feat(codebuild): publish Trustabl findings as CodeBuild test reports

[pjsk02]

Summary

Surface Trustabl scan findings natively in AWS CodeBuild Reports by converting trustabl.json into JUnit XML.

The existing JSON, SARIF and Markdown outputs remain unchanged and authoritative.

What changed

• add a dependency-light trustabl.json → JUnit XML converter (scan/to-junit.sh);
• emit trustabl-junit.xml from the CodeBuild scan flow;
• document an opt-in CodeBuild reports: configuration using JUNITXML (commented in the default buildspec);
• provide scoped example IAM permissions required for CodeBuild Reports (codepipeline/iam-reports.json);
• preserve rule, severity, source and remediation context in individual test cases;
• add offline fixture-driven converter tests.

CodeBuild Reports behavior

Native Reports integration is opt-in.

The default buildspec keeps the reports: configuration commented, so existing users:

• make no CodeBuild Reports API calls;
• require no additional Reports IAM permissions;
• retain the existing Trustabl gating behavior.

The scanner still writes trustabl-junit.xml locally. Users who enable the documented reports: block also attach the supplied Reports IAM permissions. Converter failure is a warning only and does not change the scan gate.

Finding mapping

Each Trustabl finding becomes an independently inspectable JUnit test case containing useful context such as:

• rule ID/title;
• severity;
• source file/location;
• explanation;
• remediation;
• tool/framework metadata where available.

Arbitrary finding text is XML-escaped before emission. Control characters are stripped. Test case names include a deterministic index suffix.

Large scans

AWS CodeBuild Reports expose at most 500 test cases per report.

When a scan contains more than 500 findings, the JUnit representation selects findings deterministically by severity:

critical → high → medium → low → info

with stable secondary ordering (rule_id, file_path, start_line).

Truncation is logged and recorded as testsuite properties rather than silently hidden.

The complete JSON/SARIF artifacts remain authoritative for the full finding set.

IAM

Enabling native CodeBuild Reports requires the documented permissions:

• codebuild:CreateReportGroup
• codebuild:CreateReport
• codebuild:UpdateReport
• codebuild:BatchPutTestCases

These permissions are not required by the default configuration.

Testing

Validated locally with:

bash -n scan/to-junit.sh
bash -n test/test-junit.sh
bash test/test-junit.sh

Tests cover:

• zero/one/multiple findings;
• all severity levels;
• XML escaping and multiline content;
• control characters;
• missing optional fields;
• malformed JSON;
• deterministic output;
• 500/501 finding boundaries;
• deterministic severity-first truncation;
• valid XML parsing.

Tests are offline and require no AWS credentials.

Non-goals

This PR does not change:

• Trustabl pass/fail gating;
• SARIF semantics;
• Security Hub/ASFF;
• scanner execution count;
• rule signing;
• CodeCatalyst behavior.