adds new job

src/commands/scan.yml

@@ -17,6 +17,7 @@ parameters:
     default: https://api.probely.com
 
 steps:
+- run: mkdir -p workspace
 - run:
     name: Probely - Starting Security Scan
     command: |
@@ -32,7 +33,10 @@ steps:
         echo "Please set the target id as a parameter for this orb."
         exit 1
       fi
-      curl -X POST \
-          -H "Authorization: JWT ${<< parameters.api_key >>}" \
-          << parameters.api_url >>/targets/<< parameters.target_id >>/scan_now/
+      # Save the id to use in Vulnerabilities job
+      myid=$(curl << parameters.api_url >>/targets/<< parameters.target_id >>/scan_now/ \
+        -X POST \
+        -H "Content-Type: application/json" \
+        -H "Authorization: JWT ${<< parameters.api_key >>}"| jq '.id' | tr -d '"')
+      echo $myid > workspace/echo-output
       exit $?

src/commands/vulnerabilities.yml

@@ -0,0 +1,63 @@
+description: |
+  Get scan vulnerabilities.
+
+parameters:
+  api_key:
+    default: PROBELY_API_KEY
+    description: |
+      The Probely API key to use, defined in the PROBELY_API_KEY environment variable.
+    type: env_var_name
+  api_url:
+    default: https://api.probely.com
+    description: The URL of Probely's API
+    type: string
+  target_id:
+    description: The id of the target (website) to scan.
+    type: string
+
+steps:
+- attach_workspace:
+    at: /tmp/workspace
+- run:
+    name: Probely - Getting Security Scan Vulnerabilities
+    command: |
+      # Check if API key is set
+      if [ -z "${<< parameters.api_key >>}" ]; then
+        echo "NO PROBELY API KEY SET"
+        echo "Please set your API key in the << parameters.api_key >> variable"
+        exit 1
+      fi
+      # Check if target id is set
+      if [ -z "<< parameters.target_id >>" ]; then
+        echo "NO PROBELY TARGET ID SET"
+        echo "Please set the target id as a parameter for this orb."
+        exit 1
+      fi
+      # Load the id that we saved before
+      myid=$(cat /tmp/workspace/echo-output)
+      mystatus="started"
+      # For every minute verify if the scan is over
+      while [ "$mystatus" != completed ]
+      do
+        sleep 60s
+        mystatus=$(curl << parameters.api_url >>/targets/<< parameters.target_id >>/scans/$myid/ \
+        -X GET \
+        -H "Content-Type: application/json" \
+        -H "Authorization: JWT ${<< parameters.api_key >>}"| jq '.status' | tr -d '"')
+        echo status: $mystatus
+      done
+      # Get all vulnerabilities
+      myvulnerabilities=$(curl << parameters.api_url >>/targets/<< parameters.target_id >>/scans/$myid/ \
+        -X GET \
+        -H "Content-Type: application/json" \
+        -H "Authorization: JWT ${<< parameters.api_key >>}"| jq ' . | {lows:.lows,mediums:.mediums,highs:.highs}')
+      echo Vulnerabilities of your scan = $myvulnerabilities
+      # We want high vulnerabilities
+      myhighs=`echo $myvulnerabilities | jq '.highs'`
+      if [[ $myhighs -eq 0 ]]; then
+        echo "Everything is fine!";
+        exit $?
+      else
+        echo "We find high vulnerabilities in your scan!";
+        exit 1
+      fi

src/examples/scan.yml

@@ -1,4 +1,4 @@
-description: Start the scan on a target (website) using Probely.
+description: Start the scan on a target (website) using Probely and then get scan vulnerabilities.
 usage:
   orbs:
     probely: probely/[email protected]
@@ -9,3 +9,9 @@ usage:
       - probely/scan:
           # Remember to set the PROBELY_API_KEY environment variable!
           target_id: probely_target_id # Target id of the website to scan
+      - probely/vulnerabilities:
+          requires:
+            - probely/scan
+          # Remember to set the PROBELY_API_KEY environment variable!
+          target_id: probely_target_id # Target id of the website to scan
+

src/executors/alpine.yml

@@ -3,3 +3,4 @@ docker:
 - image: cibuilds/base:latest
   environment:
     TERM: dumb
+working_directory: /tmp

src/jobs/vulnerabilities.yml

@@ -0,0 +1,14 @@
+description: Get scan vulnerabilities.
+executor: alpine
+parameters:
+  api_key:
+    default: PROBELY_API_KEY
+    description: |
+      The Probely API key to use, defined in the PROBELY_API_KEY environment variable.
+    type: env_var_name
+  target_id:
+    description: The id of the target (website) to scan.
+    type: string
+steps:
+- vulnerabilities:
+    target_id: << parameters.target_id >>