Skip to content

Commit add7ad8

Browse files
ChrisEdwardsChrisEdwards
authored
Merge pull request #21 from svevia/new-vuln-reporting-feature
AIML-212 - New capabilities to get all vulns and attacks events
2 parents 493fe67 + fb35d74 commit add7ad8

36 files changed

+6107
-52
lines changed

‎.env.integration-test.template‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# Integration Test Environment Variables
2+
# Copy this file to .env.integration-test and fill in your Contrast credentials
3+
# Then source it before running integration tests: source .env.integration-test
4+
5+
export CONTRAST_HOST_NAME=app.contrastsecurity.com
6+
export CONTRAST_API_KEY=your-api-key-here
7+
export CONTRAST_SERVICE_KEY=your-service-key-here
8+
export CONTRAST_USERNAME=your-username-here
9+
export CONTRAST_ORG_ID=your-org-id-here
10+
11+
# Note: .env.integration-test is in .gitignore to prevent committing credentials

‎.gitignore‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,3 +36,7 @@ build/
3636
.DS_Store
3737
.AppleDouble
3838
.LSOverride
39+
.env.integration-test
40+
41+
### Beads ###
42+
.beads/

‎CLAUDE.md‎

Lines changed: 27 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -80,4 +80,30 @@ This codebase handles sensitive vulnerability data. The README contains critical
8080

8181
- Default log location: `/tmp/mcp-contrast.log`
8282
- Debug logging: Add `--logging.level.root=DEBUG` to startup arguments
83-
- Console logging is minimal by design for MCP protocol compatibility
83+
- Console logging is minimal by design for MCP protocol compatibility
84+
85+
## Beads Workflow Requirements
86+
87+
This project uses Beads (bd) for issue tracking. See the MCP resource `beads://quickstart` for usage details.
88+
89+
### Managing Bead Dependencies
90+
91+
**Command syntax:** `bd dep add <dependent-task> <prerequisite-task>`
92+
93+
Example: If B must be done after A completes, use `bd dep add B A` (not `bd dep add A B`).
94+
95+
Verify with `bd show <task-id>` - dependent tasks show "Depends on", prerequisites show "Blocks".
96+
97+
### Testing Requirements Before Closing Beads
98+
99+
**CRITICAL: Before closing any bead, you MUST:**
100+
101+
1. **Write tests for ALL code changes** - No exceptions
102+
2. **Run unit tests** - `mvn test` must pass with 0 failures
103+
3. **Run integration tests** - `mvn verify` must pass (requires credentials in `.env.integration-test`)
104+
- If credentials unavailable, verify integration tests pass in CI/CD
105+
4. **Verify new tests are included** - Ensure your tests ran and passed
106+
107+
All code changes require corresponding test coverage. Do not close beads without tests.
108+
109+
See INTEGRATION_TESTS.md for integration test setup and credentials.

‎INTEGRATION_TESTS.md‎

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
# Integration Tests
2+
3+
This project includes integration tests that run against a real Contrast TeamServer instance.
4+
5+
## Setup
6+
7+
1. **Copy the environment template:**
8+
```bash
9+
cp .env.integration-test.template .env.integration-test
10+
```
11+
12+
2. **Fill in your Contrast credentials:**
13+
Edit `.env.integration-test` with your actual credentials:
14+
- `CONTRAST_HOST_NAME` - Your TeamServer host (e.g., `app.contrastsecurity.com`)
15+
- `CONTRAST_API_KEY` - Your API key
16+
- `CONTRAST_SERVICE_KEY` - Your service key
17+
- `CONTRAST_USERNAME` - Your username
18+
- `CONTRAST_ORG_ID` - Your organization ID
19+
20+
3. **Source the environment file:**
21+
```bash
22+
source .env.integration-test
23+
```
24+
25+
## Running Integration Tests
26+
27+
### Run integration tests only:
28+
```bash
29+
mvn verify
30+
```
31+
32+
### Run all tests (unit + integration):
33+
```bash
34+
mvn clean verify
35+
```
36+
37+
### Skip integration tests:
38+
```bash
39+
mvn verify -DskipITs
40+
```
41+
42+
### Run only unit tests (default):
43+
```bash
44+
mvn test
45+
```
46+
47+
## How It Works
48+
49+
- **Unit tests** (`*Test.java`) run during the `test` phase via Maven Surefire
50+
- **Integration tests** (`*IT.java`) run during the `verify` phase via Maven Failsafe
51+
- Integration tests only execute if `CONTRAST_HOST_NAME` environment variable is set
52+
- If environment variables are missing, integration tests are automatically skipped
53+
54+
## GitHub Actions / CI
55+
56+
For GitHub Actions, add these secrets to your repository:
57+
- `CONTRAST_HOST_NAME`
58+
- `CONTRAST_API_KEY`
59+
- `CONTRAST_SERVICE_KEY`
60+
- `CONTRAST_USERNAME`
61+
- `CONTRAST_ORG_ID`
62+
63+
Example GitHub Actions workflow:
64+
65+
```yaml
66+
- name: Run integration tests
67+
run: mvn verify
68+
env:
69+
CONTRAST_HOST_NAME: ${{ secrets.CONTRAST_HOST_NAME }}
70+
CONTRAST_API_KEY: ${{ secrets.CONTRAST_API_KEY }}
71+
CONTRAST_SERVICE_KEY: ${{ secrets.CONTRAST_SERVICE_KEY }}
72+
CONTRAST_USERNAME: ${{ secrets.CONTRAST_USERNAME }}
73+
CONTRAST_ORG_ID: ${{ secrets.CONTRAST_ORG_ID }}
74+
```
75+
76+
## Current Integration Tests
77+
78+
### EnvironmentsIT.java
79+
80+
Tests that environments and tags are properly populated from TeamServer API:
81+
- `testEnvironmentsAndTagsArePopulated()` - Verifies vulnerability responses include environments and tags
82+
- `testVulnerabilitiesHaveBasicFields()` - Verifies basic vulnerability fields are present
83+
84+
## Adding New Integration Tests
85+
86+
1. Create a new test class in `src/test/java` with the `IT` suffix (e.g., `MyFeatureIT.java`)
87+
2. Annotate with `@EnabledIfEnvironmentVariable(named = "CONTRAST_HOST_NAME", matches = ".+")`
88+
3. Use real Contrast SDK calls (no mocking)
89+
4. Run with `mvn verify` to execute
90+
91+
## Troubleshooting
92+
93+
**Integration tests don't run:**
94+
- Verify environment variables are set: `echo $CONTRAST_HOST_NAME`
95+
- Make sure you're running `mvn verify` (not just `mvn test`)
96+
- Check that test class name ends with `IT.java`
97+
98+
**Tests fail with authentication errors:**
99+
- Verify your credentials are correct
100+
- Check that your API key has appropriate permissions
101+
- Ensure your organization ID is correct

