import groovy.transform.Field

@Field CHECKOV_ECR_REPO = '437795906767.dkr.ecr.us-east-1.amazonaws.com/terraform-static-code-analysis'

@Field AWS_ROLES_BY_PREFIX = [
        dev : 'arn:aws:iam::103233932089:role/dev-checkov-access-role',
        qa  : 'arn:aws:iam::437795906767:role/prod-checkov-access-role',
        prod: 'arn:aws:iam::437795906767:role/prod-checkov-access-role'
]

def call(Map args = [:]) {
    def githubRepoName = (env.GIT_URL =~ "https://github.com/(.*)\\.git")[0][1]
    def checkovImageTag = args.checkovImageTag ?: 'latest'
    def checkovImage = "${CHECKOV_ECR_REPO}:${checkovImageTag}"

    checkovScan(githubRepoName, checkovImage)
}

def checkovScan(String githubRepoName, String checkovImage) {
    // Grant permissions to access repository from inside the container.
    sh 'chmod -R a=rwX ./'

    withCredentials([
            string(credentialsId: 'terraform-static-code-analysis-github-app-client-id', variable: 'GITHUB_APP_CLIENT_ID'),
            string(credentialsId: 'terraform-static-code-analysis-github-app-installation-id', variable: 'GITHUB_APP_INSTALLATION_ID'),
            file(credentialsId: 'terraform-static-code-analysis-github-app-private-key', variable: 'GITHUB_APP_PRIVATE_KEY_FILE_LOCATION')
    ]) {
        withEcr {
            sh """
                chmod 644 \${GITHUB_APP_PRIVATE_KEY_FILE_LOCATION}
                docker run --rm \
                    --pull always \
                    -v \"${env.WORKSPACE}:/repository\" \
                    -v "\${GITHUB_APP_PRIVATE_KEY_FILE_LOCATION}:\${GITHUB_APP_PRIVATE_KEY_FILE_LOCATION}" \
                    -e REPO_DIR='/repository' \
                    -e GITHUB_APP_CLIENT_ID \
                    -e GITHUB_APP_INSTALLATION_ID \
                    -e GITHUB_APP_PRIVATE_KEY_FILE_LOCATION \
                    -e GITHUB_REPO_NAME="${githubRepoName}" \
                    -e GITHUB_PR_NUM="${env.CHANGE_ID}" \
                    -e RECURSIVE_SCAN="false" \
                    -e BLOCKING_MODE="true" \
                    -e AWS_DEFAULT_REGION="us-east-1" \
                    -e AWS_ROLES_PER_PREFIX="${AWS_ROLES_BY_PREFIX.collect { k, v -> "${k}=${v}" }.join(',')}" \
                    -e CHECKOV_RENDER_MAX_LEN="32000" \
                    ${checkovImage}
                """
        }
    }
}