@aikidosec/ci-api-client 1.0.18 → 1.0.19

package/README.md

@@ -53,41 +53,30 @@ Options:
   -h, --help                        display help for command
 ```
 
-## Use case: pull request checks & gating
+## Use case: code coverage
 
-The example below shows how to use the 'scan' command. The use case here is to add a red/green check to a pull request based on the difference in files (head vs base commit).
+The example below shows how to use the `upload-coverage` command. The use case here is to upload LCOV or Cobertura coverage reports from your CI pipeline so Aikido can track coverage per commit and branch.
 
 ```sh
-$ aikido-api-client scan <repository_id or repository_name> <base_commit_id> <head_commit_id>
+$ aikido-api-client upload-coverage \
+    --repo-name <owner/repo> \
+    --commit-sha <commit_sha> \
+    --branch-name <branch_name> \
+    --repository-id <repository_id> \
+    --file-paths coverage/lcov.info
 ```
 ```
-Usage: Aikido API Client scan [options] <repository_id> <base_commit_id> <head_commit_id> [branch_name]
-Run a scan of an Aikido repo.
-Arguments:
-  repository_id                          The internal GitHub/Gitlab/Bitbucket/.. repository id you want to scan.
-  base_commit_id                         The base commit of the code you want to scan (e.g. the commit where you branched from for your PR or the
-                                         initial commit of your repo)
-  head_commit_id                         The latest commit you want to include in your scan (e.g. the latest commit id of your pull request)
-  branch_name                            The branch name (default: "main")
+Usage: Aikido API Client upload-coverage [options]
+Upload LCOV or Cobertura coverage reports to Aikido (with repository_source_paths and EOF metadata).
 Options:
-  --pull-request-title <title>           Your pull request title
-  --pull-request-url <url>               Your pull request URL
-  --self-managed-scanners <scanners...>  Set the minimum severity level. Accepted options are: LOW, MEDIUM, HIGH and CRITICAL. (choices: "checkov",
-                                         "json-sbom")
-  --expected-amount-json-sboms <amount>  The expected amount of json sbombs
-  --no-fail-on-dependency-scan           Don't fail when scanning depedencies. Default is to fail on new CVE
-  --fail-on-sast-scan                    Let Aikido fail when new static code analysis issues have been detected
-  --fail-on-iac-scan                     Let Aikido fail when new infrastructure as code issues have been detected
-  --fail-on-secrets-scan                 Let Aikido fail when new exposed secrets have been detected
-  --minimum-severity-level <level>       Set the minimum severity level. Accepted options are: LOW, MEDIUM, HIGH and CRITICAL. (choices: "LOW",
-                                         "MEDIUM", "HIGH", "CRITICAL")
-  --poll-interval [interval]             The poll interval when checking for an updated scan result (preset: 5)
-  --base-branch <branchname>             Optional: base branch for the release gated scan.
-  -h, --help                             display help for command
+  -r, --repo-name <reponame>           Repository name as owner/repo (e.g. org/my-repo)
+  -c, --commit-sha <commitsha>         The commit SHA for this CI run
+  -b, --branch-name <branchname>       The branch name for this CI run
+  -f, --file-paths <paths...>          Path(s) to LCOV or Cobertura coverage report(s). Format is detected from each filename.
+  -ri, --repository-id <repositoryid>  The scm repository id
+  -h, --help                           display help for command
 ```
 
-
-
 ## How it works
 
 The CLI will spawn a cloud-based scan and then report scan progress. It will exit with exitCode `0` if the scan was successfull (`gate_passed: true`). The process will exit with exitCode `10` if the scan was unsuccesfull (`gate_passed: false`). If anything else goes wrong (e.g. API unavailable, scanning unavailable, other unexpected issue) the process will exit with exitCode `1`.

package/lib/aikidoApi.d.ts

@@ -79,4 +79,19 @@ export type TUploadResult = {
     success: number;
 };
 export declare function uploadCustomScanResult(data: TUploadApiOptions): Promise<TUploadResult>;
+export type TUploadCodeCoverageFile = {
+    filename: string;
+    format: 'lcov' | 'cobertura';
+    content: string;
+};
+export type TUploadCodeCoverageOptions = {
+    repository_id: string | number;
+    repo_name: string;
+    commit_sha: string;
+    branch_name: string;
+    repository_source_paths: string[];
+    eof: Record<string, number>;
+    files: TUploadCodeCoverageFile[];
+};
+export declare function uploadCodeCoverage(data: TUploadCodeCoverageOptions): Promise<any>;
 export {};

package/lib/aikidoApi.js

@@ -1,4 +1,5 @@
 import axios from 'axios';
+import { gzipSync } from 'node:zlib';
 import { getApiKey } from './configuration.js';
 import { outputDebug } from './output.js';
 const getApiUrl = () => {
@@ -62,3 +63,38 @@ export async function uploadCustomScanResult(data) {
     outputDebug(resultData);
     return resultData;
 }
+export async function uploadCodeCoverage(data) {
+    const requestUrl = `${getApiUrl()}/api/integrations/continuous_integration/scan/code_coverage`;
+    const requestConfig = {
+        method: 'POST',
+        data: {
+            repository_id: data.repository_id,
+            repo_name: data.repo_name,
+            commit_sha: data.commit_sha,
+            branch_name: data.branch_name,
+            repository_source_paths: data.repository_source_paths,
+            eof: data.eof,
+            files: data.files.map((file) => ({
+                filename: file.filename,
+                format: file.format,
+                content: gzipSync(file.content).toString('base64'),
+            })),
+        },
+        headers: getApiHeaders(),
+    };
+    outputDebug(`API request: ${requestUrl}`);
+    outputDebug({
+        ...requestConfig,
+        data: {
+            ...requestConfig.data,
+            files: requestConfig.data.files.map((file) => ({
+                filename: file.filename,
+                format: file.format,
+                content: `[base64 gzip, ${file.content.length} chars]`,
+            })),
+        },
+    });
+    const resultData = (await axios(requestUrl, requestConfig)).data;
+    outputDebug(resultData);
+    return resultData;
+}

package/lib/codeCoverage/collectUploadPayload.d.ts

@@ -0,0 +1,12 @@
+import { TCoverageFormat } from './reportPaths.js';
+export type TCoverageFilePayload = {
+    filename: string;
+    format: TCoverageFormat;
+    content: string;
+};
+export type TCollectUploadPayloadResult = {
+    repository_source_paths: string[];
+    eof: Record<string, number>;
+    files: TCoverageFilePayload[];
+};
+export declare function collectUploadPayload(filePaths: string[]): Promise<TCollectUploadPayloadResult>;

package/lib/codeCoverage/collectUploadPayload.js

@@ -0,0 +1,54 @@
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import { validateFilePath } from './paths.js';
+import { loadProjectFiles } from './projectFiles.js';
+import { detectFormatFromFilename, extractCoveredSourcePaths, } from './reportPaths.js';
+import { loadSourceLineFixes } from './sourceLineFixes.js';
+export async function collectUploadPayload(filePaths) {
+    if (filePaths.length === 0) {
+        throw new Error('No code coverage file(s) provided. Specify at least one path.');
+    }
+    const project = await loadProjectFiles();
+    if (!project || project.files.length === 0) {
+        throw new Error('No source files found in this repository. ' +
+            'Run this command from a checked-out repository before uploading coverage.');
+    }
+    const repositoryRoot = project.root;
+    const files = [];
+    const coveredPaths = new Set();
+    for (const inputPath of filePaths) {
+        validateFilePath(inputPath);
+        const absolutePath = path.resolve(inputPath);
+        const stats = await fs.lstat(absolutePath);
+        const realPath = await fs.realpath(absolutePath);
+        const relativePath = path.relative(repositoryRoot, realPath);
+        if (stats.isSymbolicLink() ||
+            !stats.isFile() ||
+            relativePath.startsWith('..') ||
+            path.isAbsolute(relativePath)) {
+            throw new Error(`Coverage file must be a regular file inside the repository: ${inputPath}`);
+        }
+        const content = await fs.readFile(realPath, 'utf8');
+        const format = detectFormatFromFilename(inputPath);
+        for (const sourcePath of extractCoveredSourcePaths(content, format, repositoryRoot)) {
+            coveredPaths.add(sourcePath);
+        }
+        files.push({
+            filename: path.posix.basename(inputPath.replace(/\\/g, '/')),
+            format,
+            content,
+        });
+    }
+    const eof = {};
+    for (const sourcePath of coveredPaths) {
+        const fixes = await loadSourceLineFixes(repositoryRoot, sourcePath);
+        if (fixes?.eof != null) {
+            eof[sourcePath] = fixes.eof;
+        }
+    }
+    return {
+        repository_source_paths: project.files,
+        eof,
+        files,
+    };
+}

package/lib/codeCoverage/paths.d.ts

@@ -0,0 +1,4 @@
+export declare function validateFilePath(filePath: string): void;
+export declare function isAbsoluteSourcePath(sourcePath: string): boolean;
+export declare function normalizePathSeparators(sourcePath: string): string;
+export declare function normalizeSourcePath(sourcePath: string, repositoryRoot: string): string;

package/lib/codeCoverage/paths.js

@@ -0,0 +1,38 @@
+import path from 'node:path';
+export function validateFilePath(filePath) {
+    if (filePath.includes('..') || isAbsoluteSourcePath(filePath)) {
+        throw new Error('Invalid file path: absolute paths and ".." segments are not allowed');
+    }
+}
+export function isAbsoluteSourcePath(sourcePath) {
+    const trimmedPath = sourcePath.trim();
+    const pathInput = normalizePathSeparators(trimmedPath);
+    const windowsPath = /^[a-zA-Z]:[\\/]/.test(trimmedPath) ||
+        trimmedPath.startsWith('\\\\') ||
+        trimmedPath.startsWith('//');
+    const pathApi = windowsPath ? path.win32 : path.posix;
+    return pathApi.isAbsolute(pathInput);
+}
+export function normalizePathSeparators(sourcePath) {
+    return sourcePath.trim().replace(/\\/g, '/').replace(/^\.\//, '');
+}
+export function normalizeSourcePath(sourcePath, repositoryRoot) {
+    const trimmedPath = sourcePath.trim();
+    const pathInput = normalizePathSeparators(trimmedPath);
+    const windowsPath = /^[a-zA-Z]:[\\/]/.test(trimmedPath) ||
+        trimmedPath.startsWith('\\\\') ||
+        trimmedPath.startsWith('//');
+    const pathApi = windowsPath ? path.win32 : path.posix;
+    const absolutePath = pathApi.isAbsolute(pathInput);
+    const normalizedPath = absolutePath
+        ? pathApi.relative(repositoryRoot, pathInput)
+        : pathInput;
+    if (absolutePath &&
+        (!normalizedPath ||
+            normalizedPath === '..' ||
+            normalizedPath.startsWith(`..${pathApi.sep}`) ||
+            pathApi.isAbsolute(normalizedPath))) {
+        throw new Error(`Invalid source path outside the repository: ${sourcePath}`);
+    }
+    return normalizePathSeparators(normalizedPath);
+}

package/lib/codeCoverage/projectFiles.d.ts

@@ -0,0 +1,7 @@
+export type TProjectFiles = {
+    root: string;
+    files: string[];
+};
+export declare function loadProjectFiles(): Promise<TProjectFiles | null>;
+export declare function pathStem(sourcePath: string): string;
+export declare function createPathResolver(projectFiles: string[]): (coveragePath: string) => string | null;

package/lib/codeCoverage/projectFiles.js

@@ -0,0 +1,233 @@
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import ignore from 'ignore';
+const HARDCODED_IGNORES = [
+    '.git/',
+    'node_modules/',
+    'vendor/',
+    'coverage/',
+    'dist/',
+    'build/',
+    '.venv/',
+    'venv/',
+    '__pycache__/',
+    '.eggs/',
+    '*.egg-info/',
+    '.tox/',
+    '.mypy_cache/',
+    '.pytest_cache/',
+    '.next/',
+    '.nuxt/',
+    '.turbo/',
+    '.cache/',
+    'bower_components/',
+    '*.png',
+    '*.gif',
+    '*.jpg',
+    '*.jpeg',
+    '*.webp',
+    '*.ico',
+    '*.woff',
+    '*.woff2',
+    '*.ttf',
+    '*.eot',
+    '*.mp4',
+    '*.mp3',
+    '.nyc_output/',
+    'jspm_packages/',
+    '.yarn/cache/',
+    '.pnpm-store/',
+    'target/',
+    'Pods/',
+];
+export async function loadProjectFiles() {
+    const root = await findGitRoot(process.cwd());
+    const ignoreManager = ignore().add(HARDCODED_IGNORES);
+    try {
+        ignoreManager.add(await fs.readFile(path.join(root, '.gitignore'), 'utf8'));
+    }
+    catch {
+    }
+    const files = [];
+    await collectFiles(root, '', [{ base: '', ig: ignoreManager }], files);
+    const projectFiles = files.filter(isLikelySourceFile);
+    return projectFiles.length === 0 ? null : { root, files: projectFiles };
+}
+async function findGitRoot(startDir) {
+    const start = path.resolve(startDir);
+    let dir = start;
+    while (path.dirname(dir) !== dir) {
+        try {
+            await fs.access(path.join(dir, '.git'));
+            return dir;
+        }
+        catch {
+            dir = path.dirname(dir);
+        }
+    }
+    try {
+        await fs.access(path.join(dir, '.git'));
+        return dir;
+    }
+    catch {
+        return start;
+    }
+}
+function isLikelySourceFile(relativePath) {
+    const base = relativePath.slice(relativePath.lastIndexOf('/') + 1);
+    const lower = base.toLowerCase();
+    if (lower === '.gitignore' ||
+        lower.endsWith('.lcov') ||
+        lower === 'lcov.info' ||
+        (lower.endsWith('.info') && lower.includes('lcov')) ||
+        lower === 'coverage-final.json' ||
+        lower === 'clover.xml' ||
+        lower === 'cobertura.xml' ||
+        (lower.endsWith('.xml') && lower.includes('cobertura'))) {
+        return false;
+    }
+    return true;
+}
+async function collectFiles(absoluteDir, relativeDir, ignoreStack, files) {
+    let stack = ignoreStack;
+    if (relativeDir) {
+        try {
+            const nested = ignore().add(await fs.readFile(path.join(absoluteDir, '.gitignore'), 'utf8'));
+            stack = [...ignoreStack, { base: relativeDir, ig: nested }];
+        }
+        catch {
+        }
+    }
+    let entries;
+    try {
+        entries = await fs.readdir(absoluteDir, { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    for (const entry of entries) {
+        const relativePath = relativeDir
+            ? `${relativeDir}/${entry.name}`
+            : entry.name;
+        if (isIgnored(relativePath, entry.isDirectory(), stack)) {
+            continue;
+        }
+        if (entry.isDirectory()) {
+            await collectFiles(path.join(absoluteDir, entry.name), relativePath, stack, files);
+        }
+        else if (entry.isFile() || entry.isSymbolicLink()) {
+            files.push(relativePath);
+        }
+    }
+}
+function isIgnored(relativePath, isDirectory, stack) {
+    let ignored = false;
+    for (const { base, ig } of stack) {
+        const testPath = base ? relativePath.slice(base.length + 1) : relativePath;
+        if (!testPath) {
