Skip to content

Commit 376ea4d

Browse files
flowstateflowstate
committed
Fixed SARIF regression (#53)
* added SARIF back in
1 parent b00eb67 commit 376ea4d

File tree

7 files changed

+120
-64
lines changed

7 files changed

+120
-64
lines changed

‎README.md

+63-32
Original file line numberDiff line numberDiff line change
@@ -2,45 +2,76 @@
22

33
The Socket Security CLI was created to enable integrations with other tools like Github Actions, Gitlab, BitBucket, local use cases and more. The tool will get the head scan for the provided repo from Socket, create a new one, and then report any new alerts detected. If there are new alerts against the Socket security policy it'll exit with a non-Zero exit code.
44

5-
6-
75
## Usage
86

97
```` shell
10-
socketcli [-h] [--api-token API_TOKEN] [--repo REPO] [--branch BRANCH] [--committer COMMITTER] [--pr-number PR_NUMBER]
11-
[--commit-message COMMIT_MESSAGE] [--default-branch] [--target-path TARGET_PATH] [--scm {api,github,gitlab}] [--sbom-file SBOM_FILE]
12-
[--commit-sha COMMIT_SHA] [--generate-license GENERATE_LICENSE] [-v] [--enable-debug] [--enable-json] [--enable-sarif] [--disable-overview]
13-
[--disable-security-issue] [--files FILES] [--ignore-commit-files] [--timeout]
8+
socketcli [-h] [--api-token API_TOKEN] [--repo REPO] [--integration {api,github,gitlab}] [--owner OWNER] [--branch BRANCH]
9+
[--committers [COMMITTERS ...]] [--pr-number PR_NUMBER] [--commit-message COMMIT_MESSAGE] [--commit-sha COMMIT_SHA]
10+
[--target-path TARGET_PATH] [--sbom-file SBOM_FILE] [--files FILES] [--default-branch] [--pending-head]
11+
[--generate-license] [--enable-debug] [--enable-json] [--enable-sarif] [--disable-overview] [--disable-security-issue]
12+
[--allow-unverified] [--ignore-commit-files] [--disable-blocking] [--scm SCM] [--timeout TIMEOUT]
1413
````
1514

1615
If you don't want to provide the Socket API Token every time then you can use the environment variable `SOCKET_SECURITY_API_KEY`
1716
18-
19-
| Parameter | Alternate Name | Required | Default | Description |
20-
|:-------------------------|:---------------|:---------|:--------|:------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
21-
| -h | --help | False | | Show the CLI help message |
22-
| --api-token | | False | | Provides the Socket API Token |
23-
| --repo | | True | | The string name in a git approved name for repositories. |
24-
| --branch | | False | | The string name in a git approved name for branches. |
25-
| --committer | | False | | The string name of the person doing the commit or running the CLI. Can be specified multiple times to have more than one committer |
26-
| --pr-number | | False | 0 | The integer for the PR or MR number |
27-
| --commit-message | | False | | The string for a commit message if there is one |
28-
| --default-branch | | False | False | If the flag is specified this will signal that this is the default branch. This needs to be enabled for a report to update Org Alerts and Org Dependencies |
29-
| --target-path | | False | ./ | This is the path to where the manifest files are location. The tool will recursively search for all supported manifest files |
30-
| --scm | | False | api | This is the mode that the tool is to run in. For local runs `api` would be the mode. Other options are `gitlab` and `github` |
31-
| --generate-license | | False | False | If this flag is specified it will generate a json file with the license per package and license text in the current working directory |
32-
| --version | -v | False | | Prints the version and exits |
33-
| --enable-debug | | False | False | Enables debug messaging for the CLI |
34-
| --sbom-file | | False | False | Creates a JSON file with all dependencies and alerts |
35-
| --commit-sha | | False | | The commit hash for the commit |
36-
| --generate-license | | False | False | If enabled with `--sbom-file` will include license details |
37-
| --enable-json | | False | False | If enabled will change the console output format to JSON |
38-
| --enable-sarif | | False | False | If enabled will change the console output format to SARIF |
39-
| --disable-overview | | False | False | If enabled will disable Dependency Overview comments |
40-
| --disable-security-issue | | False | False | If enabled will disable Security Issue Comments |
41-
| --files | | False | | If provided in the format of `["file1", "file2"]` will be used to determine if there have been supported file changes. This is used if it isn't a git repo and you would like to only run if it supported files have changed. |
42-
| --ignore-commit-files | | False | False | If enabled then the CLI will ignore what files are changed in the commit and look for all manifest files |
43-
| --disable-blocking | | False | False | Disables failing checks and will only exit with an exit code of 0 |
17+
### Parameters
18+
19+
#### Authentication
20+
| Parameter | Required | Default | Description |
21+
|:-------------|:---------|:--------|:--------------------------------------------------------------------------------------|
22+
| --api-token | False | | Socket Security API token (can also be set via SOCKET_SECURITY_API_KEY env var) |
23+
24+
#### Repository
25+
| Parameter | Required | Default | Description |
26+
|:-------------|:---------|:--------|:-------------------------------------------------------------------------|
27+
| --repo | False | | Repository name in owner/repo format |
28+
| --integration| False | api | Integration type (api, github, gitlab) |
29+
| --owner | False | | Name of the integration owner, defaults to the socket organization slug |
30+
| --branch | False | "" | Branch name |
31+
| --committers | False | | Committer(s) to filter by |
32+
33+
#### Pull Request and Commit
34+
| Parameter | Required | Default | Description |
35+
|:----------------|:---------|:--------|:-------------------|
36+
| --pr-number | False | "0" | Pull request number|
37+
| --commit-message| False | | Commit message |
38+
| --commit-sha | False | "" | Commit SHA |
39+
40+
#### Path and File
41+
| Parameter | Required | Default | Description |
42+
|:-------------|:---------|:--------|:-------------------------------------------|
43+
| --target-path| False | ./ | Target path for analysis |
44+
| --sbom-file | False | | SBOM file path |
45+
| --files | False | [] | Files to analyze (JSON array string) |
46+
47+
#### Branch and Scan Configuration
48+
| Parameter | Required | Default | Description |
49+
|:---------------|:---------|:--------|:----------------------------------------------------------|
50+
| --default-branch| False | False | Make this branch the default branch |
51+
| --pending-head | False | False | If true, the new scan will be set as the branch's head scan|
52+
53+
#### Output Configuration
54+
| Parameter | Required | Default | Description |
55+
|:----------------------|:---------|:--------|:---------------------------------------------------------------|
56+
| --generate-license | False | False | Generate license information |
57+
| --enable-debug | False | False | Enable debug logging |
58+
| --enable-json | False | False | Output in JSON format |
59+
| --enable-sarif | False | False | Enable SARIF output of results instead of table or JSON format|
60+
| --disable-overview | False | False | Disable overview output |
61+
62+
#### Security Configuration
63+
| Parameter | Required | Default | Description |
64+
|:-----------------------|:---------|:--------|:-------------------------------|
65+
| --allow-unverified | False | False | Allow unverified packages |
66+
| --disable-security-issue| False | False | Disable security issue checks |
67+
68+
#### Advanced Configuration
69+
| Parameter | Required | Default | Description |
70+
|:-------------------|:---------|:--------|:-----------------------------------------------|
71+
| --ignore-commit-files| False | False | Ignore commit files |
72+
| --disable-blocking | False | False | Disable blocking mode |
73+
| --scm | False | api | Source control management type |
74+
| --timeout | False | | Timeout in seconds for API requests |
4475

