@scalequality/check 0.2.1 → 0.3.1

package/bin/check.mjs

@@ -26,6 +26,9 @@ Options:
   --token <t>      SQ token (or env SQ_TOKEN)
   --project <id>   ScaleQuality project id (or env SQ_PROJECT)
   --host <url>     API host (default https://app.scalequality.io, or env SQ_HOST)
+  --image <ref>    Also scan the container image this job just built, e.g.
+                   myapp:\${{ github.sha }}. Needs trivy on PATH; skipped with a
+                   note if it is missing, never fails the build for it.
   --timeout <s>    Max seconds to wait for the measurement (default 600)
   --json           Print the raw result as JSON
   -h, --help       Show this help
@@ -38,6 +41,7 @@ const token = flag("--token") || process.env.SQ_TOKEN
 const project = flag("--project") || process.env.SQ_PROJECT
 const host = (flag("--host") || process.env.SQ_HOST || "https://app.scalequality.io").replace(/\/+$/, "")
 const jsonOut = has("--json")
+const image = flag("--image") || process.env.SQ_IMAGE
 const timeoutMs = Math.max(30, Number(flag("--timeout") || 600)) * 1000
 
 const base = `${host}/api/insights/continuous`
@@ -49,6 +53,76 @@ if (!token || !project) {
   fail("--token and --project are required (or env SQ_TOKEN / SQ_PROJECT). See --help.")
 }
 
+/**
+ * Scans the image THIS job just built. Container CVEs cannot be measured from a
+ * repository: they live in the built image, and the only place that image exists
+ * is right here. So the scan runs in the customer's own pipeline and only the
+ * report travels.
+ *
+ * Two rules, both about not lying:
+ *  - no `--image`, no scan, and nothing is reported as clean;
+ *  - `--image` without trivy prints how to add it and CONTINUES. The container
+ *    dimension comes back not-measured, but the maturity gate still runs. A
+ *    missing scanner is not a reason to break someone's build.
+ */
+function scanImage() {
+  if (!image) return null
+  const probe = spawnSync("trivy", ["--version"], { encoding: "utf8" })
+  if (probe.error || probe.status !== 0) {
+    log("ScaleQuality: --image was given but trivy is not on PATH, so the container scan was skipped.")
+    log("ScaleQuality: add it before this step, e.g. `- uses: aquasecurity/setup-trivy@v0.2.0`.")
+    return null
+  }
+  const r = spawnSync("trivy", [
+    "image", "--format", "json", "--quiet",
+    "--scanners", "vuln",
+    // LOW is dropped for the same reason it is dropped everywhere else here: a
+    // noisy finding costs more credibility than a missed one.
+    "--severity", "CRITICAL,HIGH,MEDIUM",
+    image,
+  ], { encoding: "utf8", maxBuffer: 128 * 1024 * 1024 })
+  if (r.error || r.status !== 0 || !r.stdout) {
+    log(`ScaleQuality: could not scan ${image}, continuing without the container scan.`)
+    return null
+  }
+  return slimReport(r.stdout, image)
+}
+
+/**
+ * trivy ships the full advisory text and reference list for every finding: 933KB
+ * for a single base image, of which we read a handful of fields. Sending the rest
+ * costs the customer's pipeline upload time for nothing. Same shape, fewer bytes,
+ * so the server parser stays untouched.
+ */
+function slimReport(stdout, ref) {
+  let d
+  try { d = JSON.parse(stdout) } catch { return null }
+  let n = 0
+  const out = {
+    ArtifactName: d.ArtifactName || ref,
+    Metadata: { OS: d.Metadata?.OS ? { Family: d.Metadata.OS.Family, Name: d.Metadata.OS.Name, EOSL: d.Metadata.OS.EOSL } : undefined },
+    Results: (d.Results || []).map((res) => ({
+      Target: res.Target,
+      Class: res.Class,
+      Type: res.Type,
+      Vulnerabilities: (res.Vulnerabilities || []).map((v) => {
+        n++
+        return {
+          VulnerabilityID: v.VulnerabilityID,
+          PkgName: v.PkgName,
+          InstalledVersion: v.InstalledVersion,
+          FixedVersion: v.FixedVersion,
+          Severity: v.Severity,
+          Title: typeof v.Title === "string" ? v.Title.slice(0, 300) : undefined,
+        }
+      }),
+    })),
+  }
+  const json = JSON.stringify(out)
+  log(`ScaleQuality: scanned ${out.ArtifactName} — ${n} vulnerabilities`)
+  return json
+}
+
 async function main() {
   const auth = { Authorization: `Bearer ${token}` }
 
@@ -78,6 +152,8 @@ async function main() {
   const form = new FormData()
   form.append("project", project)
   form.append("file", new Blob([buf]), "checkout.tar.gz")
+  const containerReport = scanImage()
+  if (containerReport) form.append("containerReport", containerReport)
   const r = await fetch(`${base}/report/upload`, {
     method: "POST",
     headers: auth,
@@ -98,7 +174,14 @@ async function main() {
   // 5s quantizes every verdict to a 5s boundary: an analysis that finishes in 7s is
   // only reported at 10s, and the pipeline pays 3s of pure waiting. Start tight and
   // back off, so a fast repo answers fast and a slow one still polls cheaply.
-  const POLL_MS = [1500, 1500, 2000, 2000, 3000]
+  //
+  // The ladder is DENSE from 4s to 9s because that is where analyses actually land.
+  // Measured 2026-08-09: the engine finishes in ~5.3s (semgrep is the slowest stage),
+  // and the previous ladder's 5s->7s gap meant three consecutive gate runs all
+  // reported 7.1-7.3s. Two full seconds of the number a customer sees, and of the
+  // number we quote against Sonar, were the client sleeping. Extra polls are cheap:
+  // they are small status reads, and being wrong about our own headline number is not.
+  const POLL_MS = [1200, 1200, 900, 700, 700, 700, 700, 700, 1000, 1500, 2000, 3000]
   const deadline = Date.now() + timeoutMs
   let last
   let poll = 0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scalequality/check",
-  "version": "0.2.1",
+  "version": "0.3.1",
   "description": "ScaleQuality continuous code-maturity check for CI. Re-measures your repo on every build and fails the pipeline below your maturity line.",
   "type": "module",
   "bin": {