+            continue;
+        }
+        const result = ignoreDecision(ig, testPath, isDirectory);
+        if (result.ignored) {
+            ignored = true;
+        }
+        else if (result.unignored) {
+            ignored = false;
+        }
+    }
+    return ignored;
+}
+function ignoreDecision(ig, testPath, isDirectory) {
+    const result = ig.test(testPath);
+    if (isDirectory) {
+        const directoryResult = ig.test(`${testPath}/`);
+        if (directoryResult.ignored || directoryResult.unignored) {
+            return directoryResult;
+        }
+    }
+    return result;
+}
+export function pathStem(sourcePath) {
+    const lastSlashIndex = sourcePath.lastIndexOf('/');
+    const lastDotIndex = sourcePath.lastIndexOf('.');
+    if (lastDotIndex > lastSlashIndex) {
+        return sourcePath.slice(0, lastDotIndex);
+    }
+    return sourcePath;
+}
+function normalizePath(filePath) {
+    return filePath.trim().replace(/\\/g, '/').replace(/^\.\//, '');
+}
+function isSamePathOrSuffix(fullPath, possibleSuffix) {
+    const normalizedFullPath = fullPath.toLowerCase();
+    const suffix = possibleSuffix.toLowerCase();
+    return (normalizedFullPath === suffix ||
+        normalizedFullPath.endsWith(`/${suffix}`));
+}
+function countSharedTrailingSegments(leftPath, rightPath) {
+    const leftSegments = leftPath.toLowerCase().split('/');
+    const rightSegments = rightPath.toLowerCase().split('/');
+    const maxShared = Math.min(leftSegments.length, rightSegments.length);
+    let sharedCount = 0;
+    while (sharedCount < maxShared &&
+        leftSegments[leftSegments.length - 1 - sharedCount] ===
+            rightSegments[rightSegments.length - 1 - sharedCount]) {
+        sharedCount++;
+    }
+    return sharedCount;
+}
+function pickBestMatch(coveragePath, candidates) {
+    let best = null;
+    let bestShared = -1;
+    let bestLength = Infinity;
+    let ambiguous = false;
+    for (const candidate of candidates) {
+        const shared = countSharedTrailingSegments(coveragePath, candidate);
+        if (shared > bestShared ||
+            (shared === bestShared && candidate.length < bestLength)) {
+            best = candidate;
+            bestShared = shared;
+            bestLength = candidate.length;
+            ambiguous = false;
+        }
+        else if (shared === bestShared && candidate.length === bestLength) {
+            ambiguous = true;
+        }
+    }
+    return ambiguous ? null : best;
+}
+export function createPathResolver(projectFiles) {
+    const byBasename = new Map();
+    for (const projectPath of projectFiles) {
+        const key = projectPath
+            .slice(projectPath.lastIndexOf('/') + 1)
+            .toLowerCase();
+        const entries = byBasename.get(key);
+        if (entries) {
+            entries.push(projectPath);
+        }
+        else {
+            byBasename.set(key, [projectPath]);
+        }
+    }
+    return (coveragePath) => {
+        const normalizedCoveragePath = normalizePath(coveragePath);
+        const key = normalizedCoveragePath
+            .slice(normalizedCoveragePath.lastIndexOf('/') + 1)
+            .toLowerCase();
+        const candidates = byBasename.get(key) ?? [];
+        const matches = candidates.filter((projectPath) => isSamePathOrSuffix(projectPath, normalizedCoveragePath) ||
+            isSamePathOrSuffix(normalizedCoveragePath, projectPath));
+        if (matches.length === 0) {
+            return null;
+        }
+        const exactMatch = matches.find((projectPath) => projectPath === normalizedCoveragePath);
+        if (exactMatch) {
+            return exactMatch;
+        }
+        if (matches.length === 1) {
+            return matches[0];
+        }
