feat: CQ-4361662 security worker calls code import worker #1572
Conversation
|
This PR will trigger no release when merged. |
| .withPostProcessors([opportunityAndSuggestionsStep]) | ||
| // Note the import worker MUST trigger the next step regardless if code repo is configured | ||
| .addStep('import', extractCodeBucket, AUDIT_STEP_DESTINATIONS.IMPORT_WORKER) | ||
| .addStep('generate-suggestion-data', opportunityAndSuggestionsStep) |
There was a problem hiding this comment.
Not sure so just asking to confirm, the audit-worker is called back from the import worker once the code is done? Or it just continues once the message is sent to the import worker?
There was a problem hiding this comment.
the code exits after the import step (maybe change the name :), after the message is sent to the import worker.
then the import worker puts another message into the queue calling the audit worker with a payload next:generate-suggestion-data and that is when the second step is executed.
| .withRunner(vulnerabilityAuditRunner) | ||
| .withPostProcessors([opportunityAndSuggestionsStep]) | ||
| // Note the import worker MUST trigger the next step regardless if code repo is configured | ||
| .addStep('import-from-starfish', extractCodeBucket, AUDIT_STEP_DESTINATIONS.IMPORT_WORKER) |
There was a problem hiding this comment.
Do these need to be named with a more unique name? like security-* ?
There was a problem hiding this comment.
not really, those are steps in the security vulnerability audit types.
e.g. the SQS message looks like
{
"type": "audit",
"siteId": "9ee60274-f27a-47ab-9b60-46c09a83175c",
"allowCache": true,
"auditContext": {
"next": "generate-suggestion-data",
"auditId": "e082980d-673b-4e37-828a-949731127261",
"auditType": "security-vulnerabilities",
"fullAuditRef": "publish-p15854-e1797721.adobeaemcloud.com/us/en.html"
},
"data":{
"codeBucket": "spacecat-dev-importer",
"codePath": "/my/code/path"
}
"timestamp": "2025-11-11T16:19:38.130Z"
}
note the auditContext.auditType and auditContext.next
| // checks the session token of 1h | ||
|
|
||
| // poor man's way to use tokens that are valid > 1h. Ask bott. | ||
| if (process.env.IM_REALLY_USING_A_DEV_TOKEN === 'true' || process.env.IM_REALLY_USING_A_DEV_TOKEN === 'pinky finger promise') { |
There was a problem hiding this comment.
can you make this a bit less hackish-looking?
There was a problem hiding this comment.
the original way is hackish and annoying, this is just a patch on top,
note this is only for local development.
bottadobe
changed the title
|
@kronnox can i get another pair of eyes? |
# [1.253.0](v1.252.6...v1.253.0) (2025-11-24) ### Features * CQ-4361662 security worker calls code import worker ([#1572](#1572)) ([3ae7900](3ae7900))
|
🎉 This PR is included in version 1.253.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
This PR modified the security audit worker, to call the code import worker before calling mystique.
we hard to refactor it to be a multi step worker