top finding selected for verify/fix: $FID"
fi

#!/usr/bin/env bash
#
# verify.sh — STEP 2: verify the highest-severity finding.
#
# This runs CodeMender's FULL verification: it may build and run the target
# app to reproduce the exploit, so it can take several minutes. That is exactly
# why the CI image ships with node/npm and build tools. We do NOT short-circuit
# it — a verified finding is a stronger signal than a raw scan hit.
source "$(dirname "$0")/cm-env.sh"
cd "$REPO_DIR"

FID=$(top_finding_id)
if [[ -z "$FID" ]]; then
  echo "No findings to verify."; exit 0
fi

echo "🔬 cm find verify ${FID}"
cm find verify "${FID}"

echo "── status after verification ─────────────────────────"
cm report

#!/usr/bin/env bash
#
# fix.sh — STEP 3: generate the fix for the highest-severity finding, then apply
# CodeMender's stored patch deterministically and leave metadata for open-pr.
source "$(dirname "$0")/cm-env.sh"
cd "$REPO_DIR"

FID=$(top_finding_id)
if [[ -z "$FID" ]]; then
  echo "No findings to fix."; echo "NONE" > "$WORKSPACE/cm-status.txt"; exit 0
fi

# Grab finding metadata for the PR body NOW (before cm fix touches the tree).
cm report -f json | jq --arg id "$FID" '.[]|select(.FindingID==$id)' > "$WORKSPACE/cm-finding.json"
STATUS=$(jq -r '.Status' "$WORKSPACE/cm-finding.json")
FILE=$(jq -r '.FilePath' "$WORKSPACE/cm-finding.json" | sed "s#^$REPO_DIR/##")
if [[ "$STATUS" == "DISMISSED" ]]; then
  echo "Finding $FID was DISMISSED during verification — not fixing."
  echo "DISMISSED" > "$WORKSPACE/cm-status.txt"; exit 0
fi

echo "🩹 cm fix ${FID} --auto-apply -y"
cm fix "${FID}" --auto-apply -y 2>&1 | tee "$WORKSPACE/cm-fix.out"

# CodeMender prints a one-line headline tagged [Summary]; capture the last one.
SUMMARY=$(grep -aoE '\[Summary\][[:space:]]+.*' "$WORKSPACE/cm-fix.out" | tail -1 | sed -E 's/^\[Summary\][[:space:]]+//')
[[ -z "$SUMMARY" ]] && SUMMARY="Applied CodeMender remediation for finding ${FID}."
printf '%s\n' "$SUMMARY" > "$WORKSPACE/cm-summary.txt"

# The fix agent may or may not leave its patch applied (it sometimes builds/runs
# the app to test the fix and then resets the tree). To be deterministic we
# reset the tree to HEAD and apply CodeMender's STORED patch as the single
# source of truth, extracted from `cm report --patches`.
git checkout -- . 2>/dev/null || true
rm -rf "$REPO_DIR"/.exploit "$REPO_DIR"/.cm_project "$REPO_DIR"/routes/.exploit 2>/dev/null || true

cm report --patches 2>/dev/null | awk '
  /^  diff --git /{cap=1}
  cap && /^  /{print; next}
  cap && !/^  /{cap=0}
' | sed 's/^  //' > "$WORKSPACE/cm.patch"
sed -i -e :a -e '/^[[:space:]]*$/{$d;N;ba}' "$WORKSPACE/cm.patch"   # trim trailing blanks

if [[ ! -s "$WORKSPACE/cm.patch" ]]; then
  echo "❌ CodeMender produced no patch."; echo "NO_PATCH" > "$WORKSPACE/cm-status.txt"; exit 1
fi
git apply --whitespace=nowarn "$WORKSPACE/cm.patch"

if git diff --quiet -- "$FILE"; then
  echo "❌ patch did not change ${FILE}."; echo "NO_CHANGE" > "$WORKSPACE/cm-status.txt"; exit 1
fi

echo "FIXED" > "$WORKSPACE/cm-status.txt"
echo "✅ Fix applied to ${FILE}"
git --no-pager diff -- "$FILE"

