Skip to content

Commit cde8660

Browse files
flowstateflowstate
authoredFeb 14, 2025··
Fixed SARIF regression (#53)
* added SARIF back in
·
v2.0.56v2.0.4
1 parent ab26041 commit cde8660

File tree

9 files changed

+131
-68
lines changed

9 files changed

+131
-68
lines changed
 

‎README.md

+63-32
Original file line numberDiff line numberDiff line change
@@ -2,45 +2,76 @@
22

33
The Socket Security CLI was created to enable integrations with other tools like Github Actions, Gitlab, BitBucket, local use cases and more. The tool will get the head scan for the provided repo from Socket, create a new one, and then report any new alerts detected. If there are new alerts against the Socket security policy it'll exit with a non-Zero exit code.
44

5-
6-
75
## Usage
86

97
```` shell
10-
socketcli [-h] [--api-token API_TOKEN] [--repo REPO] [--branch BRANCH] [--committer COMMITTER] [--pr-number PR_NUMBER]
11-
[--commit-message COMMIT_MESSAGE] [--default-branch] [--target-path TARGET_PATH] [--scm {api,github,gitlab}] [--sbom-file SBOM_FILE]
12-
[--commit-sha COMMIT_SHA] [--generate-license GENERATE_LICENSE] [-v] [--enable-debug] [--enable-json] [--enable-sarif] [--disable-overview]
13-
[--disable-security-issue] [--files FILES] [--ignore-commit-files] [--timeout]
8+
socketcli [-h] [--api-token API_TOKEN] [--repo REPO] [--integration {api,github,gitlab}] [--owner OWNER] [--branch BRANCH]
9+
[--committers [COMMITTERS ...]] [--pr-number PR_NUMBER] [--commit-message COMMIT_MESSAGE] [--commit-sha COMMIT_SHA]
10+
[--target-path TARGET_PATH] [--sbom-file SBOM_FILE] [--files FILES] [--default-branch] [--pending-head]
11+
[--generate-license] [--enable-debug] [--enable-json] [--enable-sarif] [--disable-overview] [--disable-security-issue]
12+
[--allow-unverified] [--ignore-commit-files] [--disable-blocking] [--scm SCM] [--timeout TIMEOUT]
1413
````
1514

