M3 Security Fixes for Pass 39

scripts/scan.sh

@@ -7,6 +7,7 @@ PROJECT="Warehouse-Management-System"
 # The directory scan.sh was invoked from is the project root.
 PROJECT_DIR="$PWD"
 OUTPUT="$PROJECT_DIR/sonarqube-issues.csv"
+REPORT_TASK="$PROJECT_DIR/.scannerwork/report-task.txt"
 
 TMP=$(mktemp)
 
@@ -40,6 +41,83 @@ sonar-scanner \
     -Dsonar.host.url="$SONAR_URL" \
     -Dsonar.token="$SONAR_TOKEN"
 
+#
+# Wait for SonarQube server-side analysis to complete.
+#
+
+echo
+echo "Scanner finished."
+echo "Waiting for SonarQube analysis to complete..."
+
+if [ ! -f "$REPORT_TASK" ]; then
+    echo "ERROR: SonarQube report task file not found:"
+    echo "$REPORT_TASK"
+    exit 1
+fi
+
+TASK_ID=$(grep '^ceTaskId=' "$REPORT_TASK" | cut -d= -f2)
+
+if [ -z "$TASK_ID" ]; then
+    echo "ERROR: Could not determine SonarQube Compute Engine task ID."
+    exit 1
+fi
+
+echo "Compute Engine task: $TASK_ID"
+
+while true; do
+
+    RESPONSE=$(curl \
+        --connect-timeout 5 \
+        --max-time 30 \
+        -sS \
+        -u "$SONAR_TOKEN:" \
+        "$SONAR_URL/api/ce/task?id=$TASK_ID")
+
+    STATUS=$(printf '%s' "$RESPONSE" | jq -r '.task.status')
+
+    case "$STATUS" in
+
+        SUCCESS)
+            echo "SonarQube analysis complete."
+            break
+            ;;
+
+        PENDING)
+            echo "  Analysis pending..."
+            ;;
+
+        IN_PROGRESS)
+            echo "  Analysis in progress..."
+            ;;
+
+        FAILED)
+            echo "ERROR: SonarQube analysis failed."
+            printf '%s\n' "$RESPONSE" | jq
+            exit 1
+            ;;
+
+        CANCELED)
+            echo "ERROR: SonarQube analysis was canceled."
+            exit 1
+            ;;
+
+        *)
+            echo "ERROR: Unexpected SonarQube task status: $STATUS"
+            printf '%s\n' "$RESPONSE" | jq
+            exit 1
+            ;;
+
+    esac
+
+    sleep 2
+
+done
+
+#
+# Analysis is now complete.
+# Download the issues.
+#
+
 echo
 echo "Downloading SonarQube issues..."
 
@@ -49,6 +127,7 @@ PAGE=1
 PAGE_SIZE=500
 
 while true; do
+
     echo "Fetching page $PAGE..."
 
     RESPONSE=$(curl \
@@ -72,8 +151,13 @@ while true; do
     [ "$COUNT" -lt "$PAGE_SIZE" ] && break
 
     PAGE=$((PAGE + 1))
+
 done
 
+#
+# Generate CSV.
+#
+
 jq -r --arg project "$PROJECT" '
 [
     "Severity",