@aikidosec/ci-api-client 1.0.17 → 1.0.19

package/lib/commands/scanRelease.js

@@ -2,7 +2,7 @@ import chalk from 'chalk';
 import { Argument, InvalidArgumentError, Option } from 'commander';
 import { pollScanStatus, startScan, } from '../aikidoApi.js';
 import { getApiKey } from '../configuration.js';
-import { outputError, outputHttpError, outputLog, startSpinner, } from '../output.js';
+import { outputError, outputHttpError, outputJson, outputLog, startSpinner, } from '../output.js';
 async function cli(repoId, commitId, options, command) {
     const apiKey = getApiKey();
     if (!apiKey) {
@@ -11,6 +11,10 @@ async function cli(repoId, commitId, options, command) {
     const { apiOptions, cliOptions } = parseCliOptions(options);
     let loader;
     let pollCount = 1;
+    const jsonOutput = cliOptions.json;
+    if (jsonOutput) {
+        process.env.QUIET = true;
+    }
     const onStart = () => {
         loader = startSpinner('Starting Aikido Security release scan');
     };
@@ -27,6 +31,16 @@ async function cli(repoId, commitId, options, command) {
         loader = startSpinner('Waiting for scan to complete');
     };
     const onScanComplete = (pollResult) => {
+        if (jsonOutput) {
+            outputJson({
+                gate_passed: pollResult.gate_passed === true,
+                issue_breakdown: pollResult.issue_breakdown,
+            });
+            if (pollResult.gate_passed !== true) {
+                process.exitCode = 10;
+            }
+            return;
+        }
         if (pollResult.gate_passed === true) {
             loader?.succeed('Scan completed, no open issues found');
             if (pollResult.diff_url) {
@@ -123,8 +137,8 @@ export const scan = async ({ repoId, commitId, options, pollInterval = 10, onSta
     pollStatus();
 };
 const parseCliOptions = (userCliOptions) => {
-    const apiOptions = { version: '1.0.16' };
-    const cliOptions = { pollInterval: 10 };
+    const apiOptions = { version: '1.0.18' };
+    const cliOptions = { pollInterval: 10, json: false };
     if (userCliOptions.pullRequestTitle) {
         apiOptions.pull_request_metadata = {
             ...(apiOptions.pull_request_metadata ?? {}),
@@ -168,6 +182,9 @@ const parseCliOptions = (userCliOptions) => {
     else if (userCliOptions.pollInterval) {
         cliOptions.pollInterval = userCliOptions.pollInterval;
     }
+    if (userCliOptions.json) {
+        cliOptions.json = true;
+    }
     return { apiOptions, cliOptions };
 };
 const validateCommitId = (value) => {
@@ -193,6 +210,7 @@ export const cliSetup = (program) => program
     .argParser(parseFloat))
     .addOption(new Option('--base-branch <branchname>', 'Base branch for the release gated scan.'))
     .option('--sla-mode', 'Let Aikido only fail only on open issues that have gone out of SLA.')
+    .option('--json', 'Output the scan result as JSON (gate_passed and issue_breakdown)')
     .description('Run a release scan of an Aikido repo.')
     .action(cli);
 export default { cli, cliSetup, scan };

package/lib/commands/uploadCoverage.d.ts

@@ -0,0 +1,15 @@
+import { Command } from 'commander';
+type TUploadCoverageUserCliOptions = {
+    repoName: string;
+    commitSha: string;
+    branchName: string;
+    filePaths: string[];
+    repositoryId: string | number;
+};
+declare function cli(options: TUploadCoverageUserCliOptions): Promise<void>;
+export declare const cliSetup: (program: Command) => Command;
+declare const _default: {
+    cli: typeof cli;
+    cliSetup: (program: Command) => Command;
+};
+export default _default;