‎README.md‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,9 @@ Contrast's MCP server allows you as a developer or security professional to quic
2626
- [For the Security Professional](#for-the-security-professional)
2727
- [Data Privacy](#data-privacy)
2828
- [Build](#build)
29+
- [Testing](#testing)
30+
- [Unit Tests](#unit-tests)
31+
- [Integration Tests](#integration-tests)
2932
- [Run](#run)
3033
- [Docker](#docker)
3134
- [Build Docker Image](#build-docker-image)
@@ -86,6 +89,33 @@ Requires Java 17+
8689

8790
`mvn clean install`
8891

92+
## Testing
93+
94+
### Unit Tests
95+
Run unit tests during development:
96+
```bash
97+
mvn test
98+
```
99+
100+
### Integration Tests
101+
Integration tests validate against a real TeamServer instance. See [INTEGRATION_TESTS.md](INTEGRATION_TESTS.md) for detailed setup instructions.
102+
103+
Quick start:
104+
```bash
105+
# 1. Set up credentials
106+
cp .env.integration-test.template .env.integration-test
107+
# Edit .env.integration-test with your credentials
108+
109+
# 2. Run integration tests
110+
source .env.integration-test
111+
mvn verify
112+
113+
# 3. Skip integration tests
114+
mvn verify -DskipITs
115+
```
116+
117+
Integration tests only run when `CONTRAST_HOST_NAME` environment variable is set.
118+
89119
## Run
90120
To add the MCP Server to your local AI system, modify the config.json file and add the following
91121

‎pom.xml‎

Lines changed: 30 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,13 +39,19 @@
3939
<dependency>
4040
<groupId>com.contrastsecurity</groupId>
4141
<artifactId>contrast-sdk-java</artifactId>
42-
<version>3.4.2</version>
42+
<version>3.4.4</version>
4343
</dependency>
4444
<dependency>
4545
<groupId>org.springframework.ai</groupId>
4646
<artifactId>spring-ai-starter-mcp-server</artifactId>
4747
</dependency>
4848

49+
<dependency>
50+
<groupId>org.projectlombok</groupId>
51+
<artifactId>lombok</artifactId>
52+
<scope>provided</scope>
53+
</dependency>
54+
4955
<dependency>
5056
<groupId>org.springframework.boot</groupId>
5157
<artifactId>spring-boot-starter-test</artifactId>
@@ -88,6 +94,29 @@
8894
<goals>install</goals>
8995
</configuration>
9096
</plugin>
97+
<plugin>
98+
<groupId>org.apache.maven.plugins</groupId>
99+
<artifactId>maven-failsafe-plugin</artifactId>
100+
<version>3.5.3</version>
101+
<executions>
102+
<execution>
103+
<goals>
104+
<goal>integration-test</goal>
105+
<goal>verify</goal>
106+
</goals>
107+
</execution>
108+
</executions>
109+
<configuration>
110+
<systemPropertyVariables>
111+
<!-- Pass environment variables to tests -->
112+
<CONTRAST_HOST_NAME>${env.CONTRAST_HOST_NAME}</CONTRAST_HOST_NAME>
113+
<CONTRAST_API_KEY>${env.CONTRAST_API_KEY}</CONTRAST_API_KEY>
114+
<CONTRAST_SERVICE_KEY>${env.CONTRAST_SERVICE_KEY}</CONTRAST_SERVICE_KEY>
115+
<CONTRAST_USERNAME>${env.CONTRAST_USERNAME}</CONTRAST_USERNAME>
116+
<CONTRAST_ORG_ID>${env.CONTRAST_ORG_ID}</CONTRAST_ORG_ID>
117+
</systemPropertyVariables>
118+
</configuration>
119+
</plugin>
91120
</plugins>
92121
</build>
93122

0 commit comments

Comments
 (0)