feat(scanners): additional findings processor

scanners/findings-processor/.env.example

@@ -0,0 +1,16 @@
+NATS_URL=
+NATS_STREAM=
+NATS_SUBJECT=
+NATS_CONSUMER_DURABLE=
+NATS_QUEUE_GROUP=
+NATS_ACK_WAIT=
+NATS_MAX_DELIVER=
+NATS_MAX_ACK_PENDING=
+
+DB_URL=
+DB_USER=
+DB_NAME=
+DB_PASS=
+
+LOG_LEVEL=
+LOG_PRETTY=

scanners/findings-processor/Dockerfile

@@ -0,0 +1,19 @@
+FROM golang:1.25.0-alpine3.22 AS build
+
+WORKDIR /src
+
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o /out/findings-processor ./cmd/service
+
+FROM alpine:3.22
+
+RUN addgroup -S app && adduser -S app -G app
+USER app
+
+WORKDIR /app
+COPY --from=build /out/findings-processor /app/findings-processor
+
+ENTRYPOINT ["/app/findings-processor"]

scanners/findings-processor/Makefile

@@ -0,0 +1,51 @@
+.PHONY: help run test test-race test-integration build fmt fmt-check vet lint tidy ci
+
+GO ?= go
+SERVICE_BIN ?= findings-processor
+BUILD_DIR ?= bin
+
+help:
+	@printf "Targets:\n"
+	@printf "  make run              - Run the service\n"
+	@printf "  make test             - Run all tests\n"
+	@printf "  make test-race        - Run tests with race detector\n"
+	@printf "  make test-integration - Run integration tests (requires Docker)\n"
+	@printf "  make build            - Build service binary\n"
+	@printf "  make fmt              - Format Go files\n"
+	@printf "  make fmt-check        - Check formatting (no changes)\n"
+	@printf "  make vet              - Run go vet\n"
+	@printf "  make lint             - Run fmt-check + vet\n"
+	@printf "  make tidy             - Tidy modules\n"
+	@printf "  make ci               - Lint, test, build\n"
+
+run:
+	$(GO) run ./cmd/service
+
+test:
+	$(GO) test ./...
+
+test-integration:
+	$(GO) test -tags integration ./...
+
+test-race:
+	$(GO) test -race ./...
+
+build:
+	mkdir -p $(BUILD_DIR)
+	CGO_ENABLED=0 $(GO) build -o $(BUILD_DIR)/$(SERVICE_BIN) ./cmd/service
+
+fmt:
+	$(GO) fmt ./...
+
+fmt-check:
+	@test -z "$$($(GO)fmt -l .)" || (printf "Unformatted files found. Run 'make fmt'.\n" && exit 1)
+
+vet:
+	$(GO) vet ./...
+
+lint: fmt-check vet
+
+tidy:
+	$(GO) mod tidy
+
+ci: lint test build

scanners/findings-processor/README.md

@@ -0,0 +1,67 @@
+# Findings Processor
+
+Consumes finding events from NATS JetStream and upserts normalized finding documents into ArangoDB `additionalFindings`.
+
+## What it does
+
+- Subscribes to `scans.findings.*` (configurable)
+- Validates incoming payloads
+- Writes findings to ArangoDB
+- Acknowledges messages with explicit `Ack` / `Nak` / `Term` behavior
+
+## Event contract (current)
+
+Expected JSON fields:
+
+- Required: `source`, `findingType`, `domainKey`, `subject`, `confidence`, `observedAt`
+- Optional: `severity`, `reasonCode`, `evidence`, `attributes`
+
+`observedAt` must be RFC3339.
+
+## Local development
+
+1. Copy env template:
+
+```bash
+cp .env.example .env
+```
+
+2. Fill required vars in `.env` (at minimum DB and NATS settings).
+
+3. Run service:
+
+```bash
+go run ./cmd/service
+```
+
+## Environment variables
+
+| Variable                | Default                 | Notes                        |
+| ----------------------- | ----------------------- | ---------------------------- |
+| `NATS_URL`              | `nats://localhost:4222` | NATS server URL              |
+| `NATS_STREAM`           | `SCANS`                 | JetStream stream name        |
+| `NATS_SUBJECT`          | `scans.findings.*`      | Subscription subject         |
+| `NATS_CONSUMER_DURABLE` | `findings-processor`    | Durable consumer name        |
+| `NATS_ACK_WAIT`         | `30s`                   | Ack timeout                  |
+| `NATS_MAX_DELIVER`      | `10`                    | Max redeliveries             |
+| `NATS_MAX_ACK_PENDING`  | `256`                   | Max pending unacked messages |
+| `DB_URL`                | `http://localhost:8529` | ArangoDB URL                 |
+| `DB_USER`               | _(none)_                | ArangoDB user                |
+| `DB_NAME`               | _(none)_                | ArangoDB database            |
+| `DB_PASS`               | _(empty)_               | ArangoDB password            |
+| `LOG_LEVEL`             | `info`                  | Zerolog global level         |
+| `LOG_PRETTY`            | `true`                  | Human-readable logs          |
+
+## Docker
+
+Build:
+
+```bash
+docker build -t findings-processor .
+```
+
+Run:
+
+```bash
+docker run --rm --env-file .env findings-processor
+```