1615
If you don't want to provide the Socket API Token every time then you can use the environment variable `SOCKET_SECURITY_API_KEY`
1716
18-
19-
| Parameter | Alternate Name | Required | Default | Description |
20-
|:-------------------------|:---------------|:---------|:--------|:------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
21-
| -h | --help | False | | Show the CLI help message |
22-
| --api-token | | False | | Provides the Socket API Token |
23-
| --repo | | True | | The string name in a git approved name for repositories. |
24-
| --branch | | False | | The string name in a git approved name for branches. |
25-
| --committer | | False | | The string name of the person doing the commit or running the CLI. Can be specified multiple times to have more than one committer |
26-
| --pr-number | | False | 0 | The integer for the PR or MR number |
27-
| --commit-message | | False | | The string for a commit message if there is one |
28-
| --default-branch | | False | False | If the flag is specified this will signal that this is the default branch. This needs to be enabled for a report to update Org Alerts and Org Dependencies |
29-
| --target-path | | False | ./ | This is the path to where the manifest files are location. The tool will recursively search for all supported manifest files |
30-
| --scm | | False | api | This is the mode that the tool is to run in. For local runs `api` would be the mode. Other options are `gitlab` and `github` |
31-
| --generate-license | | False | False | If this flag is specified it will generate a json file with the license per package and license text in the current working directory |
32-
| --version | -v | False | | Prints the version and exits |
33-
| --enable-debug | | False | False | Enables debug messaging for the CLI |
34-
| --sbom-file | | False | False | Creates a JSON file with all dependencies and alerts |
35-
| --commit-sha | | False | | The commit hash for the commit |
36-
| --generate-license | | False | False | If enabled with `--sbom-file` will include license details |
37-
| --enable-json | | False | False | If enabled will change the console output format to JSON |
38-
| --enable-sarif | | False | False | If enabled will change the console output format to SARIF |
39-
| --disable-overview | | False | False | If enabled will disable Dependency Overview comments |
40-
| --disable-security-issue | | False | False | If enabled will disable Security Issue Comments |
41-
| --files | | False | | If provided in the format of `["file1", "file2"]` will be used to determine if there have been supported file changes. This is used if it isn't a git repo and you would like to only run if it supported files have changed. |
42-
| --ignore-commit-files | | False | False | If enabled then the CLI will ignore what files are changed in the commit and look for all manifest files |
43-
| --disable-blocking | | False | False | Disables failing checks and will only exit with an exit code of 0 |
17+
### Parameters
18+
19+
#### Authentication
20+
| Parameter | Required | Default | Description |
21+
|:-------------|:---------|:--------|:--------------------------------------------------------------------------------------|
22+
| --api-token | False | | Socket Security API token (can also be set via SOCKET_SECURITY_API_KEY env var) |
23+
24+
#### Repository
25+
| Parameter | Required | Default | Description |
26+
|:-------------|:---------|:--------|:-------------------------------------------------------------------------|
27+
| --repo | False | | Repository name in owner/repo format |
28+
| --integration| False | api | Integration type (api, github, gitlab) |
29+
| --owner | False | | Name of the integration owner, defaults to the socket organization slug |
30+
| --branch | False | "" | Branch name |
31+
| --committers | False | | Committer(s) to filter by |
32+
33+
#### Pull Request and Commit
34+
| Parameter | Required | Default | Description |
35+
|:----------------|:---------|:--------|:-------------------|
36+
| --pr-number | False | "0" | Pull request number|
37+
| --commit-message| False | | Commit message |
38+
| --commit-sha | False | "" | Commit SHA |
39+
40+
#### Path and File
41+
| Parameter | Required | Default | Description |
42+
|:-------------|:---------|:--------|:-------------------------------------------|
43+
| --target-path| False | ./ | Target path for analysis |
44+
| --sbom-file | False | | SBOM file path |
45+
| --files | False | [] | Files to analyze (JSON array string) |
46+
47+
#### Branch and Scan Configuration
48+
| Parameter | Required | Default | Description |
49+
|:---------------|:---------|:--------|:----------------------------------------------------------|
50+
| --default-branch| False | False | Make this branch the default branch |
51+
| --pending-head | False | False | If true, the new scan will be set as the branch's head scan|
52+
53+
#### Output Configuration
54+
| Parameter | Required | Default | Description |
55+
|:----------------------|:---------|:--------|:---------------------------------------------------------------|
56+
| --generate-license | False | False | Generate license information |
57+
| --enable-debug | False | False | Enable debug logging |
58+
| --enable-json | False | False | Output in JSON format |
59+
| --enable-sarif | False | False | Enable SARIF output of results instead of table or JSON format|
60+
| --disable-overview | False | False | Disable overview output |
61+
62+
#### Security Configuration
63+
| Parameter | Required | Default | Description |
64+
|:-----------------------|:---------|:--------|:-------------------------------|
65+
| --allow-unverified | False | False | Allow unverified packages |
66+
| --disable-security-issue| False | False | Disable security issue checks |
67+
68+
#### Advanced Configuration
69+
| Parameter | Required | Default | Description |
70+
|:-------------------|:---------|:--------|:-----------------------------------------------|
71+
| --ignore-commit-files| False | False | Ignore commit files |
72+
| --disable-blocking | False | False | Disable blocking mode |
73+
| --scm | False | api | Source control management type |
74+
| --timeout | False | | Timeout in seconds for API requests |
4475

4576
## Development
4677

‎pyproject.toml

+1-1
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ dependencies = [
1313
'GitPython',
1414
'packaging',
1515
'python-dotenv',
16-
'socket-sdk-python>=2.0.4'
16+
'socket-sdk-python>=2.0.5'
1717
]
1818
readme = "README.md"
1919
description = "Socket Security CLI for CI/CD"

‎socketsecurity/__init__.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
__author__ = 'socket.dev'
2-
__version__ = '2.0.3'
2+
__version__ = '2.0.4'

‎socketsecurity/config.py

+15-4
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ class CliConfig:
2323
enable_debug: bool = False
2424
allow_unverified: bool = False
2525
enable_json: bool = False
26+
enable_sarif: bool = False
2627
disable_overview: bool = False
2728
disable_security_issue: bool = False
2829
files: str = "[]"
@@ -31,7 +32,7 @@ class CliConfig:
3132
integration_type: IntegrationType = "api"
3233
integration_org_slug: Optional[str] = None
3334
pending_head: bool = False
34-
timeout: Optional[int] = None
35+
timeout: Optional[int] = 1200
3536
@classmethod
3637
def from_args(cls, args_list: Optional[List[str]] = None) -> 'CliConfig':
3738
parser = create_argument_parser()
@@ -61,6 +62,7 @@ def from_args(cls, args_list: Optional[List[str]] = None) -> 'CliConfig':
6162
'enable_debug': args.enable_debug,
6263
'allow_unverified': args.allow_unverified,
6364
'enable_json': args.enable_json,
65+
'enable_sarif': args.enable_sarif,
6466
'disable_overview': args.disable_overview,
6567
'disable_security_issue': args.disable_security_issue,
6668
'files': args.files,
@@ -215,6 +217,7 @@ def create_argument_parser() -> argparse.ArgumentParser:
215217
config_group.add_argument(
216218
"--default_branch",
217219
dest="default_branch",
220+
action="store_true",
218221
help=argparse.SUPPRESS
219222
)
220223
config_group.add_argument(
@@ -226,6 +229,7 @@ def create_argument_parser() -> argparse.ArgumentParser:
226229
config_group.add_argument(
227230
"--pending_head",
228231
dest="pending_head",
232+
action="store_true",
229233
help=argparse.SUPPRESS
230234
)
231235

