@vulnix/scan 1.0.0

package/package.json

@@ -0,0 +1,29 @@
+{
+  "name": "@vulnix/scan",
+  "version": "1.0.0",
+  "description": "Vulnix dependency vulnerability scanner CLI — scan lock files in CI/CD pipelines",
+  "type": "module",
+  "bin": {
+    "vulnix-scan": "./scan-ci.js"
+  },
+  "files": [
+    "scan-ci.js"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "license": "MIT",
+  "homepage": "https://vulnix.io",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/pbhasin/vulnix"
+  },
+  "keywords": [
+    "vulnerability",
+    "security",
+    "sast",
+    "dependency-scanning",
+    "ci",
+    "sbom"
+  ]
+}

package/scan-ci.js

@@ -0,0 +1,302 @@
+#!/usr/bin/env node
+/**
+ * VulnScanner CI CLI
+ *
+ * Usage:
+ *   node scan-ci.js <manifest-file> [options]
+ *
+ * Options:
+ *   --fail-on=CRITICAL|HIGH|MEDIUM|LOW   Minimum severity that fails the build (default: HIGH)
+ *   --url=https://...                    Scanner API base URL (or VULNSCANNER_URL env)
+ *   --token=vsk_...                      API token (or VULNSCANNER_TOKEN env)
+ *   --timeout=120                        Seconds to wait for scan completion (default: 120)
+ *   --json                               Print findings as JSON to stdout
+ *   --output=vulnix-findings.json        Write findings JSON to a file (for CI artifacts)
+ *
+ * Exit codes:
+ *   0  No findings above threshold (or findings all dismissed)
+ *   1  Findings found above threshold — block the pipeline
+ *   2  Scan error or timeout
+ *   3  Bad arguments / config
+ */
+
+import { readFileSync, writeFileSync } from 'fs'
+import { basename } from 'path'
+
+// ─── Parse args ─────────────────────────────────────────────────────────────
+
+const args    = process.argv.slice(2)
+const flags   = Object.fromEntries(
+  args.filter(a => a.startsWith('--')).map(a => {
+    const [k, v] = a.slice(2).split('=')
+    return [k, v ?? true]
+  })
+)
+const positional = args.filter(a => !a.startsWith('--'))
+const manifestPath = positional[0]
+
+const API_URL   = flags.url   || process.env.VULNSCANNER_URL
+const API_TOKEN = flags.token || process.env.VULNSCANNER_TOKEN
+const FAIL_ON   = (flags['fail-on'] || process.env.VULNSCANNER_FAIL_ON || 'HIGH').toUpperCase()
+const TIMEOUT     = parseInt(flags.timeout || process.env.VULNSCANNER_TIMEOUT || '120', 10)
+const JSON_OUT    = !!flags.json
+const OUTPUT_FILE = flags.output || process.env.VULNSCANNER_OUTPUT || null
+
+const SEVERITY_RANK = { LOW: 1, MEDIUM: 2, HIGH: 3, CRITICAL: 4 }
+
+function bail(msg, code = 3) {
+  console.error(`\n[vulnscanner] ERROR: ${msg}`)
+  process.exit(code)
+}
+
+if (!manifestPath) bail('Usage: node scan-ci.js <manifest-file> [--fail-on=HIGH] [--url=...] [--token=...]')
+if (!API_URL)      bail('Set VULNSCANNER_URL or pass --url=')
+if (!API_TOKEN)    bail('Set VULNSCANNER_TOKEN or pass --token=')
+if (!SEVERITY_RANK[FAIL_ON]) bail(`Invalid --fail-on value: ${FAIL_ON}. Must be CRITICAL, HIGH, MEDIUM, or LOW`)
+
+// ─── Helpers ────────────────────────────────────────────────────────────────
+
+const base = API_URL.replace(/\/$/, '') + '/api'
+
+async function apiFetch(path, options = {}) {
+  const res = await fetch(`${base}${path}`, {
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      'Authorization': `Bearer ${API_TOKEN}`,
+      ...options.headers,
+    },
+  })
+  const body = await res.json()
+  if (!res.ok) throw new Error(body.error ?? `HTTP ${res.status}`)
+  return body
+}
+
+function sleep(ms) { return new Promise(r => setTimeout(r, ms)) }
+
+function severityColor(s) {
+  if (!s) return '\x1b[90m'
+  return { CRITICAL: '\x1b[31m', HIGH: '\x1b[33m', MEDIUM: '\x1b[36m', LOW: '\x1b[34m' }[s] ?? '\x1b[0m'
+}
+const RESET = '\x1b[0m'
+const BOLD  = '\x1b[1m'
+const DIM   = '\x1b[2m'
+const GREEN = '\x1b[32m'
+const RED   = '\x1b[31m'
+
+function printTable(findings) {
+  if (findings.length === 0) return
+  const cols = [
+    { h: 'Package',   w: 30, f: r => `${r.package_name}@${r.package_version}` },
+    { h: 'Severity',  w: 10, f: r => r.severity ?? '—' },
+    { h: 'ID',        w: 22, f: r => r.vulnerability_id },
+    { h: 'Fix',       w: 15, f: r => r.fixed_in ?? '—' },
+    { h: 'Summary',   w: 50, f: r => (r.description ?? '').slice(0, 48) },
+  ]
+