package/lib/commands/uploadCoverage.js

@@ -0,0 +1,63 @@
+import { uploadCodeCoverage } from '../aikidoApi.js';
+import { collectUploadPayload } from '../codeCoverage/collectUploadPayload.js';
+import { getApiKey } from '../configuration.js';
+import { outputError, outputHttpError, outputLog, startSpinner, } from '../output.js';
+async function cli(options) {
+    const apiKey = getApiKey();
+    if (!apiKey) {
+        outputError('Please set an api key using: aikido-api-client apikey <key>');
+        return;
+        return;
+    }
+    const filePaths = normalizeFilePaths(options.filePaths);
+    if (filePaths.length === 0) {
+        outputError('No code coverage file(s) provided. Specify at least one path with --file-paths.');
+    }
+    let loader = startSpinner('Collecting coverage files and repository metadata');
+    let payload;
+    try {
+        payload = await collectUploadPayload(filePaths);
+    }
+    catch (error) {
+        loader?.fail();
+        outputError(error instanceof Error ? error.message : String(error));
+        return;
+    }
+    loader?.succeed(`Found ${payload.files.length} coverage file(s) (source paths=${payload.repository_source_paths.length}, eof=${Object.keys(payload.eof).length})`);
+    for (const file of payload.files) {
+        outputLog(`  ${file.filename} (${file.format})`);
+    }
+    loader = startSpinner('Uploading code coverage to Aikido');
+    try {
+        await uploadCodeCoverage({
+            repository_id: options.repositoryId,
+            repo_name: options.repoName,
+            commit_sha: options.commitSha,
+            branch_name: options.branchName,
+            repository_source_paths: payload.repository_source_paths,
+            eof: payload.eof,
+            files: payload.files,
+        });
+        loader?.succeed('Code coverage upload completed');
+        process.exit(0);
+    }
+    catch (error) {
+        loader?.fail();
+        outputHttpError(error);
+        process.exit(1);
+    }
+}
+const normalizeFilePaths = (filePaths) => filePaths
+    .flatMap((entry) => entry.split(/\n|\s+|,/))
+    .map((filePath) => filePath.trim())
+    .filter(Boolean);
+export const cliSetup = (program) => program
+    .command('upload-coverage')
+    .requiredOption('-r, --repo-name <reponame>', 'Repository name as owner/repo (e.g. org/my-repo)')
+    .requiredOption('-c, --commit-sha <commitsha>', 'The commit SHA for this CI run')
+    .requiredOption('-b, --branch-name <branchname>', 'The branch name for this CI run')
+    .requiredOption('-f, --file-paths <paths...>', 'Path(s) to LCOV or Cobertura coverage report(s). Format is detected from each filename.')
+    .requiredOption('-ri, --repository-id <repositoryid>', 'The scm repository id')
+    .description('Upload LCOV or Cobertura coverage reports to Aikido (with repository_source_paths and EOF metadata).')
+    .action(cli);
+export default { cli, cliSetup };

package/lib/index.js

@@ -6,16 +6,18 @@ import apiKey from './commands/apiKey.js';
 import scan from './commands/scan.js';
 import scanRelease from './commands/scanRelease.js';
 import upload from './commands/upload.js';
+import uploadCoverage from './commands/uploadCoverage.js';
 dotenv.config(process.env.NODE_ENV ? { path: `.env.${process.env.NODE_ENV}` } : {});
 export const program = new Command();
 program
     .name('Aikido API Client')
     .description('CLI api client to easily integrate the Aikido public CI API into custom deploy scripts')
-    .version('1.0.16');
+    .version('1.0.18');
 apiKey.cliSetup(program);
 scan.cliSetup(program);
 scanRelease.cliSetup(program);
 upload.cliSetup(program);
+uploadCoverage.cliSetup(program);
 program
     .option('-q, --quiet', 'Disable console output when executing commands')
     .on('option:quiet', function () {

package/lib/output.d.ts

@@ -1,6 +1,7 @@
 import { Ora } from 'ora';
 import { AxiosError } from 'axios';
 export declare const outputLog: (message: string) => void;
+export declare const outputJson: (data: unknown) => void;
 export declare const outputDebug: (variable: any) => void;
 export declare const outputError: (message: string, exitCode?: number) => void;
 export declare const outputHttpError: (axiosError: AxiosError) => void;

package/lib/output.js

@@ -6,6 +6,9 @@ export const outputLog = (message) => {
         console.log(message);
     }
 };
+export const outputJson = (data) => {
+    console.log(JSON.stringify(data, null, 2));
+};
 export const outputDebug = (variable) => {
     if (process.env.CLI_DEBUG == true || process.env.CLI_DEBUG == 'true') {
         console.log(chalk.blue(typeof variable == 'object' ? JSON.stringify(variable) : variable));

package/npm-shrinkwrap.json

@@ -1,19 +1,20 @@
 {
   "name": "@aikidosec/ci-api-client",
-  "version": "1.0.17",
+  "version": "1.0.19",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@aikidosec/ci-api-client",
-      "version": "1.0.17",
+      "version": "1.0.19",
       "license": "MIT",
       "dependencies": {
-        "axios": "1.16.1",
+        "axios": "1.18.0",
         "chalk": "5.3.0",
         "commander": "11.0.0",
         "configstore": "6.0.0",
         "dotenv": "16.3.1",
+        "ignore": "7.0.8",
         "ora": "6.3.1"
       },
       "bin": {
@@ -116,8 +117,7 @@
     "node_modules/@types/node": {
       "version": "20.3.3",
       "dev": true,
-      "license": "MIT",
-      "peer": true
+      "license": "MIT"
     },
     "node_modules/abbrev": {
       "version": "1.1.1",
@@ -206,9 +206,9 @@
       "license": "MIT"
     },
     "node_modules/axios": {
-      "version": "1.16.1",
-      "resolved": "https://registry.npmjs.org/axios/-/axios-1.16.1.tgz",
-      "integrity": "sha512-caYkukvroVPO8KrzuJEb50Hm07KwfBZPEC3VeFHTsqWHvKTsy54hjJz9BS/cdaypROE2rH6xvm9mHX4fgWkr3A==",
+      "version": "1.18.0",
+      "resolved": "https://registry.npmjs.org/axios/-/axios-1.18.0.tgz",
+      "integrity": "sha512-E32NzpYKp++W7XRe52rHiXV2ehxmh3wbdgO7MHeFM+vqxLBYHzt0ElkiImtOBxtOmyp0yoC8C6uESVV84Y2/hw==",
       "license": "MIT",
       "dependencies": {
         "follow-redirects": "^1.16.0",
@@ -781,6 +781,15 @@
       ],
       "license": "BSD-3-Clause"
     },
+    "node_modules/ignore": {
+      "version": "7.0.8",
+      "resolved": "https://registry.npmjs.org/ignore/-/ignore-7.0.8.tgz",
+      "integrity": "sha512-YYNsSlXBjMk92SKnkwvB5LOVSa6OznlFUGcsvrFgNJbJCd0M1XKeFVRc8ZByeCqz32FivYNHJVooLmdqrmvp/Q==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 4"
+      }
+    },
     "node_modules/ignore-by-default": {
       "version": "1.0.1",
       "dev": true,
@@ -1271,7 +1280,6 @@
       "version": "5.1.6",
       "dev": true,
       "license": "Apache-2.0",
-      "peer": true,
       "bin": {
         "tsc": "bin/tsc",
         "tsserver": "bin/tsserver"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aikidosec/ci-api-client",
-  "version": "1.0.17",
+  "version": "1.0.19",
   "description": "CLI api client to easily integrate the Aikido public CI API into custom deploy scripts",
   "license": "MIT",
   "author": "Bert Devriese <bert@builtinbruges.com>",
@@ -25,11 +25,12 @@
     }
   },
   "dependencies": {
-    "axios": "1.16.1",
+    "axios": "1.18.0",
     "chalk": "5.3.0",
     "commander": "11.0.0",
     "configstore": "6.0.0",
     "dotenv": "16.3.1",
+    "ignore": "7.0.8",
     "ora": "6.3.1"
   },
   "devDependencies": {

package/src/aikidoApi.ts

@@ -1,4 +1,5 @@
 import axios from 'axios';
+import { gzipSync } from 'node:zlib';
 import { getApiKey } from './configuration.js';
 import { outputDebug } from './output.js';
 