@@ -240,6 +244,7 @@ def create_argument_parser() -> argparse.ArgumentParser:
240244
output_group.add_argument(
241245
"--generate_license",
242246
dest="generate_license",
247+
action="store_true",
243248
help=argparse.SUPPRESS
244249
)
245250
output_group.add_argument(
@@ -251,6 +256,7 @@ def create_argument_parser() -> argparse.ArgumentParser:
251256
output_group.add_argument(
252257
"--enable_debug",
253258
dest="enable_debug",
259+
action="store_true",
254260
help=argparse.SUPPRESS
255261
)
256262
output_group.add_argument(
@@ -260,9 +266,10 @@ def create_argument_parser() -> argparse.ArgumentParser:
260266
help="Output in JSON format"
261267
)
262268
output_group.add_argument(
263-
"--enable_json",
264-
dest="enable_json",
265-
help=argparse.SUPPRESS
269+
"--enable-sarif",
270+
dest="enable_sarif",
271+
action="store_true",
272+
help="Enable SARIF output of results instead of table or JSON format"
266273
)
267274
output_group.add_argument(
268275
"--disable-overview",
@@ -273,6 +280,7 @@ def create_argument_parser() -> argparse.ArgumentParser:
273280
output_group.add_argument(
274281
"--disable_overview",
275282
dest="disable_overview",
283+
action="store_true",
276284
help=argparse.SUPPRESS
277285
)
278286

@@ -292,6 +300,7 @@ def create_argument_parser() -> argparse.ArgumentParser:
292300
security_group.add_argument(
293301
"--disable_security_issue",
294302
dest="disable_security_issue",
303+
action="store_true",
295304
help=argparse.SUPPRESS
296305
)
297306

@@ -306,6 +315,7 @@ def create_argument_parser() -> argparse.ArgumentParser:
306315
advanced_group.add_argument(
307316
"--ignore_commit_files",
308317
dest="ignore_commit_files",
318+
action="store_true",
309319
help=argparse.SUPPRESS
310320
)
311321
advanced_group.add_argument(
@@ -317,6 +327,7 @@ def create_argument_parser() -> argparse.ArgumentParser:
317327
advanced_group.add_argument(
318328
"--disable_blocking",
319329
dest="disable_blocking",
330+
action="store_true",
320331
help=argparse.SUPPRESS
321332
)
322333
advanced_group.add_argument(

‎socketsecurity/core/__init__.py

+2-2
Original file line numberDiff line numberDiff line change
@@ -427,15 +427,15 @@ def create_new_diff(
427427
428428
no_change: If True, return empty diff
429429
"""
430-
print(f"starting create_new_diff with no_change: {no_change}")
430+
log.debug(f"starting create_new_diff with no_change: {no_change}")
431431
if no_change:
432432
return Diff(id="no_diff_id")
433433

434434
# Find manifest files
435435
files = self.find_files(path)
436436
files_for_sending = self.load_files_for_sending(files, path)
437437

438-
print(f"files: {files} found at path {path}")
438+
log.debug(f"files: {files} found at path {path}")
439439
if not files:
440440
return Diff(id="no_diff_id")
441441

‎socketsecurity/core/messages.py

+7
Original file line numberDiff line numberDiff line change
@@ -192,6 +192,13 @@ def create_security_comment_sarif(diff) -> dict:
192192
Create SARIF-compliant output from the diff report, including dynamic URL generation
193193
based on manifest type and improved <br/> formatting for GitHub SARIF display.
194194
"""
195+
scan_failed = False
196+
if len(diff.new_alerts) == 0:
197+
for alert in diff.new_alerts:
198+
alert: Issue
199+
if alert.error:
200+
scan_failed = True
201+
break
195202
sarif_data = {
196203
"$schema": "https://json.schemastore.org/sarif-2.1.0.json",
197204
"version": "2.1.0",

‎socketsecurity/core/socket_config.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
class SocketConfig:
1010
api_key: str
1111
api_url: str = "https://api.socket.dev/v0"
12-
timeout: int = 30
12+
timeout: int = 1200
1313
allow_unverified_ssl: bool = False
1414
org_id: Optional[str] = None
1515
org_slug: Optional[str] = None

0 commit comments

Comments
 (0)
Please sign in to comment.