@aikidosec/ci-api-client 1.0.17 → 1.0.19

package/src/codeCoverage/projectFiles.ts

@@ -0,0 +1,342 @@
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import ignore, { Ignore } from 'ignore';
+
+// Always skip these, even if .gitignore does not list them.
+const HARDCODED_IGNORES = [
+  '.git/',
+  'node_modules/',
+  'vendor/',
+  'coverage/',
+  'dist/',
+  'build/',
+  '.venv/',
+  'venv/',
+  '__pycache__/',
+  '.eggs/',
+  '*.egg-info/',
+  '.tox/',
+  '.mypy_cache/',
+  '.pytest_cache/',
+  '.next/',
+  '.nuxt/',
+  '.turbo/',
+  '.cache/',
+  'bower_components/',
+  '*.png',
+  '*.gif',
+  '*.jpg',
+  '*.jpeg',
+  '*.webp',
+  '*.ico',
+  '*.woff',
+  '*.woff2',
+  '*.ttf',
+  '*.eot',
+  '*.mp4',
+  '*.mp3',
+  '.nyc_output/',
+  'jspm_packages/',
+  '.yarn/cache/',
+  '.pnpm-store/',
+  'target/', // Java/Rust
+  'Pods/', // Swift
+];
+
+type TIgnoreStackEntry = {
+  base: string;
+  ig: Ignore;
+};
+
+export type TProjectFiles = {
+  root: string;
+  files: string[];
+};
+
+// Walk the repo and return relative file paths, applying hardcoded ignores + .gitignore.
+export async function loadProjectFiles(): Promise<TProjectFiles | null> {
+  const root = await findGitRoot(process.cwd());
+  const ignoreManager = ignore().add(HARDCODED_IGNORES);
+
+  try {
+    ignoreManager.add(await fs.readFile(path.join(root, '.gitignore'), 'utf8'));
+  } catch {
+    // No root .gitignore — hardcoded rules still apply.
+  }
+
+  const files: string[] = [];
+  await collectFiles(root, '', [{ base: '', ig: ignoreManager }], files);
+
+  const projectFiles = files.filter(isLikelySourceFile);
+  return projectFiles.length === 0 ? null : { root, files: projectFiles };
+}
+
+async function findGitRoot(startDir: string): Promise<string> {
+  const start = path.resolve(startDir);
+  let dir = start;
+
+  while (path.dirname(dir) !== dir) {
+    try {
+      await fs.access(path.join(dir, '.git'));
+      return dir;
+    } catch {
+      dir = path.dirname(dir);
+    }
+  }
+
+  try {
+    await fs.access(path.join(dir, '.git'));
+    return dir;
+  } catch {
+    return start;
+  }
+}
+
+// Skip coverage report files and .gitignore — not useful as source matches.
+// Not in HARDCODED_IGNORES because these often live at the repo root and are not gitignored.
+function isLikelySourceFile(relativePath: string): boolean {
+  const base = relativePath.slice(relativePath.lastIndexOf('/') + 1);
+  const lower = base.toLowerCase();
+
+  if (
+    lower === '.gitignore' ||
+    lower.endsWith('.lcov') ||
+    lower === 'lcov.info' ||
+    (lower.endsWith('.info') && lower.includes('lcov')) ||
+    lower === 'coverage-final.json' ||
+    lower === 'clover.xml' ||
+    lower === 'cobertura.xml' ||
+    (lower.endsWith('.xml') && lower.includes('cobertura'))
+  ) {
+    return false;
+  }
+
+  return true;
+}
+
+// Recursively list files. ignoreStack is root → nested .gitignore rules for this path.
+async function collectFiles(
+  absoluteDir: string,
+  relativeDir: string,
+  ignoreStack: TIgnoreStackEntry[],
+  files: string[]
+): Promise<void> {
+  let stack = ignoreStack;
+
+  if (relativeDir) {
+    try {
+      const nested = ignore().add(
+        await fs.readFile(path.join(absoluteDir, '.gitignore'), 'utf8')
+      );
+      stack = [...ignoreStack, { base: relativeDir, ig: nested }];
+    } catch {
+      // No nested .gitignore for this directory.
+    }
+  }
+
+  let entries;
+  try {
+    entries = await fs.readdir(absoluteDir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+
+  for (const entry of entries) {
+    const relativePath = relativeDir
+      ? `${relativeDir}/${entry.name}`
+      : entry.name;
+
+    if (isIgnored(relativePath, entry.isDirectory(), stack)) {
+      continue;
+    }
+
+    if (entry.isDirectory()) {
+      await collectFiles(
+        path.join(absoluteDir, entry.name),
+        relativePath,
+        stack,
+        files
+      );
+    } else if (entry.isFile() || entry.isSymbolicLink()) {
+      files.push(relativePath);
+    }
+  }
+}
+
+// Git last-match: walk root → nested; a later matching rule (including !negation) wins.
+function isIgnored(
+  relativePath: string,
+  isDirectory: boolean,
+  stack: TIgnoreStackEntry[]
+): boolean {
+  let ignored = false;
+
+  for (const { base, ig } of stack) {
+    const testPath = base ? relativePath.slice(base.length + 1) : relativePath;
+
+    if (!testPath) {
+      continue;
+    }
+
+    const result = ignoreDecision(ig, testPath, isDirectory);
+
+    if (result.ignored) {
+      ignored = true;