@@ -82,8 +83,26 @@ export type TPollIsScanningResult = {
   sbom_scan_completed?: boolean;
 };
 
+export type TIssueSeverityBreakdown = {
+  critical: number;
+  high: number;
+  medium: number;
+  low: number;
+};
+
+export type TIssueBreakdown = {
+  sast: TIssueSeverityBreakdown;
+  sca: TIssueSeverityBreakdown;
+  iac: TIssueSeverityBreakdown;
+  secrets: TIssueSeverityBreakdown;
+  malware: TIssueSeverityBreakdown;
+  license: TIssueSeverityBreakdown;
+  code_quality: TIssueSeverityBreakdown;
+};
+
 type TPollScanCompletedOptions = {
   gate_passed: boolean;
+  issue_breakdown?: TIssueBreakdown;
 };
 
 type TPollScanFeatureBranchCompletedOptions = {
@@ -168,3 +187,61 @@ export async function uploadCustomScanResult(
 
   return resultData;
 }
+// #endregion
+
+// #region Upload code coverage
+export type TUploadCodeCoverageFile = {
+  filename: string;
+  format: 'lcov' | 'cobertura';
+  content: string;
+};
+
+export type TUploadCodeCoverageOptions = {
+  repository_id: string | number;
+  repo_name: string;
+  commit_sha: string;
+  branch_name: string;
+  repository_source_paths: string[];
+  eof: Record<string, number>;
+  files: TUploadCodeCoverageFile[];
+};
+
+
+export async function uploadCodeCoverage(data: TUploadCodeCoverageOptions){
+  const requestUrl = `${getApiUrl()}/api/integrations/continuous_integration/scan/code_coverage`;
+  const requestConfig = {
+    method: 'POST',
+    data: {
+      repository_id: data.repository_id,
+      repo_name: data.repo_name,
+      commit_sha: data.commit_sha,
+      branch_name: data.branch_name,
+      repository_source_paths: data.repository_source_paths,
+      eof: data.eof,
+      files: data.files.map((file) => ({
+        filename: file.filename,
+        format: file.format,
+        content: gzipSync(file.content).toString('base64'),
+      })),
+    },
+    headers: getApiHeaders(),
+  };
+
+  outputDebug(`API request: ${requestUrl}`);
+  outputDebug({
+    ...requestConfig,
+    data: {
+      ...requestConfig.data,
+      files: requestConfig.data.files.map((file) => ({
+        filename: file.filename,
+        format: file.format,
+        content: `[base64 gzip, ${file.content.length} chars]`,
+      })),
+    },
+  });
+
+  const resultData = (await axios(requestUrl, requestConfig)).data;
+  outputDebug(resultData);
+
+  return resultData;
+}

