Merge pull request #13 from nvsecurity/NV-4412-ci-pipeline-fixes

NV-4412 Fix GitLab/Azure CI: Compose v2, drop removed scan -a flag, pin ubuntu

Author: blackoutjack

.gitlab-ci.yml

@@ -33,7 +33,7 @@ workflow:
 
 extract_spec:
   stage: extract
-  image: ubuntu:latest
+  image: ubuntu:24.04
   before_script:
     - apt-get update && apt-get install -y wget ca-certificates
     - wget -c https://downloads.nightvision.net/binaries/latest/nightvision_latest_linux_amd64.tar.gz -O - | tar -xz
@@ -59,24 +59,24 @@ extract_spec:
 
 dast_scan:
   stage: scan
-  image: ubuntu:latest
+  image: ubuntu:24.04
   services:
     - docker:dind
   before_script:
-    - apt-get update && apt-get install -y wget ca-certificates docker.io docker-compose
+    - apt-get update && apt-get install -y wget ca-certificates docker.io docker-compose-v2
     - wget -c https://downloads.nightvision.net/binaries/latest/nightvision_latest_linux_amd64.tar.gz -O - | tar -xz
     - mv nightvision /usr/local/bin/
   script:
     # Fail the job on a scan error even though the scan output is piped to tee:
     # without pipefail the pipeline's exit status would be tee's (always 0).
     - set -o pipefail
     # Start the target application.
-    - docker-compose up -d
+    - docker compose up -d
     - sleep 15
     # Run the scan and capture its id robustly: extract the scan UUID from the
     # output (rather than assuming it is the first line) and fail loudly if none
     # is produced, instead of feeding an empty -s to the export.
-    - nightvision scan "${NIGHTVISION_TARGET}" -a "${NIGHTVISION_APP}" --auth "${NIGHTVISION_AUTH}" | tee scan-results.txt
+    - nightvision scan "${NIGHTVISION_TARGET}" --auth "${NIGHTVISION_AUTH}" | tee scan-results.txt
     - SCAN_ID=$(grep -oiE '[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}' scan-results.txt | head -n1)
     - 'test -n "${SCAN_ID}" || { echo "ERROR no scan id found in scan output" >&2; exit 1; }'
     # Native GitLab DAST report (replaces the former fetch-and-run Python converter).

azure-pipelines.yml

@@ -7,7 +7,7 @@
 
 ## Optional steps can be preformed locally or in the pipeline
 # nightvision swagger extract ./ -t javaspringvulny-api --lang spring
-# nightvision scan javaspringvulny-api -a javaspringvulny-api
+# nightvision scan javaspringvulny-api --auth javaspringvulny-api
 
 trigger:
 - main
@@ -53,7 +53,7 @@ stages:
       displayName: 'Start the App'
 
     - script: |
-        nightvision scan $NIGHTVISION_TARGET -a $NIGHTVISION_APP --auth $NIGHTVISION_AUTH > scan-results.txt
+        nightvision scan $NIGHTVISION_TARGET --auth $NIGHTVISION_AUTH > scan-results.txt
         nightvision export sarif -s "$(head -n 1 scan-results.txt)" --swagger-file openapi-spec.yml
       displayName: 'Scan the API'
       env: