Dependency Track

#!/usr/bin/env bash
#
# manage-projects.sh - Dependency-Track project management utilities
#
# Usage:
#   ./manage-projects.sh list
#   ./manage-projects.sh get -n "project-name" -v "1.0.0"
#   ./manage-projects.sh create -n "project-name" -v "1.0.0" -d "Description"
#   ./manage-projects.sh delete -u "project-uuid"
#   ./manage-projects.sh export -n "project-name" -v "1.0.0" -o sbom.json
#
# Environment variables:
#   DTRACK_URL      - Dependency-Track base URL
#   DTRACK_API_KEY  - API key for authentication

set -euo pipefail

# Colors
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m'

usage() {
    cat <<EOF
Usage: $0 <command> [options]

Commands:
    list                        List all projects
    get                         Get project details
    create                      Create a new project
    delete                      Delete a project
    export                      Export project SBOM
    vulnerabilities             List project vulnerabilities
    components                  List project components

Options:
    -n, --name          Project name
    -v, --version       Project version
    -u, --uuid          Project UUID
    -d, --description   Project description (for create)
    -t, --tags          Comma-separated tags (for create)
    -o, --output        Output file (for export)
    -f, --format        Output format: json, xml (for export, default: json)
    --json              Output as JSON
    -h, --help          Show this help

Environment:
    DTRACK_URL          Dependency-Track base URL
    DTRACK_API_KEY      API key for authentication
EOF
    exit 1
}

log_info() { echo -e "${GREEN}[INFO]${NC} $1"; }
log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
log_error() { echo -e "${RED}[ERROR]${NC} $1" >&2; }

check_env() {
    if [[ -z "${DTRACK_URL:-}" ]]; then
        log_error "DTRACK_URL environment variable not set"
        exit 1
    fi
    if [[ -z "${DTRACK_API_KEY:-}" ]]; then
        log_error "DTRACK_API_KEY environment variable not set"
        exit 1
    fi
}

api_get() {
    curl -s -H "X-Api-Key: ${DTRACK_API_KEY}" "${DTRACK_URL}/api/v1$1"
}

api_put() {
    curl -s -X PUT -H "X-Api-Key: ${DTRACK_API_KEY}" \
        -H "Content-Type: application/json" \
        "${DTRACK_URL}/api/v1$1" -d "$2"
}

api_delete() {
    curl -s -X DELETE -H "X-Api-Key: ${DTRACK_API_KEY}" "${DTRACK_URL}/api/v1$1"
}

cmd_list() {
    local json_output="false"

    while [[ $# -gt 0 ]]; do
        case $1 in
            --json) json_output="true"; shift ;;
            *) shift ;;
        esac
    done

    PROJECTS=$(api_get "/project?pageSize=1000")

    if [[ "$json_output" == "true" ]]; then
        echo "$PROJECTS" | jq .
    else
        echo ""
        echo "Projects:"
        echo "=========================================="
        echo "$PROJECTS" | jq -r '.[] | "\(.name):\(.version) (\(.uuid))"' | sort
        echo ""
        TOTAL=$(echo "$PROJECTS" | jq 'length')
        echo "Total: $TOTAL projects"
    fi
}

cmd_get() {
    local project_name="" project_version="" project_uuid="" json_output="false"

    while [[ $# -gt 0 ]]; do
        case $1 in
            -n|--name) project_name="$2"; shift 2 ;;
            -v|--version) project_version="$2"; shift 2 ;;
            -u|--uuid) project_uuid="$2"; shift 2 ;;
            --json) json_output="true"; shift ;;
            *) shift ;;
        esac
    done

    if [[ -n "$project_uuid" ]]; then
        PROJECT=$(api_get "/project/${project_uuid}")
    elif [[ -n "$project_name" && -n "$project_version" ]]; then
        PROJECT=$(api_get "/project/lookup?name=${project_name}&version=${project_version}")
    else
        log_error "Either --uuid or --name and --version required"
        exit 1
    fi

    if [[ "$json_output" == "true" ]]; then
        echo "$PROJECT" | jq .
    else
        echo ""
        echo "Project Details:"
        echo "=========================================="
        echo "Name:        $(echo "$PROJECT" | jq -r '.name')"
        echo "Version:     $(echo "$PROJECT" | jq -r '.version')"
        echo "UUID:        $(echo "$PROJECT" | jq -r '.uuid')"
        echo "Description: $(echo "$PROJECT" | jq -r '.description // "N/A"')"
        echo "Active:      $(echo "$PROJECT" | jq -r '.active')"
        echo "Tags:        $(echo "$PROJECT" | jq -r '[.tags[]?.name] | join(", ") // "None"')"
        echo "Last BOM:    $(echo "$PROJECT" | jq -r '.lastBomImportFormat // "N/A"')"
        echo "Created:     $(echo "$PROJECT" | jq -r '.created // "N/A"')"
    fi
}

cmd_create() {
    local project_name="" project_version="" description="" tags=""

    while [[ $# -gt 0 ]]; do
        case $1 in
            -n|--name) project_name="$2"; shift 2 ;;
            -v|--version) project_version="$2"; shift 2 ;;
            -d|--description) description="$2"; shift 2 ;;
            -t|--tags) tags="$2"; shift 2 ;;
            *) shift ;;
        esac
    done

    if [[ -z "$project_name" || -z "$project_version" ]]; then
        log_error "--name and --version required"
        exit 1
    fi

    # Build tags JSON array
    local tags_json="[]"
    if [[ -n "$tags" ]]; then
        tags_json=$(echo "$tags" | tr ',' '\n' | jq -R . | jq -s 'map({name: .})')
    fi

    local payload
    payload=$(jq -n \
        --arg name "$project_name" \
        --arg version "$project_version" \
        --arg description "$description" \
        --argjson tags "$tags_json" \
        '{name: $name, version: $version, description: $description, tags: $tags, active: true}')

    log_info "Creating project: ${project_name}:${project_version}"
    RESULT=$(api_put "/project" "$payload")

    uuid=$(echo "$RESULT" | jq -r '.uuid')
    if [[ "$uuid" != "null" && -n "$uuid" ]]; then
        log_info "Project created successfully!"
        echo "UUID: $uuid"
    else
        log_error "Failed to create project"
        echo "$RESULT"
        exit 1
    fi
}

cmd_delete() {
    local project_uuid=""

    while [[ $# -gt 0 ]]; do
        case $1 in
            -u|--uuid) project_uuid="$2"; shift 2 ;;
            *) shift ;;
        esac
    done

    if [[ -z "$project_uuid" ]]; then
        log_error "--uuid required"
        exit 1
    fi

    log_warn "Deleting project: $project_uuid"
    read -p "Are you sure? (y/N) " -n 1 -r
    echo

    if [[ $REPLY =~ ^[Yy]$ ]]; then
        api_delete "/project/${project_uuid}"
        log_info "Project deleted"
    else
        log_info "Cancelled"
    fi
}

cmd_export() {
    local project_name="" project_version="" output_file="" format="json"

    while [[ $# -gt 0 ]]; do
        case $1 in
            -n|--name) project_name="$2"; shift 2 ;;
            -v|--version) project_version="$2"; shift 2 ;;
            -o|--output) output_file="$2"; shift 2 ;;
            -f|--format) format="$2"; shift 2 ;;
            *) shift ;;
        esac
    done

    if [[ -z "$project_name" || -z "$project_version" ]]; then
        log_error "--name and --version required"
        exit 1
    fi

    # Get project UUID
    PROJECT=$(api_get "/project/lookup?name=${project_name}&version=${project_version}")
    project_uuid=$(echo "$PROJECT" | jq -r '.uuid')

    if [[ "$project_uuid" == "null" || -z "$project_uuid" ]]; then
        log_error "Project not found"
        exit 1
    fi

    log_info "Exporting SBOM for ${project_name}:${project_version}"

    SBOM=$(curl -s -H "X-Api-Key: ${DTRACK_API_KEY}" \
        "${DTRACK_URL}/api/v1/bom/cyclonedx/project/${project_uuid}?format=${format}")

    if [[ -n "$output_file" ]]; then
        echo "$SBOM" > "$output_file"
        log_info "SBOM exported to: $output_file"
    else
        echo "$SBOM"
    fi
}

cmd_vulnerabilities() {
    local project_name="" project_version="" json_output="false"

    while [[ $# -gt 0 ]]; do
        case $1 in
            -n|--name) project_name="$2"; shift 2 ;;
            -v|--version) project_version="$2"; shift 2 ;;
            --json) json_output="true"; shift ;;
            *) shift ;;
        esac
    done

    PROJECT=$(api_get "/project/lookup?name=${project_name}&version=${project_version}")
    project_uuid=$(echo "$PROJECT" | jq -r '.uuid')

    VULNS=$(api_get "/vulnerability/project/${project_uuid}")

    if [[ "$json_output" == "true" ]]; then
        echo "$VULNS" | jq .
    else
        echo ""
        echo "Vulnerabilities for ${project_name}:${project_version}:"
        echo "=========================================="
        echo "$VULNS" | jq -r '.[] | "\(.vulnerability.severity): \(.vulnerability.vulnId) - \(.component.name):\(.component.version)"' | sort
        echo ""
        echo "Summary:"
        echo "  Critical: $(echo "$VULNS" | jq '[.[] | select(.vulnerability.severity == "CRITICAL")] | length')"
        echo "  High:     $(echo "$VULNS" | jq '[.[] | select(.vulnerability.severity == "HIGH")] | length')"
        echo "  Medium:   $(echo "$VULNS" | jq '[.[] | select(.vulnerability.severity == "MEDIUM")] | length')"
        echo "  Low:      $(echo "$VULNS" | jq '[.[] | select(.vulnerability.severity == "LOW")] | length')"
    fi
}

cmd_components() {
    local project_name="" project_version="" json_output="false"

    while [[ $# -gt 0 ]]; do
        case $1 in
            -n|--name) project_name="$2"; shift 2 ;;
            -v|--version) project_version="$2"; shift 2 ;;
            --json) json_output="true"; shift ;;
            *) shift ;;
        esac
    done

    PROJECT=$(api_get "/project/lookup?name=${project_name}&version=${project_version}")
    project_uuid=$(echo "$PROJECT" | jq -r '.uuid')

    COMPONENTS=$(api_get "/component/project/${project_uuid}?pageSize=1000")

    if [[ "$json_output" == "true" ]]; then
        echo "$COMPONENTS" | jq .
    else
        echo ""
        echo "Components for ${project_name}:${project_version}:"
        echo "=========================================="
        echo "$COMPONENTS" | jq -r '.[] | "\(.name):\(.version) [\(.purl // "no-purl")]"' | sort
        echo ""
        TOTAL=$(echo "$COMPONENTS" | jq 'length')
        echo "Total: $TOTAL components"
    fi
}

# Main
check_env

COMMAND="${1:-}"
shift || true

case "$COMMAND" in
    list)
        cmd_list "$@"
        ;;
    get)
        cmd_get "$@"
        ;;
    create)
        cmd_create "$@"
        ;;
    delete)
        cmd_delete "$@"
        ;;
    export)
        cmd_export "$@"
        ;;
    vulnerabilities|vulns)
        cmd_vulnerabilities "$@"
        ;;
    components)
        cmd_components "$@"
        ;;
    -h|--help|"")
        usage
        ;;
    *)
        log_error "Unknown command: $COMMAND"
        usage
        ;;
esac

#!/usr/bin/env bash
#
# security-gate.sh - Security gate check for CI/CD pipelines
#
# Usage:
#   ./security-gate.sh -n "project-name" -v "1.0.0"
#   ./security-gate.sh -n "project-name" -v "1.0.0" --max-critical 0 --max-high 5
#
# Environment variables:
#   DTRACK_URL      - Dependency-Track base URL
#   DTRACK_API_KEY  - API key for authentication
#
# Options:
#   -n, --name          Project name (required)
#   -v, --version       Project version (required)
#   --max-critical      Maximum allowed critical vulnerabilities (default: 0)
#   --max-high          Maximum allowed high vulnerabilities (default: 0)
#   --max-medium        Maximum allowed medium vulnerabilities (default: unlimited)
#   --max-low           Maximum allowed low vulnerabilities (default: unlimited)
#   --max-policy-fail   Maximum allowed FAIL policy violations (default: 0)
#   --fail-on-warn      Fail on policy WARN violations
#   -o, --output        Output format: text, json, github (default: text)
#   -h, --help          Show this help message

set -euo pipefail

# Default thresholds
MAX_CRITICAL=0
MAX_HIGH=0
MAX_MEDIUM=999999
MAX_LOW=999999
MAX_POLICY_FAIL=0
FAIL_ON_WARN="false"
OUTPUT_FORMAT="text"

# Colors
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

usage() {
    grep '^#' "$0" | grep -v '#!/' | cut -c3-
    exit 1
}

log_info() {
    [[ "$OUTPUT_FORMAT" == "text" ]] && echo -e "${GREEN}[INFO]${NC} $1"
}

log_warn() {
    [[ "$OUTPUT_FORMAT" == "text" ]] && echo -e "${YELLOW}[WARN]${NC} $1"
}

log_error() {
    [[ "$OUTPUT_FORMAT" == "text" ]] && echo -e "${RED}[ERROR]${NC} $1" >&2
}

# Parse arguments
while [[ $# -gt 0 ]]; do
    case $1 in
        -n|--name)
            PROJECT_NAME="$2"
            shift 2
            ;;
        -v|--version)
            PROJECT_VERSION="$2"
            shift 2
            ;;
        --max-critical)
            MAX_CRITICAL="$2"
            shift 2
            ;;
        --max-high)
            MAX_HIGH="$2"
            shift 2
            ;;
        --max-medium)
            MAX_MEDIUM="$2"
            shift 2
            ;;
        --max-low)
            MAX_LOW="$2"
            shift 2
            ;;
        --max-policy-fail)
            MAX_POLICY_FAIL="$2"
            shift 2
            ;;
        --fail-on-warn)
            FAIL_ON_WARN="true"
            shift
            ;;
        -o|--output)
            OUTPUT_FORMAT="$2"
            shift 2
            ;;
        -h|--help)
            usage
            ;;
        *)
            log_error "Unknown option: $1"
            usage
            ;;
    esac
done

# Validate environment
if [[ -z "${DTRACK_URL:-}" ]]; then
    log_error "DTRACK_URL environment variable not set"
    exit 1
fi

if [[ -z "${DTRACK_API_KEY:-}" ]]; then
    log_error "DTRACK_API_KEY environment variable not set"
    exit 1
fi

if [[ -z "${PROJECT_NAME:-}" || -z "${PROJECT_VERSION:-}" ]]; then
    log_error "Project name (-n) and version (-v) are required"
    usage
fi

# Get project UUID
log_info "Looking up project: ${PROJECT_NAME}:${PROJECT_VERSION}"
PROJECT=$(curl -s -H "X-Api-Key: ${DTRACK_API_KEY}" \
    "${DTRACK_URL}/api/v1/project/lookup?name=${PROJECT_NAME}&version=${PROJECT_VERSION}")

PROJECT_UUID=$(echo "$PROJECT" | jq -r '.uuid // empty')

if [[ -z "$PROJECT_UUID" ]]; then
    log_error "Project not found: ${PROJECT_NAME}:${PROJECT_VERSION}"
    exit 1
fi

log_info "Project UUID: $PROJECT_UUID"

# Get vulnerability metrics
METRICS=$(curl -s -H "X-Api-Key: ${DTRACK_API_KEY}" \
    "${DTRACK_URL}/api/v1/metrics/project/${PROJECT_UUID}/current")

CRITICAL=$(echo "$METRICS" | jq -r '.critical // 0')
HIGH=$(echo "$METRICS" | jq -r '.high // 0')
MEDIUM=$(echo "$METRICS" | jq -r '.medium // 0')
LOW=$(echo "$METRICS" | jq -r '.low // 0')
UNASSIGNED=$(echo "$METRICS" | jq -r '.unassigned // 0')

# Get policy violations
VIOLATIONS=$(curl -s -H "X-Api-Key: ${DTRACK_API_KEY}" \
    "${DTRACK_URL}/api/v1/violation/project/${PROJECT_UUID}")

POLICY_FAIL=$(echo "$VIOLATIONS" | jq '[.[] | select(.policyViolation.violationState == "FAIL")] | length')
POLICY_WARN=$(echo "$VIOLATIONS" | jq '[.[] | select(.policyViolation.violationState == "WARN")] | length')
POLICY_INFO=$(echo "$VIOLATIONS" | jq '[.[] | select(.policyViolation.violationState == "INFO")] | length')

# Determine result
RESULT="PASSED"
FAILURES=()

if [[ $CRITICAL -gt $MAX_CRITICAL ]]; then
    FAILURES+=("Critical: $CRITICAL > $MAX_CRITICAL")
    RESULT="FAILED"
fi

if [[ $HIGH -gt $MAX_HIGH ]]; then
    FAILURES+=("High: $HIGH > $MAX_HIGH")
    RESULT="FAILED"
fi

if [[ $MEDIUM -gt $MAX_MEDIUM ]]; then
    FAILURES+=("Medium: $MEDIUM > $MAX_MEDIUM")
    RESULT="FAILED"
fi

if [[ $LOW -gt $MAX_LOW ]]; then
    FAILURES+=("Low: $LOW > $MAX_LOW")
    RESULT="FAILED"
fi

if [[ $POLICY_FAIL -gt $MAX_POLICY_FAIL ]]; then
    FAILURES+=("Policy FAIL: $POLICY_FAIL > $MAX_POLICY_FAIL")
    RESULT="FAILED"
fi

if [[ "$FAIL_ON_WARN" == "true" && $POLICY_WARN -gt 0 ]]; then
    FAILURES+=("Policy WARN: $POLICY_WARN (--fail-on-warn enabled)")
    RESULT="FAILED"
fi

# Output results
case "$OUTPUT_FORMAT" in
    json)
        cat <<EOF
{
    "result": "$RESULT",
    "project": {
        "name": "$PROJECT_NAME",
        "version": "$PROJECT_VERSION",
        "uuid": "$PROJECT_UUID"
    },
    "vulnerabilities": {
        "critical": $CRITICAL,
        "high": $HIGH,
        "medium": $MEDIUM,
        "low": $LOW,
        "unassigned": $UNASSIGNED
    },
    "thresholds": {
        "critical": $MAX_CRITICAL,
        "high": $MAX_HIGH,
        "medium": $MAX_MEDIUM,
        "low": $MAX_LOW
    },
    "policyViolations": {
        "fail": $POLICY_FAIL,
        "warn": $POLICY_WARN,
        "info": $POLICY_INFO
    },
    "failures": $(printf '%s\n' "${FAILURES[@]:-}" | jq -R . | jq -s .)
}
EOF
        ;;

    github)
        # GitHub Actions output format
        echo "result=$RESULT" >> "${GITHUB_OUTPUT:-/dev/stdout}"
        echo "critical=$CRITICAL" >> "${GITHUB_OUTPUT:-/dev/stdout}"
        echo "high=$HIGH" >> "${GITHUB_OUTPUT:-/dev/stdout}"
        echo "medium=$MEDIUM" >> "${GITHUB_OUTPUT:-/dev/stdout}"
        echo "low=$LOW" >> "${GITHUB_OUTPUT:-/dev/stdout}"
        echo "policy_fail=$POLICY_FAIL" >> "${GITHUB_OUTPUT:-/dev/stdout}"
        echo "policy_warn=$POLICY_WARN" >> "${GITHUB_OUTPUT:-/dev/stdout}"

        # Summary
        {
            echo "## Security Gate: $RESULT"
            echo ""
            echo "| Severity | Count | Threshold |"
            echo "|----------|-------|-----------|"
            echo "| Critical | $CRITICAL | $MAX_CRITICAL |"
            echo "| High | $HIGH | $MAX_HIGH |"
            echo "| Medium | $MEDIUM | $MAX_MEDIUM |"
            echo "| Low | $LOW | $MAX_LOW |"
            echo ""
            echo "### Policy Violations"
            echo "- FAIL: $POLICY_FAIL"
            echo "- WARN: $POLICY_WARN"
            echo "- INFO: $POLICY_INFO"
        } >> "${GITHUB_STEP_SUMMARY:-/dev/stdout}"
        ;;

    text|*)
        echo ""
        echo "========================================"
        echo "Security Gate: $RESULT"
        echo "========================================"
        echo "Project: ${PROJECT_NAME}:${PROJECT_VERSION}"
        echo ""
        echo "Vulnerabilities:"
        echo "  Critical:   $CRITICAL (max: $MAX_CRITICAL)"
        echo "  High:       $HIGH (max: $MAX_HIGH)"
        echo "  Medium:     $MEDIUM (max: $MAX_MEDIUM)"
        echo "  Low:        $LOW (max: $MAX_LOW)"
        echo "  Unassigned: $UNASSIGNED"
        echo ""
        echo "Policy Violations:"
        echo "  FAIL: $POLICY_FAIL (max: $MAX_POLICY_FAIL)"
        echo "  WARN: $POLICY_WARN"
        echo "  INFO: $POLICY_INFO"
        echo ""

        if [[ ${#FAILURES[@]} -gt 0 ]]; then
            echo "Failures:"
            for failure in "${FAILURES[@]}"; do
                echo "  - $failure"
            done
        fi
        echo "========================================"
        ;;
esac

# Exit with appropriate code
if [[ "$RESULT" == "PASSED" ]]; then
    exit 0
else
    exit 1
fi

#!/usr/bin/env bash
#
# upload-sbom.sh - Upload CycloneDX SBOM to Dependency-Track
#
# Usage:
#   ./upload-sbom.sh -f bom.json -n "project-name" -v "1.0.0"
#   ./upload-sbom.sh -f bom.json -u "project-uuid"
#
# Environment variables:
#   DTRACK_URL      - Dependency-Track base URL
#   DTRACK_API_KEY  - API key for authentication
#
# Options:
#   -f, --file      BOM file path (required)
#   -n, --name      Project name (required if no UUID)
#   -v, --version   Project version (required if no UUID)
#   -u, --uuid      Project UUID (alternative to name/version)
#   -a, --auto      Auto-create project if not exists (default: true)
#   -w, --wait      Wait for processing to complete
#   -t, --timeout   Timeout in seconds for waiting (default: 300)
#   -h, --help      Show this help message

set -euo pipefail

# Default values
AUTO_CREATE="true"
WAIT="false"
TIMEOUT=300
POLL_INTERVAL=5

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

usage() {
    grep '^#' "$0" | grep -v '#!/' | cut -c3-
    exit 1
}

log_info() {
    echo -e "${GREEN}[INFO]${NC} $1"
}

log_warn() {
    echo -e "${YELLOW}[WARN]${NC} $1"
}

log_error() {
    echo -e "${RED}[ERROR]${NC} $1" >&2
}

# Parse command line arguments
while [[ $# -gt 0 ]]; do
    case $1 in
        -f|--file)
            BOM_FILE="$2"
            shift 2
            ;;
        -n|--name)
            PROJECT_NAME="$2"
            shift 2
            ;;
        -v|--version)
            PROJECT_VERSION="$2"
            shift 2
            ;;
        -u|--uuid)
            PROJECT_UUID="$2"
            shift 2
            ;;
        -a|--auto)
            AUTO_CREATE="$2"
            shift 2
            ;;
        -w|--wait)
            WAIT="true"
            shift
            ;;
        -t|--timeout)
            TIMEOUT="$2"
            shift 2
            ;;
        -h|--help)
            usage
            ;;
        *)
            log_error "Unknown option: $1"
            usage
            ;;
    esac
done

# Validate environment
if [[ -z "${DTRACK_URL:-}" ]]; then
    log_error "DTRACK_URL environment variable not set"
    exit 1
fi

if [[ -z "${DTRACK_API_KEY:-}" ]]; then
    log_error "DTRACK_API_KEY environment variable not set"
    exit 1
fi

# Validate arguments
if [[ -z "${BOM_FILE:-}" ]]; then
    log_error "BOM file is required (-f/--file)"
    usage
fi

if [[ ! -f "$BOM_FILE" ]]; then
    log_error "BOM file not found: $BOM_FILE"
    exit 1
fi

if [[ -z "${PROJECT_UUID:-}" ]] && [[ -z "${PROJECT_NAME:-}" || -z "${PROJECT_VERSION:-}" ]]; then
    log_error "Either project UUID (-u) or project name (-n) and version (-v) are required"
    usage
fi

# Base64 encode the BOM
log_info "Encoding BOM file: $BOM_FILE"
BOM_CONTENT=$(base64 -w0 "$BOM_FILE")

# Build JSON payload
if [[ -n "${PROJECT_UUID:-}" ]]; then
    PAYLOAD=$(cat <<EOF
{
    "project": "${PROJECT_UUID}",
    "autoCreate": ${AUTO_CREATE},
    "bom": "${BOM_CONTENT}"
}
EOF
)
else
    PAYLOAD=$(cat <<EOF
{
    "projectName": "${PROJECT_NAME}",
    "projectVersion": "${PROJECT_VERSION}",
    "autoCreate": ${AUTO_CREATE},
    "bom": "${BOM_CONTENT}"
}
EOF
)
fi

# Upload SBOM
log_info "Uploading SBOM to Dependency-Track..."
RESPONSE=$(curl -s -w "\n%{http_code}" -X PUT "${DTRACK_URL}/api/v1/bom" \
    -H "X-Api-Key: ${DTRACK_API_KEY}" \
    -H "Content-Type: application/json" \
    -d "${PAYLOAD}")

HTTP_CODE=$(echo "$RESPONSE" | tail -n1)
BODY=$(echo "$RESPONSE" | head -n-1)

if [[ "$HTTP_CODE" -ne 200 ]]; then
    log_error "Failed to upload SBOM. HTTP $HTTP_CODE"
    echo "$BODY"
    exit 1
fi

TOKEN=$(echo "$BODY" | jq -r '.token')
log_info "SBOM uploaded successfully. Token: $TOKEN"

# Wait for processing if requested
if [[ "$WAIT" == "true" ]]; then
    log_info "Waiting for BOM processing to complete (timeout: ${TIMEOUT}s)..."

    START_TIME=$(date +%s)
    while true; do
        ELAPSED=$(($(date +%s) - START_TIME))
        if [[ $ELAPSED -ge $TIMEOUT ]]; then
            log_error "Timeout waiting for BOM processing"
            exit 1
        fi

        STATUS=$(curl -s -H "X-Api-Key: ${DTRACK_API_KEY}" \
            "${DTRACK_URL}/api/v1/bom/token/${TOKEN}")

        PROCESSING=$(echo "$STATUS" | jq -r '.processing')

        if [[ "$PROCESSING" == "false" ]]; then
            log_info "BOM processing complete!"
            break
        fi

        echo -n "."
        sleep $POLL_INTERVAL
    done
fi

# Output the token for use in other scripts
echo "$TOKEN"

#!/usr/bin/env python3
"""
Dependency-Track Python Client

A comprehensive Python client for interacting with the Dependency-Track REST API.
Supports all common operations: projects, SBOMs, vulnerabilities, policies.

Requirements:
    pip install requests python-dotenv

Usage:
    from python_client import DependencyTrackClient

    client = DependencyTrackClient(
        base_url="https://dtrack.example.com",
        api_key="your-api-key"
    )

    # List all projects
    projects = client.get_projects()

    # Upload SBOM
    client.upload_sbom("bom.json", project_name="my-app", project_version="1.0.0")
"""

import os
import json
import base64
import time
from pathlib import Path
from typing import Optional, List, Dict, Any
from dataclasses import dataclass
from datetime import datetime

import requests
from requests.adapters import HTTPAdapter
from urllib3.util.retry import Retry


@dataclass
class VulnerabilitySummary:
    """Summary of vulnerabilities for a project."""
    critical: int = 0
    high: int = 0
    medium: int = 0
    low: int = 0
    unassigned: int = 0

    @property
    def total(self) -> int:
        return self.critical + self.high + self.medium + self.low + self.unassigned

    def exceeds_threshold(
        self,
        max_critical: int = 0,
        max_high: int = 0,
        max_medium: int = 0,
        max_low: int = 0
    ) -> bool:
        """Check if vulnerabilities exceed specified thresholds."""
        return (
            self.critical > max_critical or
            self.high > max_high or
            self.medium > max_medium or
            self.low > max_low
        )


@dataclass
class PolicyViolationSummary:
    """Summary of policy violations for a project."""
    fail: int = 0
    warn: int = 0
    info: int = 0

    @property
    def total(self) -> int:
        return self.fail + self.warn + self.info


class DependencyTrackClient:
    """Client for Dependency-Track REST API."""

    def __init__(
        self,
        base_url: Optional[str] = None,
        api_key: Optional[str] = None,
        timeout: int = 30,
        verify_ssl: bool = True
    ):
        """
        Initialize the Dependency-Track client.

        Args:
            base_url: Base URL of Dependency-Track instance (or DTRACK_URL env var)
            api_key: API key for authentication (or DTRACK_API_KEY env var)
            timeout: Request timeout in seconds
            verify_ssl: Whether to verify SSL certificates
        """
        self.base_url = (base_url or os.getenv("DTRACK_URL", "")).rstrip("/")
        self.api_key = api_key or os.getenv("DTRACK_API_KEY", "")

        if not self.base_url:
            raise ValueError("base_url or DTRACK_URL environment variable required")
        if not self.api_key:
            raise ValueError("api_key or DTRACK_API_KEY environment variable required")

        self.timeout = timeout
        self.verify_ssl = verify_ssl

        # Configure session with retries
        self.session = requests.Session()
        retry_strategy = Retry(
            total=3,
            backoff_factor=1,
            status_forcelist=[429, 500, 502, 503, 504]
        )
        adapter = HTTPAdapter(max_retries=retry_strategy)
        self.session.mount("http://", adapter)
        self.session.mount("https://", adapter)

        self.session.headers.update({
            "X-Api-Key": self.api_key,
            "Content-Type": "application/json",
            "Accept": "application/json"
        })

    def _request(
        self,
        method: str,
        endpoint: str,
        **kwargs
    ) -> requests.Response:
        """Make an API request."""
        url = f"{self.base_url}/api/v1{endpoint}"
        response = self.session.request(
            method,
            url,
            timeout=self.timeout,
            verify=self.verify_ssl,
            **kwargs
        )
        response.raise_for_status()
        return response

    def _get(self, endpoint: str, **kwargs) -> Any:
        """Make a GET request and return JSON."""
        return self._request("GET", endpoint, **kwargs).json()

    def _put(self, endpoint: str, **kwargs) -> Any:
        """Make a PUT request and return JSON."""
        return self._request("PUT", endpoint, **kwargs).json()

    def _post(self, endpoint: str, **kwargs) -> Any:
        """Make a POST request and return JSON."""
        return self._request("POST", endpoint, **kwargs).json()

    def _delete(self, endpoint: str, **kwargs) -> None:
        """Make a DELETE request."""
        self._request("DELETE", endpoint, **kwargs)

    # =========================================================================
    # Version / Health
    # =========================================================================
    def get_version(self) -> Dict[str, str]:
        """Get Dependency-Track version information."""
        return self._get("/version")

    def health_check(self) -> bool:
        """Check if Dependency-Track is healthy."""
        try:
            self.get_version()
            return True
        except Exception:
            return False

    # =========================================================================
    # Projects
    # =========================================================================
    def get_projects(
        self,
        name: Optional[str] = None,
        exclude_inactive: bool = False,
        only_root: bool = False,
        page_size: int = 100,
        page_number: int = 1
    ) -> List[Dict[str, Any]]:
        """
        Get all projects or filter by name.

        Args:
            name: Filter projects by name
            exclude_inactive: Exclude inactive projects
            only_root: Only return root projects (no children)
            page_size: Number of results per page
            page_number: Page number (1-indexed)
        """
        params = {
            "pageSize": page_size,
            "pageNumber": page_number,
            "excludeInactive": exclude_inactive,
            "onlyRoot": only_root
        }
        if name:
            params["name"] = name

        return self._get("/project", params=params)

    def get_project(self, uuid: str) -> Dict[str, Any]:
        """Get a project by UUID."""
        return self._get(f"/project/{uuid}")

    def get_project_by_name_version(
        self,
        name: str,
        version: str
    ) -> Optional[Dict[str, Any]]:
        """Look up a project by name and version."""
        try:
            return self._get("/project/lookup", params={"name": name, "version": version})
        except requests.HTTPError as e:
            if e.response.status_code == 404:
                return None
            raise

    def create_project(
        self,
        name: str,
        version: str,
        description: Optional[str] = None,
        tags: Optional[List[str]] = None,
        parent_uuid: Optional[str] = None,
        active: bool = True
    ) -> Dict[str, Any]:
        """
        Create a new project.

        Args:
            name: Project name
            version: Project version
            description: Project description
            tags: List of tag names
            parent_uuid: UUID of parent project
            active: Whether project is active
        """
        data = {
            "name": name,
            "version": version,
            "active": active
        }

        if description:
            data["description"] = description
        if tags:
            data["tags"] = [{"name": tag} for tag in tags]
        if parent_uuid:
            data["parent"] = {"uuid": parent_uuid}

        return self._put("/project", json=data)

    def delete_project(self, uuid: str) -> None:
        """Delete a project by UUID."""
        self._delete(f"/project/{uuid}")

    def get_project_children(self, uuid: str) -> List[Dict[str, Any]]:
        """Get child projects of a parent project."""
        return self._get(f"/project/{uuid}/children")

    # =========================================================================
    # SBOM / BOM
    # =========================================================================
    def upload_sbom(
        self,
        bom_path: str,
        project_uuid: Optional[str] = None,
        project_name: Optional[str] = None,
        project_version: Optional[str] = None,
        auto_create: bool = True,
        parent_uuid: Optional[str] = None
    ) -> Dict[str, Any]:
        """
        Upload a CycloneDX SBOM to Dependency-Track.

        Args:
            bom_path: Path to BOM file (JSON or XML)
            project_uuid: UUID of existing project (if known)
            project_name: Project name (required if no UUID)
            project_version: Project version (required if no UUID)
            auto_create: Create project if it doesn't exist
            parent_uuid: UUID of parent project for auto-created projects

        Returns:
            Upload response containing token for tracking
        """
        bom_path = Path(bom_path)
        if not bom_path.exists():
            raise FileNotFoundError(f"BOM file not found: {bom_path}")

        with open(bom_path, "rb") as f:
            bom_content = base64.b64encode(f.read()).decode("utf-8")

        data = {
            "bom": bom_content,
            "autoCreate": auto_create
        }

        if project_uuid:
            data["project"] = project_uuid
        else:
            if not project_name or not project_version:
                raise ValueError("project_name and project_version required when project_uuid not provided")
            data["projectName"] = project_name
            data["projectVersion"] = project_version

        if parent_uuid:
            data["parentUUID"] = parent_uuid

        return self._put("/bom", json=data)

    def upload_sbom_multipart(
        self,
        bom_path: str,
        project_name: str,
        project_version: str,
        auto_create: bool = True
    ) -> Dict[str, Any]:
        """
        Upload SBOM using multipart form data (no base64 encoding needed).
        Useful for very large SBOMs.
        """
        bom_path = Path(bom_path)
        if not bom_path.exists():
            raise FileNotFoundError(f"BOM file not found: {bom_path}")

        # Remove Content-Type header for multipart
        headers = {"X-Api-Key": self.api_key}

        with open(bom_path, "rb") as f:
            files = {"bom": (bom_path.name, f)}
            data = {
                "projectName": project_name,
                "projectVersion": project_version,
                "autoCreate": str(auto_create).lower()
            }

            response = self.session.post(
                f"{self.base_url}/api/v1/bom",
                headers=headers,
                files=files,
                data=data,
                timeout=self.timeout,
                verify=self.verify_ssl
            )
            response.raise_for_status()
            return response.json()

    def is_bom_processing_complete(self, token: str) -> bool:
        """Check if BOM processing is complete."""
        result = self._get(f"/bom/token/{token}")
        return result.get("processing", True) is False

    def wait_for_bom_processing(
        self,
        token: str,
        timeout_seconds: int = 300,
        poll_interval: int = 5
    ) -> bool:
        """
        Wait for BOM processing to complete.

        Args:
            token: Upload token from upload_sbom response
            timeout_seconds: Maximum time to wait
            poll_interval: Seconds between status checks

        Returns:
            True if processing completed, False if timeout
        """
        start_time = time.time()
        while time.time() - start_time < timeout_seconds:
            if self.is_bom_processing_complete(token):
                return True
            time.sleep(poll_interval)
        return False

    def export_sbom(
        self,
        project_uuid: str,
        format: str = "json",
        variant: str = "inventory"
    ) -> str:
        """
        Export a project's SBOM.

        Args:
            project_uuid: Project UUID
            format: Export format (json or xml)
            variant: BOM variant (inventory, withVulnerabilities, vdr, vex)

        Returns:
            SBOM content as string
        """
        params = {"format": format, "variant": variant}
        response = self._request("GET", f"/bom/cyclonedx/project/{project_uuid}", params=params)
        return response.text

    # =========================================================================
    # Vulnerabilities
    # =========================================================================
    def get_project_vulnerabilities(
        self,
        project_uuid: str,
        suppressed: bool = False
    ) -> List[Dict[str, Any]]:
        """Get vulnerabilities for a project."""
        params = {"suppressed": suppressed}
        return self._get(f"/vulnerability/project/{project_uuid}", params=params)

    def get_vulnerability(
        self,
        source: str,
        vuln_id: str
    ) -> Dict[str, Any]:
        """Get vulnerability details by source and ID."""
        return self._get(f"/vulnerability/source/{source}/vuln/{vuln_id}")

    def get_project_metrics(self, project_uuid: str) -> Dict[str, Any]:
        """Get current vulnerability metrics for a project."""
        return self._get(f"/metrics/project/{project_uuid}/current")

    def get_vulnerability_summary(self, project_uuid: str) -> VulnerabilitySummary:
        """Get vulnerability summary for a project."""
        metrics = self.get_project_metrics(project_uuid)
        return VulnerabilitySummary(
            critical=metrics.get("critical", 0),
            high=metrics.get("high", 0),
            medium=metrics.get("medium", 0),
            low=metrics.get("low", 0),
            unassigned=metrics.get("unassigned", 0)
        )

    # =========================================================================
    # Components
    # =========================================================================
    def get_project_components(
        self,
        project_uuid: str,
        page_size: int = 100,
        page_number: int = 1
    ) -> List[Dict[str, Any]]:
        """Get components for a project."""
        params = {"pageSize": page_size, "pageNumber": page_number}
        return self._get(f"/component/project/{project_uuid}", params=params)

    def get_component(self, uuid: str) -> Dict[str, Any]:
        """Get component details by UUID."""
        return self._get(f"/component/{uuid}")

    # =========================================================================
    # Policies
    # =========================================================================
    def get_policies(self) -> List[Dict[str, Any]]:
        """Get all policies."""
        return self._get("/policy")

    def get_policy(self, uuid: str) -> Dict[str, Any]:
        """Get a policy by UUID."""
        return self._get(f"/policy/{uuid}")

    def create_policy(
        self,
        name: str,
        operator: str = "ANY",
        violation_state: str = "FAIL",
        conditions: Optional[List[Dict[str, str]]] = None
    ) -> Dict[str, Any]:
        """
        Create a new policy.

        Args:
            name: Policy name
            operator: ALL or ANY
            violation_state: FAIL, WARN, or INFO
            conditions: List of policy conditions
        """
        data = {
            "name": name,
            "operator": operator,
            "violationState": violation_state
        }

        if conditions:
            data["policyConditions"] = conditions

        return self._put("/policy", json=data)

    def delete_policy(self, uuid: str) -> None:
        """Delete a policy by UUID."""
        self._delete(f"/policy/{uuid}")

    # =========================================================================
    # Policy Violations
    # =========================================================================
    def get_project_policy_violations(
        self,
        project_uuid: str,
        suppressed: bool = False
    ) -> List[Dict[str, Any]]:
        """Get policy violations for a project."""
        params = {"suppressed": suppressed}
        return self._get(f"/violation/project/{project_uuid}", params=params)

    def get_policy_violation_summary(
        self,
        project_uuid: str
    ) -> PolicyViolationSummary:
        """Get policy violation summary for a project."""
        violations = self.get_project_policy_violations(project_uuid)

        summary = PolicyViolationSummary()
        for v in violations:
            state = v.get("policyViolation", {}).get("violationState", "")
            if state == "FAIL":
                summary.fail += 1
            elif state == "WARN":
                summary.warn += 1
            elif state == "INFO":
                summary.info += 1

        return summary

    # =========================================================================
    # Findings (Analysis/Audit)
    # =========================================================================
    def get_project_findings(
        self,
        project_uuid: str,
        suppressed: bool = False
    ) -> List[Dict[str, Any]]:
        """Get findings (vulnerabilities with audit info) for a project."""
        params = {"suppressed": suppressed}
        return self._get(f"/finding/project/{project_uuid}", params=params)

    def update_analysis(
        self,
        project_uuid: str,
        component_uuid: str,
        vulnerability_uuid: str,
        state: str,
        comment: Optional[str] = None,
        suppressed: bool = False
    ) -> Dict[str, Any]:
        """
        Update vulnerability analysis/audit state.

        Args:
            project_uuid: Project UUID
            component_uuid: Component UUID
            vulnerability_uuid: Vulnerability UUID
            state: Analysis state (NOT_SET, EXPLOITABLE, IN_TRIAGE, FALSE_POSITIVE,
                   NOT_AFFECTED, RESOLVED)
            comment: Optional analysis comment
            suppressed: Whether to suppress the finding
        """
        data = {
            "project": project_uuid,
            "component": component_uuid,
            "vulnerability": vulnerability_uuid,
            "analysisState": state,
            "suppressed": suppressed
        }

        if comment:
            data["comment"] = comment

        return self._put("/analysis", json=data)

    # =========================================================================
    # License
    # =========================================================================
    def get_licenses(self) -> List[Dict[str, Any]]:
        """Get all licenses."""
        return self._get("/license")

    def get_license_groups(self) -> List[Dict[str, Any]]:
        """Get all license groups."""
        return self._get("/licenseGroup")


# =========================================================================
# CLI Interface
# =========================================================================
def main():
    """CLI interface for common operations."""
    import argparse

    parser = argparse.ArgumentParser(description="Dependency-Track CLI")
    parser.add_argument("--url", help="Dependency-Track URL", default=os.getenv("DTRACK_URL"))
    parser.add_argument("--api-key", help="API Key", default=os.getenv("DTRACK_API_KEY"))

    subparsers = parser.add_subparsers(dest="command", help="Commands")

    # Upload command
    upload_parser = subparsers.add_parser("upload", help="Upload SBOM")
    upload_parser.add_argument("bom", help="Path to BOM file")
    upload_parser.add_argument("--project", help="Project name")
    upload_parser.add_argument("--version", help="Project version")
    upload_parser.add_argument("--wait", action="store_true", help="Wait for processing")

    # List projects command
    subparsers.add_parser("projects", help="List projects")

    # Get metrics command
    metrics_parser = subparsers.add_parser("metrics", help="Get project metrics")
    metrics_parser.add_argument("project", help="Project name")
    metrics_parser.add_argument("version", help="Project version")

    # Security gate command
    gate_parser = subparsers.add_parser("gate", help="Security gate check")
    gate_parser.add_argument("project", help="Project name")
    gate_parser.add_argument("version", help="Project version")
    gate_parser.add_argument("--max-critical", type=int, default=0)
    gate_parser.add_argument("--max-high", type=int, default=0)

    args = parser.parse_args()

    if not args.url or not args.api_key:
        parser.error("--url and --api-key required (or set DTRACK_URL and DTRACK_API_KEY)")

    client = DependencyTrackClient(base_url=args.url, api_key=args.api_key)

    if args.command == "upload":
        result = client.upload_sbom(
            args.bom,
            project_name=args.project,
            project_version=args.version
        )
        print(f"Upload initiated. Token: {result.get('token')}")

        if args.wait:
            print("Waiting for processing...")
            if client.wait_for_bom_processing(result["token"]):
                print("Processing complete!")
            else:
                print("Processing timeout!")
                exit(1)

    elif args.command == "projects":
        projects = client.get_projects()
        for p in projects:
            print(f"{p['name']}:{p['version']} ({p['uuid']})")

    elif args.command == "metrics":
        project = client.get_project_by_name_version(args.project, args.version)
        if not project:
            print(f"Project not found: {args.project}:{args.version}")
            exit(1)

        summary = client.get_vulnerability_summary(project["uuid"])
        print(f"Vulnerabilities for {args.project}:{args.version}")
        print(f"  Critical: {summary.critical}")
        print(f"  High:     {summary.high}")
        print(f"  Medium:   {summary.medium}")
        print(f"  Low:      {summary.low}")
        print(f"  Total:    {summary.total}")

    elif args.command == "gate":
        project = client.get_project_by_name_version(args.project, args.version)
        if not project:
            print(f"Project not found: {args.project}:{args.version}")
            exit(1)

        summary = client.get_vulnerability_summary(project["uuid"])

        if summary.exceeds_threshold(
            max_critical=args.max_critical,
            max_high=args.max_high
        ):
            print(f"FAILED: Vulnerabilities exceed threshold")
            print(f"  Critical: {summary.critical} (max: {args.max_critical})")
            print(f"  High: {summary.high} (max: {args.max_high})")
            exit(1)
        else:
            print("PASSED: Security gate check")


if __name__ == "__main__":
    main()

# Azure DevOps Pipeline - Dependency-Track Integration
# Complete CI/CD pipeline with SBOM generation and security gates

trigger:
  branches:
    include:
      - main
      - develop
  paths:
    exclude:
      - '*.md'
      - 'docs/**'

pr:
  branches:
    include:
      - main
  drafts: false

pool:
  vmImage: 'ubuntu-latest'

variables:
  - group: dependency-track-credentials  # Contains DTRACK_URL and DTRACK_API_KEY
  - name: projectName
    value: '$(Build.Repository.Name)'
  - name: projectVersion
    value: '$(Build.SourceBranchName)'

stages:
  # ============================================
  # Stage 1: Build
  # ============================================
  - stage: Build
    displayName: 'Build Application'
    jobs:
      - job: BuildJob
        displayName: 'Build'
        steps:
          - checkout: self
            fetchDepth: 0

          # Node.js build
          - task: NodeTool@0
            displayName: 'Install Node.js'
            inputs:
              versionSpec: '20.x'

          - task: Npm@1
            displayName: 'npm install'
            inputs:
              command: 'ci'

          - task: Npm@1
            displayName: 'npm build'
            inputs:
              command: 'custom'
              customCommand: 'run build'

          # Publish build artifacts
          - task: PublishPipelineArtifact@1
            displayName: 'Publish Build Artifacts'
            inputs:
              targetPath: '$(Build.SourcesDirectory)/dist'
              artifact: 'build'

  # ============================================
  # Stage 2: Security Scan
  # ============================================
  - stage: Security
    displayName: 'Security Analysis'
    dependsOn: Build
    jobs:
      - job: GenerateSBOM
        displayName: 'Generate SBOM'
        steps:
          - checkout: self

          - task: NodeTool@0
            displayName: 'Install Node.js'
            inputs:
              versionSpec: '20.x'

          - task: Npm@1
            displayName: 'npm install'
            inputs:
              command: 'ci'

          # Generate SBOM using CycloneDX
          - task: Bash@3
            displayName: 'Generate CycloneDX SBOM'
            inputs:
              targetType: 'inline'
              script: |
                npx @cyclonedx/cyclonedx-npm --output-file $(Build.ArtifactStagingDirectory)/bom.json
                echo "SBOM generated successfully"
                cat $(Build.ArtifactStagingDirectory)/bom.json | jq '.metadata'

          # Alternative: Use Syft for container scanning
          # - task: Bash@3
          #   displayName: 'Generate SBOM with Syft'
          #   inputs:
          #     targetType: 'inline'
          #     script: |
          #       curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin
          #       syft packages dir:. -o cyclonedx-json > $(Build.ArtifactStagingDirectory)/bom.json

          - task: PublishPipelineArtifact@1
            displayName: 'Publish SBOM'
            inputs:
              targetPath: '$(Build.ArtifactStagingDirectory)/bom.json'
              artifact: 'sbom'