+    } else if (result.unignored) {
+      ignored = false;
+    }
+  }
+
+  return ignored;
+}
+
+// Directory patterns end with "/"; node-ignore treats "foo" as a file unless we also test "foo/".
+function ignoreDecision(
+  ig: Ignore,
+  testPath: string,
+  isDirectory: boolean
+): { ignored: boolean; unignored: boolean } {
+  const result = ig.test(testPath);
+
+  if (isDirectory) {
+    const directoryResult = ig.test(`${testPath}/`);
+    if (directoryResult.ignored || directoryResult.unignored) {
+      return directoryResult;
+    }
+  }
+
+  return result;
+}
+
+// Drop the file extension: "src/foo.ts" → "src/foo".
+export function pathStem(sourcePath: string): string {
+  const lastSlashIndex = sourcePath.lastIndexOf('/');
+  const lastDotIndex = sourcePath.lastIndexOf('.');
+
+  if (lastDotIndex > lastSlashIndex) {
+    return sourcePath.slice(0, lastDotIndex);
+  }
+
+  return sourcePath;
+}
+
+function normalizePath(filePath: string): string {
+  return filePath.trim().replace(/\\/g, '/').replace(/^\.\//, '');
+}
+
+// True if paths are equal, or one ends with the other after a "/".
+// e.g. "app/src/util.js" matches "src/util.js"; "src/utils.js" does not match "util.js".
+function isSamePathOrSuffix(fullPath: string, possibleSuffix: string): boolean {
+  const normalizedFullPath = fullPath.toLowerCase();
+  const suffix = possibleSuffix.toLowerCase();
+  return (
+    normalizedFullPath === suffix ||
+    normalizedFullPath.endsWith(`/${suffix}`)
+  );
+}
+
+// Count matching segments from the end: "x/a/b.js" and "y/a/b.js" → 2.
+// needed for picking the best match when there are multiple candidates
+function countSharedTrailingSegments(
+  leftPath: string,
+  rightPath: string
+): number {
+  const leftSegments = leftPath.toLowerCase().split('/');
+  const rightSegments = rightPath.toLowerCase().split('/');
+  const maxShared = Math.min(leftSegments.length, rightSegments.length);
+  let sharedCount = 0;
+
+  while (
+    sharedCount < maxShared &&
+    leftSegments[leftSegments.length - 1 - sharedCount] ===
+      rightSegments[rightSegments.length - 1 - sharedCount]
+  ) {
+    sharedCount++;
+  }
+
+  return sharedCount;
+}
+
+// Prefer more shared trailing segments, then the shorter path. Tie → null (ambiguous).
+// needed for picking the best match when there are multiple candidates
+function pickBestMatch(
+  coveragePath: string,
+  candidates: string[]
+): string | null {
+  let best: string | null = null;
+  let bestShared = -1;
+  let bestLength = Infinity;
+  let ambiguous = false;
+
+  for (const candidate of candidates) {
+    const shared = countSharedTrailingSegments(coveragePath, candidate);
+
+    if (
+      shared > bestShared ||
+      (shared === bestShared && candidate.length < bestLength)
+    ) {
+      best = candidate;
+      bestShared = shared;
+      bestLength = candidate.length;
+      ambiguous = false;
+    } else if (shared === bestShared && candidate.length === bestLength) {
+      ambiguous = true;
+    }
+  }
+
+  return ambiguous ? null : best;
+}
+
+// Map a coverage report path (LCOV SF:) to a real project file. No match → null (drop it).
+export function createPathResolver(
+  projectFiles: string[]
+): (coveragePath: string) => string | null {
+  const byBasename = new Map<string, string[]>();
+
+  // group by basename
+  for (const projectPath of projectFiles) {
+    const key = projectPath
+      .slice(projectPath.lastIndexOf('/') + 1)
+      .toLowerCase();
+    const entries = byBasename.get(key);
+    if (entries) {
+      entries.push(projectPath);
+    } else {
+      byBasename.set(key, [projectPath]);
+    }
+  }
+
+  return (coveragePath: string) => {
+    const normalizedCoveragePath = normalizePath(coveragePath);
+    const key = normalizedCoveragePath
+      .slice(normalizedCoveragePath.lastIndexOf('/') + 1)
+      .toLowerCase();
+
+    // find all files with the same basename
+    const candidates = byBasename.get(key) ?? [];
+
+    // filter by path suffix
+    const matches = candidates.filter(
+      (projectPath) =>
+        isSamePathOrSuffix(projectPath, normalizedCoveragePath) ||
+        isSamePathOrSuffix(normalizedCoveragePath, projectPath)
+    );
+
+    if (matches.length === 0) {
+      return null;
+    }
+
+    const exactMatch = matches.find(
+      (projectPath) => projectPath === normalizedCoveragePath
+    );
+    if (exactMatch) {
+      return exactMatch;
+    }
+
+    if (matches.length === 1) {
+      return matches[0];
+    }
+
+    return pickBestMatch(normalizedCoveragePath, matches);
+  };
+}