scanners/findings-processor/cloudbuild.yaml

@@ -0,0 +1,52 @@
+steps:
+  - name: "golang:1.25"
+    id: ci-checks
+    dir: scanners/findings-processor
+    entrypoint: "bash"
+    args:
+      - "-c"
+      - |
+        make ci
+
+  - name: "golang:1.25"
+    id: integration-tests
+    dir: scanners/findings-processor
+    entrypoint: "bash"
+    args:
+      - "-c"
+      - |
+        make test-integration
+
+  - name: "gcr.io/cloud-builders/docker"
+    id: generate-image-name
+    entrypoint: "bash"
+    dir: scanners/findings-processor
+    args:
+      - "-c"
+      - |
+        echo "northamerica-northeast1-docker.pkg.dev/track-compliance/tracker/findings-processor:$(echo $BRANCH_NAME | sed 's/[^a-zA-Z0-9]/-/g')-$SHORT_SHA-$(date +%s)" > /workspace/imagename
+
+  - name: "gcr.io/cloud-builders/docker"
+    id: build
+    entrypoint: "bash"
+    dir: scanners/findings-processor
+    args:
+      - "-c"
+      - |
+        image=$(cat /workspace/imagename)
+        docker build -t $image .
+
+  - name: "gcr.io/cloud-builders/docker"
+    id: push-if-master
+    entrypoint: "bash"
+    dir: scanners/findings-processor
+    args:
+      - "-c"
+      - |
+        if [[ "$BRANCH_NAME" == "master" ]]
+        then
+          image=$(cat /workspace/imagename)
+          docker push $image
+        else
+          exit 0
+        fi

scanners/findings-processor/cmd/service/main.go

@@ -0,0 +1,19 @@
+package main
+
+import (
+	"github.com/canada-ca/tracker/scanners/findings-processor/internal/config"
+	"github.com/canada-ca/tracker/scanners/findings-processor/internal/runner"
+	"github.com/rs/zerolog/log"
+)
+
+func main() {
+	cfg, err := config.Load()
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed to load config")
+	}
+	config.SetupLogger(cfg)
+
+	if err := runner.Run(cfg); err != nil {
+		log.Fatal().Err(err).Msg("findings processor failed")
+	}
+}

scanners/findings-processor/go.mod

@@ -0,0 +1,79 @@
+module github.com/canada-ca/tracker/scanners/findings-processor
+
+go 1.25.0
+
+require (
+	github.com/joho/godotenv v1.5.1
+	github.com/kelseyhightower/envconfig v1.4.0
+	github.com/nats-io/nats.go v1.52.0
+	github.com/rs/zerolog v1.34.0
+	github.com/testcontainers/testcontainers-go v0.44.0
+	github.com/testcontainers/testcontainers-go/modules/nats v0.44.0
+)
+
+require (
+	dario.cat/mergo v1.0.2 // indirect
+	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
+	github.com/Microsoft/go-winio v0.6.2 // indirect
+	github.com/arangodb/go-velocypack v0.0.0-20200318135517-5af53c29c67e // indirect
+	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/containerd/errdefs v1.0.0 // indirect
+	github.com/containerd/errdefs/pkg v0.3.0 // indirect
+	github.com/containerd/log v0.1.0 // indirect
+	github.com/containerd/platforms v0.2.1 // indirect
+	github.com/cpuguy83/dockercfg v0.3.2 // indirect
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/dchest/siphash v1.2.3 // indirect
+	github.com/distribution/reference v0.6.0 // indirect
+	github.com/docker/go-connections v0.7.0 // indirect
+	github.com/docker/go-units v0.5.0 // indirect
+	github.com/ebitengine/purego v0.10.1 // indirect
+	github.com/felixge/httpsnoop v1.1.0 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/go-ole/go-ole v1.3.0 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/kkdai/maglev v0.2.0 // indirect
+	github.com/lufia/plan9stats v0.0.0-20260330125221-c963978e514e // indirect
+	github.com/magiconair/properties v1.8.10 // indirect
+	github.com/mattn/go-colorable v0.1.13 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/moby/docker-image-spec v1.3.1 // indirect
+	github.com/moby/go-archive v0.2.0 // indirect
+	github.com/moby/moby/api v1.55.0 // indirect
+	github.com/moby/moby/client v0.5.0 // indirect
+	github.com/moby/patternmatcher v0.6.1 // indirect
+	github.com/moby/sys/sequential v0.7.0 // indirect
+	github.com/moby/sys/user v0.4.0 // indirect
+	github.com/moby/sys/userns v0.1.0 // indirect
+	github.com/moby/term v0.5.2 // indirect
+	github.com/opencontainers/go-digest v1.0.0 // indirect
+	github.com/opencontainers/image-spec v1.1.1 // indirect
+	github.com/pkg/errors v0.9.1 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
+	github.com/shirou/gopsutil/v4 v4.26.6 // indirect
+	github.com/sirupsen/logrus v1.9.4 // indirect
+	github.com/stretchr/testify v1.11.1 // indirect
+	github.com/tklauser/go-sysconf v0.4.0 // indirect
+	github.com/tklauser/numcpus v0.12.0 // indirect
+	github.com/yusufpapurcu/wmi v1.2.4 // indirect
+	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 // indirect
+	go.opentelemetry.io/otel v1.44.0 // indirect
+	go.opentelemetry.io/otel/metric v1.44.0 // indirect
+	go.opentelemetry.io/otel/trace v1.44.0 // indirect
+	golang.org/x/net v0.56.0 // indirect
+	golang.org/x/text v0.40.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+)
+
+require (
+	github.com/arangodb/go-driver/v2 v2.3.1
+	github.com/klauspost/compress v1.18.6 // indirect
+	github.com/nats-io/nkeys v0.4.15 // indirect
+	github.com/nats-io/nuid v1.0.1 // indirect
+	golang.org/x/crypto v0.54.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
+)