#!/usr/bin/env bash
#
# open-pr.sh — STEP 4: commit CodeMender's fix to a branch, push it to the
# fork, and open a Pull Request whose body is CodeMender's own analysis.
#
# Does NOT touch CodeMender state — only git + the GitHub API — so it needs no
# gcsfuse mount. Reads the metadata that fix.sh left in $WORKSPACE.
set -euo pipefail

WORKSPACE="${WORKSPACE:-/workspace}"
REPO_DIR="${REPO_DIR:-$WORKSPACE/repo}"
BASE_BRANCH="${BASE_BRANCH:-master}"
GIT_AUTHOR_NAME="${GIT_AUTHOR_NAME:-codemender-bot}"
GIT_AUTHOR_EMAIL="${GIT_AUTHOR_EMAIL:-codemender-bot@users.noreply.github.com}"

: "${GH_OWNER:?set GH_OWNER}"; : "${GH_REPO:?set GH_REPO}"; : "${GH_TOKEN:?set GH_TOKEN (from Secret Manager)}"
# Secret values often carry a trailing newline; strip all whitespace so it
# can't corrupt the push URL or the auth header.
GH_TOKEN=$(printf '%s' "$GH_TOKEN" | tr -d '[:space:]')

STATUS=$(cat "$WORKSPACE/cm-status.txt" 2>/dev/null || echo UNKNOWN)
if [[ "$STATUS" != "FIXED" ]]; then
  echo "cm-status is '$STATUS' (not FIXED) — nothing to open a PR for."; exit 0
fi

# --- Read the finding metadata ----------------------------------------------
F="$WORKSPACE/cm-finding.json"
FID=$(jq -r '.FindingID' "$F")
TITLE=$(jq -r '.Title' "$F")
SEV=$(jq -r '.Severity|ascii_upcase' "$F")
CWE=$(jq -r '.VulnID // "CWE-unknown"' "$F")
VTYPE=$(jq -r '.VulnType // "Vulnerability"' "$F")
CONF=$(jq -r '.Confidence // 0' "$F")
FILE=$(jq -r '.FilePath' "$F" | sed "s#^$REPO_DIR/##")
ANALYSIS=$(jq -r '.Analysis // ""' "$F")
SUMMARY=$(cat "$WORKSPACE/cm-summary.txt")

SHORT="${FID:0:8}"
CWE_SLUG=$(echo "$CWE" | tr 'A-Z' 'a-z' | tr -cd 'a-z0-9-')
BRANCH="codemender/${CWE_SLUG}-${SHORT}"
PR_TITLE="security: fix ${VTYPE} in ${FILE} (${CWE})"

# --- Commit ------------------------------------------------------------------
cd "$REPO_DIR"
git config user.name  "$GIT_AUTHOR_NAME"
git config user.email "$GIT_AUTHOR_EMAIL"
git checkout -b "$BRANCH"
git add -u                                   # tracked modifications only
git commit -F - <<EOF
${PR_TITLE}

${SUMMARY}

Finding:  ${TITLE}
Severity: ${SEV}   Confidence: ${CONF}%   ${CWE}
Detected & remediated by CodeMender (finding ${FID}).
EOF

# --- Push (token redacted from any output) ----------------------------------
PUSH_URL="https://x-access-token:${GH_TOKEN}@github.com/${GH_OWNER}/${GH_REPO}.git"
set +e
PUSH_OUT=$(git push "$PUSH_URL" "$BRANCH" 2>&1); PUSH_RC=$?
set -e
echo "${PUSH_OUT//${GH_TOKEN}/***}"
[[ $PUSH_RC -eq 0 ]] || { echo "❌ git push failed"; exit 1; }