+  const hr = cols.map(c => '─'.repeat(c.w)).join('─┼─')
+  const header = cols.map(c => c.h.padEnd(c.w)).join(' │ ')
+  console.log(`\n  ${BOLD}${header}${RESET}`)
+  console.log(`  ${hr}`)
+  for (const row of findings) {
+    const sev   = row.severity ?? '—'
+    const color = severityColor(sev)
+    const cells = cols.map((c, i) => {
+      const val = c.f(row).padEnd(c.w).slice(0, c.w)
+      return i === 1 ? `${color}${val}${RESET}` : val
+    })
+    console.log(`  ${cells.join(' │ ')}`)
+  }
+}
+
+// ─── Detect CI repo context ──────────────────────────────────────────────────
+
+function detectRepoContext() {
+  const env = process.env
+
+  // GitHub Actions
+  if (env.GITHUB_ACTIONS) {
+    return {
+      repoName:    env.GITHUB_REPOSITORY,
+      repoUrl:     `${env.GITHUB_SERVER_URL}/${env.GITHUB_REPOSITORY}`,
+      branch:      env.GITHUB_HEAD_REF || env.GITHUB_REF_NAME,
+      commitSha:   env.GITHUB_SHA,
+      pipelineUrl: `${env.GITHUB_SERVER_URL}/${env.GITHUB_REPOSITORY}/actions/runs/${env.GITHUB_RUN_ID}`,
+    }
+  }
+
+  // GitLab CI
+  if (env.GITLAB_CI) {
+    return {
+      repoName:    env.CI_PROJECT_PATH,
+      repoUrl:     env.CI_PROJECT_URL,
+      branch:      env.CI_COMMIT_REF_NAME,
+      commitSha:   env.CI_COMMIT_SHA,
+      pipelineUrl: env.CI_PIPELINE_URL,
+    }
+  }
+
+  // Bitbucket Pipelines
+  if (env.BITBUCKET_BUILD_NUMBER) {
+    return {
+      repoName:    `${env.BITBUCKET_WORKSPACE}/${env.BITBUCKET_REPO_SLUG}`,
+      repoUrl:     `https://bitbucket.org/${env.BITBUCKET_WORKSPACE}/${env.BITBUCKET_REPO_SLUG}`,
+      branch:      env.BITBUCKET_BRANCH,
+      commitSha:   env.BITBUCKET_COMMIT,
+      pipelineUrl: `https://bitbucket.org/${env.BITBUCKET_WORKSPACE}/${env.BITBUCKET_REPO_SLUG}/pipelines/results/${env.BITBUCKET_BUILD_NUMBER}`,
+    }
+  }
+
+  return {}
+}
+
+function extractProjectName(fname, text) {
+  try {
+    if (fname === 'package.json' || fname === 'package-lock.json') {
+      const pkg = JSON.parse(text)
+      if (pkg.name) return pkg.version ? `${pkg.name}@${pkg.version}` : pkg.name
+    }
+    if (fname === 'go.mod') {
+      const m = text.match(/^module\s+(\S+)/m)
+      if (m) return m[1]
+    }
+    if (fname === 'pom.xml') {
+      const a = text.match(/<artifactId>([^<]+)<\/artifactId>/)
+      const v = text.match(/<version>([^<]+)<\/version>/)
+      if (a) return v ? `${a[1]}@${v[1]}` : a[1]
+    }
+    if (fname === 'Cargo.toml') {
+      const n = text.match(/^\s*name\s*=\s*"([^"]+)"/m)
+      const v = text.match(/^\s*version\s*=\s*"([^"]+)"/m)
+      if (n) return v ? `${n[1]}@${v[1]}` : n[1]
+    }
+  } catch {}
+  return null
+}
+
+// ─── Main ────────────────────────────────────────────────────────────────────
+
+let content, filename
+try {
+  content  = readFileSync(manifestPath, 'utf8')
+  filename = basename(manifestPath)
+} catch {
+  bail(`Cannot read file: ${manifestPath}`)
+}
+
+console.log(`\n${BOLD}VulnScanner CI${RESET}`)
+console.log(`${DIM}  API  ${RESET} ${base}`)
+console.log(`${DIM}  File ${RESET} ${filename}`)
+console.log(`${DIM}  Fail ${RESET} severity >= ${FAIL_ON}\n`)
+
+// Submit scan
+const repoContext = detectRepoContext()
+if (!repoContext.repoName) {
+  const projectName = extractProjectName(filename, content)
+  if (projectName) repoContext.repoName = projectName
+}
+if (repoContext.repoName) {
+  console.log(`${DIM}  Repo ${RESET} ${repoContext.repoName}`)
+  console.log(`${DIM}  Branch ${RESET} ${repoContext.branch ?? '—'}`)
+  console.log(`${DIM}  Commit ${RESET} ${repoContext.commitSha?.slice(0, 12) ?? '—'}\n`)
+}
+
+let scanId
+try {
+  console.log('  Submitting scan…')
+  const res = await apiFetch('/scans', {
+    method: 'POST',
+    body: JSON.stringify({ filename, content, ...repoContext }),
+  })
+  scanId = res.scanId
+  console.log(`  Scan ID: ${DIM}${scanId}${RESET}`)
+  console.log(`  Dependencies detected: ${res.dependencyCount} (${res.manifestType})\n`)
+} catch (err) {
+  bail(`Failed to submit scan: ${err.message}`, 2)
+}
+
+// Poll for completion
+const deadline = Date.now() + TIMEOUT * 1000
+let scan = null
+let timedOut = true
+
+process.stdout.write('  Waiting for results ')
+while (Date.now() < deadline) {
+  await sleep(3000)
+  process.stdout.write('.')
