In this exercise we explore the non-functional side of testing.
_____
As a learner you will be able to
- Create additional Jenkins stages to scan for security vulnerabilities in the Apps
- Assess test quiality by producing coveage reports as part of a build
- Improve code readability with linting
- Do some light performance testing to monitor throughput of APIs
Below is a collection of the frameworks that will be used in this lab
This exercise begins cluster containing blah blah
This lesson will use the Exerisise 4's Zap Slave and Arachni scanner to improve the pipeline. Linting will be included in the build and code coverage too.
Add a parallel stage after the e2e tests on the front end to run OWASP Zap and Arachni against the deployed apps.
Add Code Coverage reporing to the build for gaining greater insight into test improvements.
Add npm run lint:ci
to the Frontend and report the result using the Checkstyle Plugin in Jenkins.
Create a new Jenkins job to run some light performance testing against the API layer using the perf tests tasks.
This is a well structured guide with references to exact filenames and indications as to what should be done.
In this exercise the first of our non-functional testing is explored in the form of some security scanning. We will add the scans to our Jenkinsfile and have them run as new stages
Open the todolist-fe
application's Jenkinsfile
in your favourite editor. The file is stored in the root of the project.
The file is layed out with a collection of stages that correspond to each part of our build as seen below. We will create a new stage to execute in parallel.
Create a new Parallel Stage called security scanning
underneath the stage("e2e test") { }
section as shown below. The contents of the e2e test
has been removed for simplicity.
```groovy
stage("e2e test") {
// ... stuff in here ....
}
stage("security scanning") {
parallel {
stage('OWASP Scan') {
}
stage('Arachni Scan') {
}
}
}
2. Let's start filling out the configuration for the OWASP Zap scan first. We will set the label to our slave created in previous exercise and a when condition of the mater or develop branch.
stage('OWASP Scan') {
agent {
node {
label "jenkins-slave-zap"
}
}
when {
expression { GIT_BRANCH ==~ /(.*master|.*develop)/ }
}
}
```
A command to run the tool by passing in the URL of the app we're going to test.groovy stage('OWASP Scan') { agent { node { label "jenkins-slave-zap" } } when { expression { GIT_BRANCH ==~ /(.*master|.*develop)/ } } steps { sh ''' /zap/zap-baseline.py -r index.html -t ${E2E_TEST_ROUTE} ''' } }
Finally add the reporting for Jenkins in post
hook of our Declarative Pipeline. This is to report the findings of the scan in Jenkins as a HTML report.groovy stage('OWASP Scan') { agent { node { label "jenkins-slave-zap" } } when { expression { GIT_BRANCH ==~ /(.*master|.*develop)/ } } steps { sh ''' /zap/zap-baseline.py -r index.html -t http://${E2E_TEST_ROUTE} exit $? ''' } post { always { // publish html publishHTML target: [ allowMissing: false, alwaysLinkToLastBuild: false, keepAll: true, reportDir: '/zap/wrk', reportFiles: 'index.html', reportName: 'Zap Branniscan' ] } } }
Let's add our Arachni Scann to the second part of the parallel block. The main difference between these sections is Jenkins will report an XML report too for failing the build accordingly. Below is the snippet for the Arachni scanning.groovy stage('Arachni Scan') { agent { node { label "jenkins-slave-arachni" } } when { expression { GIT_BRANCH ==~ /(.*master|.*develop)/ } } steps { sh ''' /arachni/bin/arachni http://${E2E_TEST_ROUTE} --report-save-path=arachni-report.afr /arachni/bin/arachni_reporter arachni-report.afr --reporter=xunit:outfile=report.xml --reporter=html:outfile=web-report.zip unzip web-report.zip -d arachni-web-report ''' } post { always { junit 'report.xml' publishHTML target: [ allowMissing: false, alwaysLinkToLastBuild: false, keepAll: true, reportDir: 'arachni-web-report', reportFiles: 'index.html', reportName: 'Arachni Web Crawl' ] } } }
With this config in place run a build on Jenkins. Once the Jobs have completed; navigate to
prefix of exercise and why we're doing it
Ideas for go-getters. Advanced topic for doers to get on with if they finish early. These will usually not have a solution and are provided for additional scope.
List of links or other reading that might be of use / reference for the exercise
link back to the deck for the supporting material