4576
## Development
4677

‎pyproject.toml

+1-1
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ dependencies = [
1313
'GitPython',
1414
'packaging',
1515
'python-dotenv',
16-
'socket-sdk-python>=2.0.4'
16+
'socket-sdk-python>=2.0.5'
1717
]
1818
readme = "README.md"
1919
description = "Socket Security CLI for CI/CD"

‎socketsecurity/config.py

+7-3
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ class CliConfig:
2323
enable_debug: bool = False
2424
allow_unverified: bool = False
2525
enable_json: bool = False
26+
enable_sarif: bool = False
2627
disable_overview: bool = False
2728
disable_security_issue: bool = False
2829
files: str = "[]"
@@ -32,6 +33,7 @@ class CliConfig:
3233
integration_org_slug: Optional[str] = None
3334
pending_head: bool = False
3435
timeout: Optional[int] = 1200
36+
timeout: Optional[int] = 1200
3537
@classmethod
3638
def from_args(cls, args_list: Optional[List[str]] = None) -> 'CliConfig':
3739
parser = create_argument_parser()
@@ -61,6 +63,7 @@ def from_args(cls, args_list: Optional[List[str]] = None) -> 'CliConfig':
6163
'enable_debug': args.enable_debug,
6264
'allow_unverified': args.allow_unverified,
6365
'enable_json': args.enable_json,
66+
'enable_sarif': args.enable_sarif,
6467
'disable_overview': args.disable_overview,
6568
'disable_security_issue': args.disable_security_issue,
6669
'files': args.files,
@@ -264,10 +267,11 @@ def create_argument_parser() -> argparse.ArgumentParser:
264267
help="Output in JSON format"
265268
)
266269
output_group.add_argument(
267-
"--enable_json",
268-
dest="enable_json",
270+
"--enable-sarif",
271+
dest="enable_sarif",
269272
action="store_true",
270-
help=argparse.SUPPRESS
273+
action="store_true",
274+
help="Enable SARIF output of results instead of table or JSON format"
271275
)
272276
output_group.add_argument(
273277
"--disable-overview",

‎socketsecurity/core/__init__.py

+2-2
Original file line numberDiff line numberDiff line change
@@ -459,15 +459,15 @@ def create_new_diff(
459459
no_change: bool = False
460460
) -> Diff:
461461
"""Create a new diff using the Socket SDK."""
462-
print(f"starting create_new_diff with no_change: {no_change}")
462+
log.debug(f"starting create_new_diff with no_change: {no_change}")
463463
if no_change:
464464
return Diff(id="no_diff_id")
465465