+  try {
+    scan = await apiFetch(`/scans/${scanId}`)
+    if (scan.status === 'done' || scan.status === 'error') { timedOut = false; break }
+  } catch { /* retry */ }
+}
+console.log()
+
+if (!scan || scan.status !== 'done') {
+  if (OUTPUT_FILE) {
+    try { writeFileSync(OUTPUT_FILE, JSON.stringify({ scanId, status: scan?.status ?? 'unknown', findings: [], failing: 0 }, null, 2)) }
+    catch {}
+  }
+  bail(timedOut
+    ? `Scan timed out after ${TIMEOUT}s (status: ${scan?.status ?? 'unknown'})`
+    : `Scan failed (status: ${scan.status})`,
+  2)
+}
+
+// ─── Results ─────────────────────────────────────────────────────────────────
+
+const findings = (scan.findings ?? []).filter(f => !f.dismissed)
+const failing  = findings.filter(f => (SEVERITY_RANK[f.severity] ?? 0) >= SEVERITY_RANK[FAIL_ON])
+const passing  = findings.filter(f => (SEVERITY_RANK[f.severity] ?? 0) <  SEVERITY_RANK[FAIL_ON])
+
+const jsonPayload = JSON.stringify({ scanId, status: scan.status, findings, failing: failing.length }, null, 2)
+
+if (OUTPUT_FILE) {
+  try {
+    writeFileSync(OUTPUT_FILE, jsonPayload)
+    console.log(`  ${DIM}Findings written to ${OUTPUT_FILE}${RESET}`)
+  } catch (err) {
+    console.error(`  WARNING: could not write ${OUTPUT_FILE}: ${err.message}`)
+  }
+}
+
+if (JSON_OUT) {
+  console.log(jsonPayload)
+  process.exit(failing.length > 0 ? 1 : 0)
+}
+
+// Severity breakdown across all findings
+const bySeverity = {}
+for (const f of findings) {
+  bySeverity[f.severity ?? 'UNKNOWN'] = (bySeverity[f.severity ?? 'UNKNOWN'] ?? 0) + 1
+}
+
+const summaryParts = ['CRITICAL', 'HIGH', 'MEDIUM', 'LOW']
+  .filter(s => bySeverity[s] > 0)
+  .map(s => `${severityColor(s)}${bySeverity[s]} ${s}${RESET}`)
+
+console.log(`  Total findings:  ${findings.length}${summaryParts.length ? '  (' + summaryParts.join(', ') + ')' : ''}`)
+console.log(`  Fail threshold:  ${FAIL_ON} and above (${failing.length} failing, ${passing.length} informational)`)
+
+if (findings.length > 0) {
+  if (failing.length > 0) {
+    console.log(`\n  ${BOLD}Findings above threshold (${FAIL_ON}+):${RESET}`)
+    printTable(failing)
+  }
+  if (passing.length > 0) {
+    console.log(`\n  ${DIM}${BOLD}Informational findings (below ${FAIL_ON}):${RESET}`)
+    printTable(passing)
+  }
+}
+
+console.log(`\n  ${DIM}View full report: ${base.replace('/api', '')}/scans/${scanId}${RESET}`)
+
+if (failing.length > 0) {
+  const failParts = ['CRITICAL', 'HIGH', 'MEDIUM', 'LOW']
+    .filter(s => (bySeverity[s] ?? 0) > 0 && SEVERITY_RANK[s] >= SEVERITY_RANK[FAIL_ON])
+    .map(s => `${severityColor(s)}${bySeverity[s]} ${s}${RESET}`)
+  console.log(`\n  ${RED}${BOLD}✖ Build failed${RESET} — ${failParts.join(', ')}\n`)
+  process.exit(1)
+} else {
+  console.log(`\n  ${GREEN}${BOLD}✔ All findings below fail threshold (${FAIL_ON})${RESET}\n`)
+  process.exit(0)
+}