package/src/codeCoverage/reportPaths.ts

@@ -0,0 +1,63 @@
+import { normalizePathSeparators, normalizeSourcePath } from './paths.js';
+
+export type TCoverageFormat = 'lcov' | 'cobertura';
+
+/**
+ * Detect coverage format from the report filename only.
+ */
+export function detectFormatFromFilename(filename: string): TCoverageFormat {
+  const lower = normalizePathSeparators(filename).toLowerCase();
+  const base = lower.slice(lower.lastIndexOf('/') + 1);
+
+  if (base.endsWith('.lcov') || base.endsWith('.info') || base.includes('lcov')) {
+    return 'lcov';
+  }
+
+  if (base.endsWith('.xml') || base.includes('cobertura')) {
+    return 'cobertura';
+  }
+
+  throw new Error(
+    `Could not detect coverage format from filename "${filename}". ` +
+      'Use a name like lcov.info, *.lcov, or *cobertura*.xml.'
+  );
+}
+
+/**
+ * Extract source file paths referenced in a coverage report (for EOF map).
+ */
+export function extractCoveredSourcePaths(
+  content: string,
+  format: TCoverageFormat,
+  repositoryRoot: string
+): string[] {
+  if (format === 'cobertura') {
+    return extractCoberturaFilenames(content, repositoryRoot);
+  }
+
+  return extractLcovFilenames(content, repositoryRoot);
+}
+
+function extractLcovFilenames(
+  content: string,
+  repositoryRoot: string
+): string[] {
+  return [...content.matchAll(/^SF:([^\r\n]+)$/gm)]
+    .map((match) => normalizeSourcePath(match[1], repositoryRoot))
+    .filter(Boolean);
+}
+
+function extractCoberturaFilenames(
+  content: string,
+  repositoryRoot: string
+): string[] {
+  const paths: string[] = [];
+  for (const match of content.matchAll(/\bfilename\s*=\s*"([^"]+)"/gi)) {
+    const normalized = normalizeSourcePath(match[1], repositoryRoot);
+    if (normalized) {
+      paths.push(normalized);
+    }
+  }
+
+  return paths;
+}