# --- Compose the PR body -----------------------------------------------------
{
  echo "## 🛡️ CodeMender automated security fix"
  echo
  echo "> ${SUMMARY}"
  echo
  echo "| | |"
  echo "|---|---|"
  echo "| **Finding** | ${TITLE} |"
  echo "| **Severity** | ${SEV} |"
  echo "| **Type** | ${VTYPE} (${CWE}) |"
  echo "| **Confidence** | ${CONF}% |"
  echo "| **File** | \`${FILE}\` |"
  echo
  echo "### Analysis"
  echo
  echo "${ANALYSIS}"
  echo
  echo "### Change"
  echo '```diff'
  git --no-pager diff "${BASE_BRANCH}..${BRANCH}" -- "$FILE"
  echo '```'
  echo
  echo "---"
  echo "_Generated by CodeMender. Review the diff before approving; merging applies the fix to \`${BASE_BRANCH}\`._"
} > "$WORKSPACE/cm-pr-body.md"

# --- Open the PR -------------------------------------------------------------
jq -n --arg t "$PR_TITLE" --arg h "$BRANCH" --arg b "$BASE_BRANCH" \
      --rawfile body "$WORKSPACE/cm-pr-body.md" \
      '{title:$t, head:$h, base:$b, body:$body, maintainer_can_modify:true}' > "$WORKSPACE/pr-request.json"

HTTP=$(curl -sS -o "$WORKSPACE/pr-response.json" -w '%{http_code}' -X POST \
  -H "Authorization: Bearer ${GH_TOKEN}" \
  -H "Accept: application/vnd.github+json" \
  -H "X-GitHub-Api-Version: 2022-11-28" \
  "https://api.github.com/repos/${GH_OWNER}/${GH_REPO}/pulls" \
  -d @"$WORKSPACE/pr-request.json")

if [[ "$HTTP" == "201" ]]; then
  echo "✅ Pull Request opened: $(jq -r '.html_url' "$WORKSPACE/pr-response.json")"
elif [[ "$HTTP" == "422" ]]; then
  echo "ℹ️  A PR for this branch already exists (HTTP 422):"
  jq -r '.errors[]?.message // .message' "$WORKSPACE/pr-response.json"
else
  echo "❌ GitHub API returned HTTP $HTTP"
  jq -r '.message' "$WORKSPACE/pr-response.json" 2>/dev/null || cat "$WORKSPACE/pr-response.json"
  exit 1
fi

# CodeMender remediation pipeline — SEPARATE find / verify / fix / open-pr steps.
#
# Run from a working directory that contains this file and the scripts/ folder
# (the source is uploaded, so the steps can run scripts/*.sh):
#
#   gcloud builds submit . \
#     --config cloudbuild.yaml \
#     --substitutions=\
#   _CM_IMAGE=us-central1-docker.pkg.dev/CENTRAL_PROJECT/codemender/codemender-ci:v0.2.0,\
#   _CM_STATE_BUCKET=YOUR_PROJECT-cm-state,\
#   _GH_OWNER=YOUR_GITHUB_USERNAME,_GH_REPO=juice-shop,_BASE_BRANCH=master,\
#   _SCAN_PATH=routes/login.ts
#
# CodeMender state (config, identity, findings SQLite DB) is persisted across
# the separate steps in a GCS bucket mounted with gcsfuse (see scripts/cm-env.sh).
# The GitHub token comes from Secret Manager (secret name: gh-pat).
#
# Set _CM_IMAGE, _CM_STATE_BUCKET and _GH_OWNER (on the command line in Step 9,
# or here). The rest have working defaults for this lab.
substitutions:
  _CM_IMAGE: ""              # ◀ SET: CodeMender image URL from your facilitator
  _CM_STATE_BUCKET: ""       # ◀ SET: the GCS state bucket you created (Step 4)
  _GH_OWNER: ""              # ◀ SET: your GitHub username (owner of the fork)
  _GH_REPO: juice-shop
  _BASE_BRANCH: master
  _SCAN_PATH: routes/login.ts

steps:
  # 0 · Clone your fork into the shared /workspace (scripts/ stays alongside).
  - id: clone
    name: gcr.io/cloud-builders/git
    entrypoint: bash
    args:
      - -c
      - |
        set -e
        rm -rf /workspace/repo
        git clone --depth 1 --branch "${_BASE_BRANCH}" \
          "https://github.com/${_GH_OWNER}/${_GH_REPO}.git" /workspace/repo