+        return pickBestMatch(normalizedCoveragePath, matches);
+    };
+}

package/lib/codeCoverage/reportPaths.d.ts

@@ -0,0 +1,3 @@
+export type TCoverageFormat = 'lcov' | 'cobertura';
+export declare function detectFormatFromFilename(filename: string): TCoverageFormat;
+export declare function extractCoveredSourcePaths(content: string, format: TCoverageFormat, repositoryRoot: string): string[];

package/lib/codeCoverage/reportPaths.js

@@ -0,0 +1,34 @@
+import { normalizePathSeparators, normalizeSourcePath } from './paths.js';
+export function detectFormatFromFilename(filename) {
+    const lower = normalizePathSeparators(filename).toLowerCase();
+    const base = lower.slice(lower.lastIndexOf('/') + 1);
+    if (base.endsWith('.lcov') || base.endsWith('.info') || base.includes('lcov')) {
+        return 'lcov';
+    }
+    if (base.endsWith('.xml') || base.includes('cobertura')) {
+        return 'cobertura';
+    }
+    throw new Error(`Could not detect coverage format from filename "${filename}". ` +
+        'Use a name like lcov.info, *.lcov, or *cobertura*.xml.');
+}
+export function extractCoveredSourcePaths(content, format, repositoryRoot) {
+    if (format === 'cobertura') {
+        return extractCoberturaFilenames(content, repositoryRoot);
+    }
+    return extractLcovFilenames(content, repositoryRoot);
+}
+function extractLcovFilenames(content, repositoryRoot) {
+    return [...content.matchAll(/^SF:([^\r\n]+)$/gm)]
+        .map((match) => normalizeSourcePath(match[1], repositoryRoot))
+        .filter(Boolean);
+}
+function extractCoberturaFilenames(content, repositoryRoot) {
+    const paths = [];
+    for (const match of content.matchAll(/\bfilename\s*=\s*"([^"]+)"/gi)) {
+        const normalized = normalizeSourcePath(match[1], repositoryRoot);
+        if (normalized) {
+            paths.push(normalized);
+        }
+    }
+    return paths;
+}

package/lib/codeCoverage/sourceLineFixes.d.ts

@@ -0,0 +1,14 @@
+export declare function loadSourceLineFixes(repositoryRoot: string, sourcePath: string): Promise<{
+    eof: number;
+} | null>;
+type TCoverageRecord = {
+    lines: Map<number, unknown>;
+    functions: Map<string, {
+        line: number;
+    }>;
+    branches: Map<string, unknown>;
+};
+export declare function applySourceLineFixes(record: TCoverageRecord, lineFixes: {
+    eof: number;
+} | null): TCoverageRecord;
+export {};

package/lib/codeCoverage/sourceLineFixes.js

@@ -0,0 +1,48 @@
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+export async function loadSourceLineFixes(repositoryRoot, sourcePath) {
+    if (!repositoryRoot || !sourcePath) {
+        return null;
+    }
+    try {
+        const base = path.resolve(repositoryRoot);
+        const target = path.resolve(base, sourcePath);
+        const relative = path.relative(base, target);
+        if (relative.startsWith('..') || path.isAbsolute(relative)) {
+            return null;
+        }
+        const stats = await fs.lstat(target);
+        if (stats.isSymbolicLink() || !stats.isFile()) {
+            return null;
+        }
+        const content = await fs.readFile(target, 'utf8');
+        const lineCount = content.split(/\r?\n/).length;
+        return { eof: lineCount };
+    }
+    catch {
+        return null;
+    }
+}
+export function applySourceLineFixes(record, lineFixes) {
+    if (!lineFixes) {
+        return record;
+    }
+    const { eof } = lineFixes;
+    for (const lineNumber of record.lines.keys()) {
+        if (lineNumber < 1 || lineNumber > eof) {
+            record.lines.delete(lineNumber);
+        }
+    }
+    for (const [functionName, meta] of record.functions.entries()) {
+        if (meta.line < 1 || meta.line > eof) {
+            record.functions.delete(functionName);
