feat(codebuild): publish Trustabl findings as CodeBuild test reports

[pjsk02]

Summary

Surface Trustabl scan findings natively in AWS CodeBuild Reports by converting trustabl.json into JUnit XML.

The existing JSON, SARIF and Markdown outputs remain unchanged and authoritative.

What changed

• add a dependency-light trustabl.json → JUnit XML converter (scan/to-junit.sh);
• emit trustabl-junit.xml from the CodeBuild scan flow;
• document an opt-in CodeBuild reports: configuration using JUNITXML (commented in the default buildspec);
• provide scoped example IAM permissions required for CodeBuild Reports (codepipeline/iam-reports.json);
• preserve rule, severity, source and remediation context in individual test cases;
• add offline fixture-driven converter tests.

CodeBuild Reports behavior

Native Reports integration is opt-in.

The default buildspec keeps the reports: configuration commented, so existing users:

• make no CodeBuild Reports API calls;
• require no additional Reports IAM permissions;
• retain the existing Trustabl gating behavior.

The scanner still writes trustabl-junit.xml locally. Users who enable the documented reports: block also attach the supplied Reports IAM permissions. Converter failure is a warning only and does not change the scan gate.

Finding mapping

Each Trustabl finding becomes an independently inspectable JUnit test case containing useful context such as:

• rule ID/title;
• severity;
• source file/location;
• explanation;
• remediation;
• tool/framework metadata where available.

Arbitrary finding text is XML-escaped before emission. Control characters are stripped. Test case names include a deterministic index suffix.

Large scans

AWS CodeBuild Reports expose at most 500 test cases per report.

When a scan contains more than 500 findings, the JUnit representation selects findings deterministically by severity:

critical → high → medium → low → info

with stable secondary ordering (rule_id, file_path, start_line).

Truncation is logged and recorded as testsuite properties rather than silently hidden.

The complete JSON/SARIF artifacts remain authoritative for the full finding set.

IAM

Enabling native CodeBuild Reports requires the documented permissions:

• codebuild:CreateReportGroup
• codebuild:CreateReport
• codebuild:UpdateReport
• codebuild:BatchPutTestCases

These permissions are not required by the default configuration.

Testing

Validated locally with:

bash -n scan/to-junit.sh
bash -n test/test-junit.sh
bash test/test-junit.sh

Tests cover:

• zero/one/multiple findings;
• all severity levels;
• XML escaping and multiline content;
• control characters;
• missing optional fields;
• malformed JSON;
• deterministic output;
• 500/501 finding boundaries;
• deterministic severity-first truncation;
• valid XML parsing.

Tests are offline and require no AWS credentials.

Non-goals

This PR does not change:

• Trustabl pass/fail gating;
• SARIF semantics;
• Security Hub/ASFF;
• scanner execution count;
• rule signing;
• CodeCatalyst behavior.

[sairenchristianbuerano]

Thanks @pjsk02. Flagging that this is being read rather than sitting unlooked-at.

We are reviewing all 52 open PRs together instead of one at a time. 31 of them edit scan/trustabl-scan.sh, so merge order decides as much as any individual verdict — GitHub reports almost all of these as mergeable, but that is each PR against main in isolation, not against each other. The first merge makes most of the rest conflict.

Queued. This is one of the larger changes in the queue, so it gets read after the single-purpose fixes land.

The order we are working to: the test harness in #1 first, since twelve PRs depend on it and nothing is verifiable without it, then the fixes that close fail-open paths, then behaviour changes, then docs. A verdict on this one follows once its cluster is read.

Apologies for the wait, and thanks for the contribution.

[sairenchristianbuerano]

Thanks @pjsk02 — the change looks good, but it needs a rebase.

Several PRs touching scan/trustabl-scan.sh have landed on main since you opened this, so it no longer merges cleanly. Could you rebase and resolve?

bash test/run-tests.sh will confirm it — 19 passing on main right now.

Ping me when it's up.