  # 1 · Scan (writes findings to the gcsfuse-mounted state bucket).
  - id: find
    name: ${_CM_IMAGE}
    entrypoint: bash
    args: ["scripts/find.sh"]
    env: &cmenv
      - CM_STATE_BUCKET=${_CM_STATE_BUCKET}
      - STATE_ID=${BUILD_ID}
      - WORKSPACE=/workspace
      - REPO_DIR=/workspace/repo
      - SCAN_PATH=${_SCAN_PATH}

  # 2 · Verify the top finding (full verification — may take several minutes).
  - id: verify
    name: ${_CM_IMAGE}
    entrypoint: bash
    args: ["scripts/verify.sh"]
    env: *cmenv

  # 3 · Fix the top finding and stage commit/PR metadata.
  - id: fix
    name: ${_CM_IMAGE}
    entrypoint: bash
    args: ["scripts/fix.sh"]
    env: *cmenv

  # 4 · Commit, push the branch, and open the Pull Request.
  - id: open-pr
    name: ${_CM_IMAGE}
    entrypoint: bash
    args: ["scripts/open-pr.sh"]
    secretEnv: ["GH_TOKEN"]
    env:
      - WORKSPACE=/workspace
      - REPO_DIR=/workspace/repo
      - GH_OWNER=${_GH_OWNER}
      - GH_REPO=${_GH_REPO}
      - BASE_BRANCH=${_BASE_BRANCH}

availableSecrets:
  secretManager:
    - versionName: projects/$PROJECT_ID/secrets/gh-pat/versions/latest
      env: GH_TOKEN

options:
  logging: CLOUD_LOGGING_ONLY
timeout: 3600s      # verify can build & run the app to reproduce the exploit

export CM_IMAGE="...from your facilitator.../codemender-ci:v0.2.0"

gcloud builds submit . \
  --config cloudbuild.yaml \
  --substitutions=_CM_IMAGE="$CM_IMAGE",_CM_STATE_BUCKET="$CM_STATE_BUCKET",_GH_OWNER=YOUR_GITHUB_USERNAME,_GH_REPO=juice-shop,_BASE_BRANCH=master,_SCAN_PATH=routes/login.ts

- models.sequelize.query(`SELECT * FROM Users WHERE email = '${req.body.email || ''}'
-   AND password = '${security.hash(req.body.password || '')}' AND deletedAt IS NULL`,
-   { model: UserModel, plain: true })
+ models.sequelize.query('SELECT * FROM Users WHERE email = ? AND password = ?
+   AND deletedAt IS NULL',
+   { replacements: [req.body.email || '', security.hash(req.body.password || '')],
+     model: UserModel, plain: true })

gh pr view N  --repo YOUR_GITHUB_USERNAME/juice-shop --web
gh pr merge N --repo YOUR_GITHUB_USERNAME/juice-shop --squash

gcloud builds submit . --config cloudbuild.yaml \
  --substitutions=_CM_IMAGE="$CM_IMAGE",_CM_STATE_BUCKET="$CM_STATE_BUCKET",_GH_OWNER=YOUR_GITHUB_USERNAME,_GH_REPO=juice-shop,_BASE_BRANCH=master,_SCAN_PATH=routes/login.ts

gcloud secrets delete gh-pat --quiet
gcloud storage rm -r "gs://$CM_STATE_BUCKET" --quiet     # optional: delete CM state
gh pr list --repo YOUR_GITHUB_USERNAME/juice-shop     # close any leftover PRs