added grafana oncall

software_vulnarabilities/jenkins.py

@@ -21,7 +21,9 @@ CROWD_URL = "https://crowd.lmru.tech"
 
 GHE_URL = "https://github.lmru.tech"
 
-ARGOCD_URL = "https://argocd.devops.lmru.tech/"
+ARGOCD_URL = "https://argocd.devops.lmru.tech"
+
+GRAFANA_OBS_URL = "https://obs-grafana-yc-techno.apps.lmru.tech"
 
 NVD_API_URL = "https://services.nvd.nist.gov/rest/json/cves/2.0"
 NVD_API_KEY = "aa054ea4-4a99-4f16-b5ed-1f77b5193d80"
@@ -140,6 +142,30 @@ def get_argocd_version():
         print("Could not determine ArgoCD version from /api/version endpoint.")
         return None
 
+def get_oncall_version():
+    url = f"{GRAFANA_OBS_URL}/metrics"
+    resp = requests.get(url, verify=False)
+    resp.raise_for_status()
+    text = resp.text
+
+    # Ищем строку с plugin_id="grafana-oncall-app"
+    # Пример строки:
+    # grafana_plugin_build_info{plugin_id="grafana-oncall-app",plugin_type="app",signature_status="valid",version="1.3.58"} 1
+    match_line = re.search(r'grafana_plugin_build_info\{[^}]*plugin_id="grafana-oncall-app"[^}]*\}', text)
+    if not match_line:
+        print("Could not find grafana-oncall-app plugin info in /metrics.")
+        return None
+
+    line = match_line.group(0)
+    # Извлекаем version="..."
+    match_version = re.search(r'version="([^"]+)"', line)
+    if match_version:
+        oncall_version = match_version.group(1)
+        return oncall_version
+    else:
+        print("Could not extract version from grafana-oncall-app plugin line.")
+        return None
+
 def fetch_cves_by_cpe(cpe_name, max_retries=3, delay=5):
     """
     Запросить уязвимости из NVD по cpeName.
@@ -351,6 +377,17 @@ def main():
     argocd_vulns = fetch_cves_by_cpe(argocd_cpe)
     insert_vulnerabilities(conn, "argocd", "argocd", argocd_version, argocd_vulns)
 
+    # OnCall
+    oncall_version = get_oncall_version()
+    if not oncall_version:
+        print("Could not determine OnCall version.")
+        sys.exit(1)
+    oncall_cpe = f"cpe:2.3:a:grafana:oncall:{oncall_version}:*:*:*:*:*:*:*"
+    print(f"OnCall version: {oncall_version}")
+    print(f"OnCall CPE: {oncall_cpe}")
+
+    oncall_vulns = fetch_cves_by_cpe(oncall_cpe)
+    insert_vulnerabilities(conn, "grafana", "oncall_plugin", oncall_version, oncall_vulns)
 
     conn.close()