FROM shiftleft/scan-base as builder

ARG CLI_VERSION
ARG BUILD_DATE

ENV GOSEC_VERSION=2.14.0 \
    TFSEC_VERSION=0.63.1 \
    KUBESEC_VERSION=2.11.4 \
    KUBE_SCORE_VERSION=1.13.0 \
    SHELLCHECK_VERSION=0.7.2 \
    DETEKT_VERSION=1.22.0 \
    GITLEAKS_VERSION=7.6.1 \
    SC_VERSION=0.3.3 \
    JQ_VERSION=1.6 \
    GOPATH=/opt/app-root/go \
    SHIFTLEFT_HOME=/opt/sl-cli \
    PATH=${PATH}:${GOPATH}/bin:

USER root

RUN mkdir -p /usr/local/bin/shiftleft \
    && curl -LO "https://github.com/securego/gosec/releases/download/v${GOSEC_VERSION}/gosec_${GOSEC_VERSION}_linux_amd64.tar.gz" \
    && tar -C /usr/local/bin/shiftleft/ -xvf gosec_${GOSEC_VERSION}_linux_amd64.tar.gz \
    && chmod +x /usr/local/bin/shiftleft/gosec \
    && rm gosec_${GOSEC_VERSION}_linux_amd64.tar.gz
RUN curl -LO "https://github.com/koalaman/shellcheck/releases/download/v${SHELLCHECK_VERSION}/shellcheck-v${SHELLCHECK_VERSION}.linux.x86_64.tar.xz" \
    && tar -C /tmp/ -xvf shellcheck-v${SHELLCHECK_VERSION}.linux.x86_64.tar.xz \
    && cp /tmp/shellcheck-v${SHELLCHECK_VERSION}/shellcheck /usr/local/bin/shiftleft/shellcheck \
    && chmod +x /usr/local/bin/shiftleft/shellcheck \
    && curl -LO "https://github.com/dominikh/go-tools/releases/download/v${SC_VERSION}/staticcheck_linux_amd64.tar.gz" \
    && tar -C /tmp -xvf staticcheck_linux_amd64.tar.gz \
    && chmod +x /tmp/staticcheck/staticcheck \
    && cp /tmp/staticcheck/staticcheck /usr/local/bin/shiftleft/staticcheck \
    && rm staticcheck_linux_amd64.tar.gz
RUN curl -L "https://github.com/zricethezav/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks-linux-amd64" -o "/usr/local/bin/shiftleft/gitleaks" \
    && chmod +x /usr/local/bin/shiftleft/gitleaks \
    && curl -L "https://github.com/aquasecurity/tfsec/releases/download/v${TFSEC_VERSION}/tfsec-linux-amd64" -o "/usr/local/bin/shiftleft/tfsec" \
    && chmod +x /usr/local/bin/shiftleft/tfsec \
    && rm shellcheck-v${SHELLCHECK_VERSION}.linux.x86_64.tar.xz
RUN curl -L "https://github.com/zegl/kube-score/releases/download/v${KUBE_SCORE_VERSION}/kube-score_${KUBE_SCORE_VERSION}_linux_amd64" -o "/usr/local/bin/shiftleft/kube-score" \
    && chmod +x /usr/local/bin/shiftleft/kube-score \
    && curl -L "https://github.com/stedolan/jq/releases/download/jq-${JQ_VERSION}/jq-linux64" -o "/usr/local/bin/shiftleft/jq" \
    && chmod +x /usr/local/bin/shiftleft/jq
RUN curl -L "https://github.com/detekt/detekt/releases/download/v${DETEKT_VERSION}/detekt-cli-${DETEKT_VERSION}-all.jar" -o "/usr/local/bin/shiftleft/detekt-cli.jar" \
    && curl -LO "https://github.com/controlplaneio/kubesec/releases/download/v${KUBESEC_VERSION}/kubesec_linux_amd64.tar.gz" \
    && tar -C /usr/local/bin/shiftleft/ -xvf kubesec_linux_amd64.tar.gz \
    && rm kubesec_linux_amd64.tar.gz \
    && curl "https://cdn.shiftleft.io/download/sl" > /usr/local/bin/shiftleft/sl \
    && chmod a+rx /usr/local/bin/shiftleft/sl \
    && mkdir -p /opt/sl-cli \
    && /usr/local/bin/shiftleft/sl update csharp2cpg

FROM shiftleft/scan-base-csharp as sast-scan-tools

LABEL maintainer="ShiftLeftSecurity" \
      org.label-schema.schema-version="1.0" \
      org.label-schema.vendor="shiftleft" \
      org.label-schema.name="sast-scan" \
      org.label-schema.version=$CLI_VERSION \
      org.label-schema.license="Apache-2.0" \
      org.label-schema.description="Container with various opensource static analysis security testing tools (shellcheck, gosec, tfsec, gitleaks, ...) for multiple programming languages" \
      org.label-schema.url="https://www.shiftleft.io" \
      org.label-schema.usage="https://github.com/ShiftLeftSecurity/sast-scan" \
      org.label-schema.build-date=$BUILD_DATE \
      org.label-schema.vcs-url="https://github.com/ShiftLeftSecurity/sast-scan.git" \
      org.label-schema.docker.cmd="docker run --rm -it --name sast-scan shiftleft/scan-csharp"

ENV APP_SRC_DIR=/usr/local/src \
    DEPSCAN_CMD="/usr/local/bin/depscan" \
    MVN_CMD="/usr/bin/mvn" \
    PMD_CMD="/opt/pmd-bin/bin/run.sh pmd" \
    PYTHONUNBUFFERED=1 \
    DOTNET_CLI_TELEMETRY_OPTOUT=1 \
    SHIFTLEFT_HOME=/opt/sl-cli \
    GO111MODULE=auto \
    GOARCH=amd64 \
    GOOS=linux \
    CGO_ENABLED=0 \
    NVD_EXCLUDE_TYPES="o,h" \
    PATH=/usr/local/src/:${PATH}:/usr/local/go/bin:/opt/sl-cli:

COPY --from=builder /usr/local/bin/shiftleft /usr/local/bin
COPY --from=builder /opt/sl-cli /opt/sl-cli
COPY tools_config/ /usr/local/src/
COPY requirements.txt /usr/local/src/

USER root

RUN python3 -m pip install --upgrade pip \
    && pip3 install --no-cache-dir wheel \
    && pip3 install --no-cache-dir -r /usr/local/src/requirements.txt \
    && npm install --no-audit --progress=false --only=production -g @cyclonedx/cdxgen  @microsoft/rush --unsafe-perm \
    && microdnf clean all

WORKDIR /app

COPY scan /usr/local/src/
COPY lib /usr/local/src/lib

CMD [ "python3", "/usr/local/src/scan" ]