466466
# Find manifest files
467467
files = self.find_files(path)
468468
files_for_sending = self.load_files_for_sending(files, path)
469469

470-
print(f"files: {files} found at path {path}")
470+
log.debug(f"files: {files} found at path {path}")
471471
if not files:
472472
return Diff(id="no_diff_id")
473473

‎socketsecurity/core/messages.py

+7
Original file line numberDiff line numberDiff line change
@@ -192,6 +192,13 @@ def create_security_comment_sarif(diff) -> dict:
192192
Create SARIF-compliant output from the diff report, including dynamic URL generation
193193
based on manifest type and improved <br/> formatting for GitHub SARIF display.
194194
"""
195+
scan_failed = False
196+
if len(diff.new_alerts) == 0:
197+
for alert in diff.new_alerts:
198+
alert: Issue
199+
if alert.error:
200+
scan_failed = True
201+
break
195202
sarif_data = {
196203
"$schema": "https://json.schemastore.org/sarif-2.1.0.json",
197204
"version": "2.1.0",

‎socketsecurity/output.py

+31-14
Original file line numberDiff line numberDiff line change
@@ -5,33 +5,39 @@
55
from typing import Any, Dict, Optional
66
from .core.messages import Messages
77
from .core.classes import Diff, Issue
8+
from .config import CliConfig
89

910

1011
class OutputHandler:
11-
blocking_disabled: bool
12+
config: CliConfig
1213
logger: logging.Logger
1314

14-
def __init__(self, blocking_disabled: bool):
15-
self.blocking_disabled = blocking_disabled
15+
def __init__(self, config: CliConfig):
16+
self.config = config
1617
self.logger = logging.getLogger("socketcli")
1718

18-
def handle_output(self, diff_report: Diff, sbom_file_name: Optional[str] = None, json_output: bool = False) -> int:
19-
"""Main output handler that determines output format and returns exit code"""
20-
if json_output:
21-
self.output_console_json(diff_report, sbom_file_name)
19+
def handle_output(self, diff_report: Diff) -> None:
20+
"""Main output handler that determines output format"""
21+
if self.config.enable_json:
22+
self.output_console_json(diff_report, self.config.sbom_file)
23+
elif self.config.enable_sarif:
24+
self.output_console_sarif(diff_report, self.config.sbom_file)
2225
else:
23-
self.output_console_comments(diff_report, sbom_file_name)
26+
self.output_console_comments(diff_report, self.config.sbom_file)
2427

25-
self.save_sbom_file(diff_report, sbom_file_name)
28+
self.save_sbom_file(diff_report, self.config.sbom_file)
2629

2730
def return_exit_code(self, diff_report: Diff) -> int:
28-
if not self.report_pass(diff_report) and not self.blocking_disabled:
31+
if self.config.disable_blocking:
32+
return 0
33+
34+
if not self.report_pass(diff_report):
2935
return 1
30-
elif len(diff_report.new_alerts) > 0 and not self.blocking_disabled:
36+
37+
if len(diff_report.new_alerts) > 0:
3138
# 5 means warning alerts but no blocking alerts
3239
return 5
33-
else:
34-
return 0
40+
return 0
3541

3642
def output_console_comments(self, diff_report: Diff, sbom_file_name: Optional[str] = None) -> None:
3743
"""Outputs formatted console comments"""
@@ -46,15 +52,26 @@ def output_console_comments(self, diff_report: Diff, sbom_file_name: Optional[st
4652
def output_console_json(self, diff_report: Diff, sbom_file_name: Optional[str] = None) -> None:
4753
"""Outputs JSON formatted results"""
4854
console_security_comment = Messages.create_security_comment_json(diff_report)
55+
self.save_sbom_file(diff_report, sbom_file_name)
4956
self.logger.info(json.dumps(console_security_comment))
5057

58+
def output_console_sarif(self, diff_report: Diff, sbom_file_name: Optional[str] = None) -> None:
59+
"""
60+
Generate SARIF output from the diff report and print to console.
61+
"""
62+
if diff_report.id != "NO_DIFF_RAN":
63+
# Generate the SARIF structure using Messages
64+
console_security_comment = Messages.create_security_comment_sarif(diff_report)
65+
self.save_sbom_file(diff_report, sbom_file_name)
66+
# Print the SARIF output to the console in JSON format
67+
print(json.dumps(console_security_comment, indent=2))
5168

5269
def report_pass(self, diff_report: Diff) -> bool:
5370
"""Determines if the report passes security checks"""
5471
if not diff_report.new_alerts:
5572
return True
5673

57-
if self.blocking_disabled:
74+
if self.config.disable_blocking:
5875
return True
5976

6077
return not any(issue.error for issue in diff_report.new_alerts)

0 commit comments

Comments
 (0)