Fail the build on a disallowed licence or a known vulnerability

#!/usr/bin/env bash
# Fail when a scanoss-cli raw result contains a disallowed licence, or a
# known vulnerability at or above a severity threshold.
#
# Usage: ci/scanoss-policy.sh scanoss-results.json
#
# Environment:
#   DENY_LICENSES      regular expression matched against SPDX licence IDs
#                      (default: GPL, AGPL and SSPL families, not LGPL)
#   FAIL_ON_SEVERITY   lowest severity that fails: critical, high, medium, low
#                      (default: high)
#   SKIP_IDENTIFIED    "true" exempts components approved in scanoss.json
#                      from the licence rule (default: false). A rule that
#                      pins a version exempts only that version.
set -euo pipefail

RESULTS="${1:?usage: $0 <scanoss-results.json>}"
DENY_LICENSES="${DENY_LICENSES:-^(AGPL|GPL|SSPL)-}"
FAIL_ON_SEVERITY="${FAIL_ON_SEVERITY:-high}"
SKIP_IDENTIFIED="${SKIP_IDENTIFIED:-false}"

# Components scanoss.json doesn't approve (filter from the "Approve components" recipe).
rules=scanoss.json; [ -f "$rules" ] || rules=/dev/null
unapproved="$(jq -c --slurpfile rules "$rules" -f scanoss/unapproved.jq "$RESULTS" \
  | jq -cs 'map("\(.purl)@\(.version)")')"

case "$FAIL_ON_SEVERITY" in
  critical|high|medium|low) ;;
  *) echo "FAIL_ON_SEVERITY must be critical, high, medium, or low" >&2; exit 1 ;;
esac

# Rule 1: licences on the deny-list.
licence_hits="$(jq -r --arg deny "$DENY_LICENSES" --arg skip "$SKIP_IDENTIFIED" \
    --argjson unapproved "$unapproved" '
  .components[]
  | select($skip != "true" or (.identified | not)
           or ("\(.purl)@\(.version)" as $key | $unapproved | index($key)))
  | [.licenses[]?.id | select(test($deny))] as $bad
  | select($bad | length > 0)
  | "\(.purl)@\(.version // "unknown")  \($bad | unique | join(", "))"
' "$RESULTS")"

# Rule 2: vulnerabilities at or above the threshold.
vuln_hits="$(jq -r --arg min "$FAIL_ON_SEVERITY" '
  {"critical": 4, "high": 3, "medium": 2, "low": 1} as $rank
  | .vulnerabilities[]?
  | select(($rank[(.severity // "") | ascii_downcase] // 0) >= $rank[$min])
  | "\(.id)  \(.severity)  \(.purls // [] | join(", "))"
' "$RESULTS")"

status=0
if [ -n "$licence_hits" ]; then
  echo "Disallowed licences (pattern: $DENY_LICENSES):"
  echo "$licence_hits"
  status=2
fi
if [ -n "$vuln_hits" ]; then
  echo "Vulnerabilities at or above '$FAIL_ON_SEVERITY':"
  echo "$vuln_hits"
  status=2
fi
[ "$status" -eq 0 ] && echo "Licence and vulnerability policy passed."
exit "$status"

scanoss-cli scan . --include licenses,vulns --output scanoss-results.json
ci/scanoss-policy.sh scanoss-results.json

# Only strong copyleft network licences
DENY_LICENSES='^(AGPL|SSPL)-' ci/scanoss-policy.sh scanoss-results.json

# An explicit list of IDs
DENY_LICENSES='^(GPL-3\.0-only|GPL-3\.0-or-later|AGPL-3\.0-only)$' ci/scanoss-policy.sh scanoss-results.json

Disallowed licences (pattern: ^(AGPL|GPL|SSPL)-):
pkg:github/example/readline@8.1  GPL-3.0-or-later
Vulnerabilities at or above 'high':
CVE-2022-37434  CRITICAL  pkg:github/madler/zlib@1.2.11

# Licences
jq -r --arg deny '^(AGPL|GPL|SSPL)-' '
  .components[]
  | [.licenses[]?.license.id // empty | select(test($deny))] as $bad
  | select($bad | length > 0)
  | "\(.purl)  \($bad | join(", "))"' sbom.cdx.json

# Vulnerabilities rated critical or high
jq -r '
  .vulnerabilities[]?
  | select([.ratings[]?.severity] | any(. == "critical" or . == "high"))
  | "\(.id)  \([.affects[]?.ref] | join(", "))"' sbom.cdx.json