package/src/codeCoverage/sourceLineFixes.ts

@@ -0,0 +1,73 @@
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+
+// Drop coverage that points past the end of the source file.
+// applied per-extension in their uploader and are not language-agnostic — we only
+export async function loadSourceLineFixes(
+  repositoryRoot: string,
+  sourcePath: string
+): Promise<{ eof: number } | null> {
+  if (!repositoryRoot || !sourcePath) {
+    return null;
+  }
+
+  try {
+    const base = path.resolve(repositoryRoot);
+    const target = path.resolve(base, sourcePath);
+    const relative = path.relative(base, target);
+    if (relative.startsWith('..') || path.isAbsolute(relative)) {
+      return null;
+    }
+
+    // Do not follow symlinks: a tracked link can point at an unbounded
+    // special file (e.g. /dev/zero) and hang or exhaust memory on read.
+    const stats = await fs.lstat(target);
+    if (stats.isSymbolicLink() || !stats.isFile()) {
+      return null;
+    }
+
+    const content = await fs.readFile(target, 'utf8');
+    const lineCount = content.split(/\r?\n/).length;
+    return { eof: lineCount };
+  } catch {
+    return null;
+  }
+}
+
+type TCoverageRecord = {
+  lines: Map<number, unknown>;
+  functions: Map<string, { line: number }>;
+  branches: Map<string, unknown>;
+};
+
+export function applySourceLineFixes(
+  record: TCoverageRecord,
+  lineFixes: { eof: number } | null
+): TCoverageRecord {
+  if (!lineFixes) {
+    return record;
+  }
+
+  const { eof } = lineFixes;
+
+  for (const lineNumber of record.lines.keys()) {
+    if (lineNumber < 1 || lineNumber > eof) {
+      record.lines.delete(lineNumber);
+    }
+  }
+
+  for (const [functionName, meta] of record.functions.entries()) {
+    if (meta.line < 1 || meta.line > eof) {
+      record.functions.delete(functionName);
+    }
+  }
+
+  for (const branchKey of record.branches.keys()) {
+    const lineNumber = Number(branchKey.split('\0')[0]);
+    if (lineNumber < 1 || lineNumber > eof) {
+      record.branches.delete(branchKey);
+    }
+  }
+
+  return record;
+}

package/src/commands/scan.ts

@@ -245,7 +245,7 @@ export const scan = async ({
 const parseCliOptions = (userCliOptions: TScanUserCliOptions) => {
   // Version provided to the API corresponds with the version in package.json
   // of the cli client
-  const apiOptions: TScanApiOptions = { version: '1.0.16' };
+  const apiOptions: TScanApiOptions = { version: '1.0.18' };
   const cliOptions: TScanCliOptions = { pollInterval: 5 };
 
   if (userCliOptions.pullRequestTitle) {

package/src/commands/scanRelease.ts

@@ -14,6 +14,7 @@ import { getApiKey } from '../configuration.js';
 import {
   outputError,
   outputHttpError,
+  outputJson,
   outputLog,
   startSpinner,
 } from '../output.js';
@@ -49,6 +50,7 @@ type TScanArguments = {
 
 type TScanCliOptions = {
   pollInterval: number;
+  json: boolean;
 };
 
 type TScanUserCliOptions = {
@@ -63,6 +65,7 @@ type TScanUserCliOptions = {
   pollInterval?: number;
   baseBranch?: string;
   slaMode?: boolean;
+  json?: boolean;
 };
 
 async function cli(
@@ -83,6 +86,13 @@ async function cli(
   let loader: Ora | null;
   let pollCount: number = 1;
 
+  // when the json option is added, only output the json result.
+  // Disabling console output takes care of the spinners and other extra info
+  const jsonOutput = cliOptions.json;
+  if (jsonOutput) {
+    process.env.QUIET = true;
+  }
+
   // Setup different scan() event handlers
   const onStart = () => {
     loader = startSpinner('Starting Aikido Security release scan');
@@ -107,6 +117,20 @@ async function cli(
   };
 
   const onScanComplete = (pollResult: any) => {
+    if (jsonOutput) {
+      outputJson({
+        gate_passed: pollResult.gate_passed === true,
+        issue_breakdown: pollResult.issue_breakdown,
+      });
+
+      if (pollResult.gate_passed !== true) {
+        // Don't process.exit() here: with piped stdout (CI) the JSON write
+        // may still be queued and a forced exit can truncate it.
+        process.exitCode = 10;
+      }
+      return;
+    }
+
     if (pollResult.gate_passed === true) {
       loader?.succeed('Scan completed, no open issues found');
       if (pollResult.diff_url) {
@@ -245,8 +269,8 @@ export const scan = async ({
 const parseCliOptions = (userCliOptions: TScanUserCliOptions) => {
   // Version provided to the API corresponds with the version in package.json
   // of the cli client
-  const apiOptions: TScanApiOptions = { version: '1.0.16' };
-  const cliOptions: TScanCliOptions = { pollInterval: 10 };
+  const apiOptions: TScanApiOptions = { version: '1.0.18' };
+  const cliOptions: TScanCliOptions = { pollInterval: 10, json: false };
 