      - job: UploadSBOM
        displayName: 'Upload SBOM to Dependency-Track'
        dependsOn: GenerateSBOM
        steps:
          - task: DownloadPipelineArtifact@2
            displayName: 'Download SBOM'
            inputs:
              artifact: 'sbom'
              path: '$(Pipeline.Workspace)/sbom'

          - task: Bash@3
            displayName: 'Upload SBOM to Dependency-Track'
            inputs:
              targetType: 'inline'
              script: |
                set -e

                BOM_FILE="$(Pipeline.Workspace)/sbom/bom.json"

                # Base64 encode the SBOM
                BOM_CONTENT=$(base64 -w0 "$BOM_FILE")

                # Upload to Dependency-Track
                RESPONSE=$(curl -s -w "\n%{http_code}" -X PUT "$(DTRACK_URL)/api/v1/bom" \
                  -H "X-Api-Key: $(DTRACK_API_KEY)" \
                  -H "Content-Type: application/json" \
                  -d "{
                    \"projectName\": \"$(projectName)\",
                    \"projectVersion\": \"$(projectVersion)\",
                    \"autoCreate\": true,
                    \"bom\": \"${BOM_CONTENT}\"
                  }")

                HTTP_CODE=$(echo "$RESPONSE" | tail -n1)
                BODY=$(echo "$RESPONSE" | head -n-1)

                if [ "$HTTP_CODE" -ne 200 ]; then
                  echo "##[error]Failed to upload SBOM. HTTP $HTTP_CODE"
                  echo "$BODY"
                  exit 1
                fi

                echo "##[section]SBOM uploaded successfully"
                TOKEN=$(echo "$BODY" | jq -r '.token')
                echo "##vso[task.setvariable variable=uploadToken;isOutput=true]$TOKEN"
            name: upload

      - job: SecurityGate
        displayName: 'Security Gate'
        dependsOn: UploadSBOM
        steps:
          - task: Bash@3
            displayName: 'Wait for Analysis'
            inputs:
              targetType: 'inline'
              script: |
                echo "Waiting for Dependency-Track to process SBOM..."
                sleep 45

          - task: Bash@3
            displayName: 'Check Vulnerabilities'
            inputs:
              targetType: 'inline'
              script: |
                set -e

                # Get project UUID
                PROJECT=$(curl -s -H "X-Api-Key: $(DTRACK_API_KEY)" \
                  "$(DTRACK_URL)/api/v1/project/lookup?name=$(projectName)&version=$(projectVersion)")

                PROJECT_UUID=$(echo $PROJECT | jq -r '.uuid')

                if [ "$PROJECT_UUID" = "null" ] || [ -z "$PROJECT_UUID" ]; then
                  echo "##[error]Project not found in Dependency-Track"
                  exit 1
                fi

                echo "##[section]Project UUID: $PROJECT_UUID"

                # Get metrics
                METRICS=$(curl -s -H "X-Api-Key: $(DTRACK_API_KEY)" \
                  "$(DTRACK_URL)/api/v1/metrics/project/${PROJECT_UUID}/current")

                CRITICAL=$(echo $METRICS | jq -r '.critical // 0')
                HIGH=$(echo $METRICS | jq -r '.high // 0')
                MEDIUM=$(echo $METRICS | jq -r '.medium // 0')
                LOW=$(echo $METRICS | jq -r '.low // 0')

                echo "##[section]Vulnerability Summary"
                echo "Critical: $CRITICAL"
                echo "High: $HIGH"
                echo "Medium: $MEDIUM"
                echo "Low: $LOW"

                # Set output variables for later stages
                echo "##vso[task.setvariable variable=criticalCount;isOutput=true]$CRITICAL"
                echo "##vso[task.setvariable variable=highCount;isOutput=true]$HIGH"

                # Fail on critical vulnerabilities
                if [ "$CRITICAL" -gt 0 ]; then
                  echo "##[error]Critical vulnerabilities found: $CRITICAL"
                  echo "##vso[task.logissue type=error]Security gate failed - critical vulnerabilities detected"
                  exit 1
                fi

                # Warn on high vulnerabilities (configurable)
                if [ "$HIGH" -gt 5 ]; then
                  echo "##[warning]High vulnerability count ($HIGH) exceeds threshold"
                  echo "##vso[task.logissue type=warning]High vulnerabilities exceed threshold"
                fi

                echo "##[section]Security gate passed!"
            name: gate

          - task: Bash@3
            displayName: 'Check Policy Violations'
            inputs:
              targetType: 'inline'
              script: |
                set -e

                PROJECT=$(curl -s -H "X-Api-Key: $(DTRACK_API_KEY)" \
                  "$(DTRACK_URL)/api/v1/project/lookup?name=$(projectName)&version=$(projectVersion)")

                PROJECT_UUID=$(echo $PROJECT | jq -r '.uuid')

                # Get policy violations
                VIOLATIONS=$(curl -s -H "X-Api-Key: $(DTRACK_API_KEY)" \
                  "$(DTRACK_URL)/api/v1/violation/project/${PROJECT_UUID}")

                FAIL_COUNT=$(echo $VIOLATIONS | jq '[.[] | select(.policyViolation.violationState == "FAIL")] | length')
                WARN_COUNT=$(echo $VIOLATIONS | jq '[.[] | select(.policyViolation.violationState == "WARN")] | length')

                echo "##[section]Policy Violations"
                echo "FAIL: $FAIL_COUNT"
                echo "WARN: $WARN_COUNT"

                if [ "$FAIL_COUNT" -gt 0 ]; then
                  echo "##[error]Policy violations found!"
                  echo $VIOLATIONS | jq -r '.[] | select(.policyViolation.violationState == "FAIL") | "- \(.component.name):\(.component.version) - \(.policyViolation.policy.name)"'
                  exit 1
                fi

  # ============================================
  # Stage 3: Test
  # ============================================
  - stage: Test
    displayName: 'Run Tests'
    dependsOn: Security
    jobs:
      - job: UnitTests
        displayName: 'Unit Tests'
        steps:
          - checkout: self

          - task: NodeTool@0
            inputs:
              versionSpec: '20.x'

          - task: Npm@1
            inputs:
              command: 'ci'

          - task: Npm@1
            displayName: 'Run Tests'
            inputs:
              command: 'custom'
              customCommand: 'test -- --coverage'

          - task: PublishCodeCoverageResults@2
            displayName: 'Publish Coverage'
            inputs:
              summaryFileLocation: '$(Build.SourcesDirectory)/coverage/cobertura-coverage.xml'

  # ============================================
  # Stage 4: Deploy
  # ============================================
  - stage: Deploy
    displayName: 'Deploy to Production'
    dependsOn: Test
    condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'))
    jobs:
      - deployment: Production
        displayName: 'Deploy to Production'
        environment: 'production'
        strategy:
          runOnce:
            deploy:
              steps:
                - task: DownloadPipelineArtifact@2
                  inputs:
                    artifact: 'build'
                    path: '$(Pipeline.Workspace)/build'

                - task: Bash@3
                  displayName: 'Deploy'
                  inputs:
                    targetType: 'inline'
                    script: |
                      echo "Deploying to production..."
                      # Add deployment commands