+        }
+    }
+    for (const branchKey of record.branches.keys()) {
+        const lineNumber = Number(branchKey.split('\0')[0]);
+        if (lineNumber < 1 || lineNumber > eof) {
+            record.branches.delete(branchKey);
+        }
+    }
+    return record;
+}

package/lib/commands/uploadCoverage.d.ts

@@ -0,0 +1,15 @@
+import { Command } from 'commander';
+type TUploadCoverageUserCliOptions = {
+    repoName: string;
+    commitSha: string;
+    branchName: string;
+    filePaths: string[];
+    repositoryId: string | number;
+};
+declare function cli(options: TUploadCoverageUserCliOptions): Promise<void>;
+export declare const cliSetup: (program: Command) => Command;
+declare const _default: {
+    cli: typeof cli;
+    cliSetup: (program: Command) => Command;
+};
+export default _default;

package/lib/commands/uploadCoverage.js

@@ -0,0 +1,63 @@
+import { uploadCodeCoverage } from '../aikidoApi.js';
+import { collectUploadPayload } from '../codeCoverage/collectUploadPayload.js';
+import { getApiKey } from '../configuration.js';
+import { outputError, outputHttpError, outputLog, startSpinner, } from '../output.js';
+async function cli(options) {
+    const apiKey = getApiKey();
+    if (!apiKey) {
+        outputError('Please set an api key using: aikido-api-client apikey <key>');
+        return;
+        return;
+    }
+    const filePaths = normalizeFilePaths(options.filePaths);
+    if (filePaths.length === 0) {
+        outputError('No code coverage file(s) provided. Specify at least one path with --file-paths.');
+    }
+    let loader = startSpinner('Collecting coverage files and repository metadata');
+    let payload;
+    try {
+        payload = await collectUploadPayload(filePaths);
+    }
+    catch (error) {
+        loader?.fail();
+        outputError(error instanceof Error ? error.message : String(error));
+        return;
+    }
+    loader?.succeed(`Found ${payload.files.length} coverage file(s) (source paths=${payload.repository_source_paths.length}, eof=${Object.keys(payload.eof).length})`);
+    for (const file of payload.files) {
+        outputLog(`  ${file.filename} (${file.format})`);
+    }
+    loader = startSpinner('Uploading code coverage to Aikido');
+    try {
+        await uploadCodeCoverage({
+            repository_id: options.repositoryId,
+            repo_name: options.repoName,
+            commit_sha: options.commitSha,
+            branch_name: options.branchName,
+            repository_source_paths: payload.repository_source_paths,
+            eof: payload.eof,
+            files: payload.files,
+        });
+        loader?.succeed('Code coverage upload completed');
+        process.exit(0);
+    }
+    catch (error) {
+        loader?.fail();
+        outputHttpError(error);
+        process.exit(1);
+    }
+}
+const normalizeFilePaths = (filePaths) => filePaths
+    .flatMap((entry) => entry.split(/\n|\s+|,/))
+    .map((filePath) => filePath.trim())
+    .filter(Boolean);
+export const cliSetup = (program) => program
+    .command('upload-coverage')
+    .requiredOption('-r, --repo-name <reponame>', 'Repository name as owner/repo (e.g. org/my-repo)')
+    .requiredOption('-c, --commit-sha <commitsha>', 'The commit SHA for this CI run')
+    .requiredOption('-b, --branch-name <branchname>', 'The branch name for this CI run')
+    .requiredOption('-f, --file-paths <paths...>', 'Path(s) to LCOV or Cobertura coverage report(s). Format is detected from each filename.')
+    .requiredOption('-ri, --repository-id <repositoryid>', 'The scm repository id')
+    .description('Upload LCOV or Cobertura coverage reports to Aikido (with repository_source_paths and EOF metadata).')
+    .action(cli);
+export default { cli, cliSetup };