   if (userCliOptions.pullRequestTitle) {
     apiOptions.pull_request_metadata = {
@@ -292,6 +316,9 @@ const parseCliOptions = (userCliOptions: TScanUserCliOptions) => {
   } else if (userCliOptions.pollInterval) {
     cliOptions.pollInterval = userCliOptions.pollInterval;
   }
+  if (userCliOptions.json) {
+    cliOptions.json = true;
+  }
 
   return { apiOptions, cliOptions };
 };
@@ -363,6 +390,10 @@ export const cliSetup = (program: Command) =>
       '--sla-mode',
       'Let Aikido only fail only on open issues that have gone out of SLA.'
     )
+    .option(
+      '--json',
+      'Output the scan result as JSON (gate_passed and issue_breakdown)'
+    )
     .description('Run a release scan of an Aikido repo.')
     .action(cli);
 

package/src/commands/uploadCoverage.ts

@@ -0,0 +1,115 @@
+import { Command } from 'commander';
+import { Ora } from 'ora';
+import { uploadCodeCoverage } from '../aikidoApi.js';
+import { collectUploadPayload } from '../codeCoverage/collectUploadPayload.js';
+import { getApiKey } from '../configuration.js';
+import {
+  outputError,
+  outputHttpError,
+  outputLog,
+  startSpinner,
+} from '../output.js';
+
+type TUploadCoverageUserCliOptions = {
+  repoName: string;
+  commitSha: string;
+  branchName: string;
+  filePaths: string[];
+  repositoryId: string | number;
+};
+
+async function cli(options: TUploadCoverageUserCliOptions) {
+  const apiKey = getApiKey();
+
+  if (!apiKey) {
+    outputError('Please set an api key using: aikido-api-client apikey <key>');
+    return;
+    return;
+  }
+
+  const filePaths = normalizeFilePaths(options.filePaths);
+  if (filePaths.length === 0) {
+    outputError(
+      'No code coverage file(s) provided. Specify at least one path with --file-paths.'
+    );
+  }
+
+  let loader: Ora | null = startSpinner(
+    'Collecting coverage files and repository metadata'
+  );
+
+  let payload;
+  try {
+    payload = await collectUploadPayload(filePaths);
+  } catch (error) {
+    loader?.fail();
+    outputError(error instanceof Error ? error.message : String(error));
+    return;
+  }
+
+  loader?.succeed(
+    `Found ${payload.files.length} coverage file(s) (source paths=${payload.repository_source_paths.length}, eof=${Object.keys(payload.eof).length})`
+  );
+
+  for (const file of payload.files) {
+    outputLog(`  ${file.filename} (${file.format})`);
+  }
+
+  loader = startSpinner('Uploading code coverage to Aikido');
+
+  try {
+    await uploadCodeCoverage({
+      repository_id: options.repositoryId,
+      repo_name: options.repoName,
+      commit_sha: options.commitSha,
+      branch_name: options.branchName,
+      repository_source_paths: payload.repository_source_paths,
+      eof: payload.eof,
+      files: payload.files,
+    });
+
+    
+    loader?.succeed('Code coverage upload completed');
+    process.exit(0);
+  } catch (error) {
+    loader?.fail();
+    outputHttpError(error as any);
+    process.exit(1);
+  }
+}
+
+const normalizeFilePaths = (filePaths: string[]): string[] =>
+  filePaths
+    .flatMap((entry) => entry.split(/\n|\s+|,/))
+    .map((filePath) => filePath.trim())
+    .filter(Boolean);
+
+export const cliSetup = (program: Command) =>
+  program
+    .command('upload-coverage')
+    .requiredOption(
+      '-r, --repo-name <reponame>',
+      'Repository name as owner/repo (e.g. org/my-repo)'
+    )
+    .requiredOption(
+      '-c, --commit-sha <commitsha>',
+      'The commit SHA for this CI run'
+    )
+    .requiredOption(
+      '-b, --branch-name <branchname>',
+      'The branch name for this CI run'
+    )
+    .requiredOption(
+      '-f, --file-paths <paths...>',
+      'Path(s) to LCOV or Cobertura coverage report(s). Format is detected from each filename.'
+    )
+    .requiredOption(
+      '-ri, --repository-id <repositoryid>',
+      'The scm repository id'
+    )
+    .description(
+      'Upload LCOV or Cobertura coverage reports to Aikido (with repository_source_paths and EOF metadata).'
+    )
+    .action(cli);
+
+export default { cli, cliSetup };