package/src/codeCoverage/collectUploadPayload.ts

@@ -0,0 +1,93 @@
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import { validateFilePath } from './paths.js';
+import { loadProjectFiles } from './projectFiles.js';
+import {
+  TCoverageFormat,
+  detectFormatFromFilename,
+  extractCoveredSourcePaths,
+} from './reportPaths.js';
+import { loadSourceLineFixes } from './sourceLineFixes.js';
+
+export type TCoverageFilePayload = {
+  filename: string;
+  format: TCoverageFormat;
+  content: string;
+};
+
+export type TCollectUploadPayloadResult = {
+  repository_source_paths: string[];
+  eof: Record<string, number>;
+  files: TCoverageFilePayload[];
+};
+
+/**
+ * Read coverage files and collect repository_source_paths + EOF metadata
+ * for backend processing. Mirrors AikidoSec/code-coverage-github-action.
+ */
+export async function collectUploadPayload(
+  filePaths: string[]
+): Promise<TCollectUploadPayloadResult> {
+  if (filePaths.length === 0) {
+    throw new Error(
+      'No code coverage file(s) provided. Specify at least one path.'
+    );
+  }
+
+  const project = await loadProjectFiles();
+  if (!project || project.files.length === 0) {
+    throw new Error(
+      'No source files found in this repository. ' +
+        'Run this command from a checked-out repository before uploading coverage.'
+    );
+  }
+
+  const repositoryRoot = project.root;
+  const files: TCoverageFilePayload[] = [];
+  const coveredPaths = new Set<string>();
+
+  for (const inputPath of filePaths) {
+    validateFilePath(inputPath);
+    
+    const absolutePath = path.resolve(inputPath);
+    const stats = await fs.lstat(absolutePath);
+    const realPath = await fs.realpath(absolutePath);
+    const relativePath = path.relative(repositoryRoot, realPath);
+    if (
+      stats.isSymbolicLink() ||
+      !stats.isFile() ||
+      relativePath.startsWith('..') ||
+      path.isAbsolute(relativePath)
+    ) {
+      throw new Error(
+        `Coverage file must be a regular file inside the repository: ${inputPath}`
+      );
+    }
+    const content = await fs.readFile(realPath, 'utf8');
+    const format = detectFormatFromFilename(inputPath);
+
+    for (const sourcePath of extractCoveredSourcePaths(content, format, repositoryRoot)) {
+      coveredPaths.add(sourcePath);
+    }
+
+    files.push({
+      filename: path.posix.basename(inputPath.replace(/\\/g, '/')),
+      format,
+      content,
+    });
+  }
+
+  const eof: Record<string, number> = {};
+  for (const sourcePath of coveredPaths) {
+    const fixes = await loadSourceLineFixes(repositoryRoot, sourcePath);
+    if (fixes?.eof != null) {
+      eof[sourcePath] = fixes.eof;
+    }
+  }
+
+  return {
+    repository_source_paths: project.files,
+    eof,
+    files,
+  };
+}

package/src/codeCoverage/paths.ts

@@ -0,0 +1,62 @@
+import path from 'node:path';
+
+/**
+ * Validate that a file path is safe to read.
+ * Rejects absolute paths and paths containing '..' segments to prevent
+ * directory traversal and arbitrary file access.
+ */
+export function validateFilePath(filePath: string): void {
+  if (filePath.includes('..') || isAbsoluteSourcePath(filePath)) {
+    throw new Error(
+      'Invalid file path: absolute paths and ".." segments are not allowed'
+    );
+  }
+}
+
+export function isAbsoluteSourcePath(sourcePath: string): boolean {
+  const trimmedPath = sourcePath.trim();
+  const pathInput = normalizePathSeparators(trimmedPath);
+
+  const windowsPath =
+    /^[a-zA-Z]:[\\/]/.test(trimmedPath) ||
+    trimmedPath.startsWith('\\\\') ||
+    trimmedPath.startsWith('//');
+  const pathApi = windowsPath ? path.win32 : path.posix;
+
+  return pathApi.isAbsolute(pathInput);
+}
+
+/** Trim, use forward slashes, drop a leading `./`. */
+export function normalizePathSeparators(sourcePath: string): string {
+  return sourcePath.trim().replace(/\\/g, '/').replace(/^\.\//, '');
+}
+
+export function normalizeSourcePath(
+  sourcePath: string,
+  repositoryRoot: string
+): string {
+  const trimmedPath = sourcePath.trim();
+  const pathInput = normalizePathSeparators(trimmedPath);
+
+  const windowsPath =
+    /^[a-zA-Z]:[\\/]/.test(trimmedPath) ||
+    trimmedPath.startsWith('\\\\') ||
+    trimmedPath.startsWith('//');
+  const pathApi = windowsPath ? path.win32 : path.posix;
+  const absolutePath = pathApi.isAbsolute(pathInput);
+  const normalizedPath = absolutePath
+    ? pathApi.relative(repositoryRoot, pathInput)
+    : pathInput;
+
+  if (
+    absolutePath &&
+    (!normalizedPath ||
+      normalizedPath === '..' ||
+      normalizedPath.startsWith(`..${pathApi.sep}`) ||
+      pathApi.isAbsolute(normalizedPath))
+  ) {
+    throw new Error(`Invalid source path outside the repository: ${sourcePath}`);
+  }
+
+  return normalizePathSeparators(normalizedPath);
+}