cloudburn 0.10.1 → 0.11.1

package/README.md

@@ -43,6 +43,14 @@ If you want to inspect the starter template without writing a file:
 cloudburn config --print-template
 ```
 
+CloudBurn does not implicitly trust repository config in CI. Pass the exact file explicitly when you want CI to use
+its rule selection, output defaults, or severity gate:
+
+```bash
+cloudburn scan ./iac --config .cloudburn.yml
+cloudburn discover --config .cloudburn.yml
+```
+
 ### Scan
 
 Use `scan` to check Terraform and CloudFormation before you deploy.
@@ -51,9 +59,32 @@ Use `scan` to check Terraform and CloudFormation before you deploy.
 cloudburn scan ./main.tf
 cloudburn scan ./template.yaml
 cloudburn scan ./iac --exit-code
+cloudburn scan ./iac --fail-on high
 cloudburn --format json scan ./iac
 ```
 
+`--fail-on high|medium|low` exits with code 1 when an active finding meets or exceeds the selected severity. The same
+threshold can be configured as `iac.fail-on`. Plain `--exit-code` continues to gate on any active finding.
+In CI, configured thresholds apply only when the config is passed with `--config` as shown above.
+
+Terraform and CloudFormation YAML support resource-local exceptions. Put one of these comments immediately above or
+inside the resource; text after the directive is retained as an optional reason:
+
+```hcl
+# cloudburn-ignore CLDBRN-AWS-EBS-1 migration scheduled
+resource "aws_ebs_volume" "legacy" {
+  type = "gp2"
+}
+
+# cloudburn-ignore-all approved temporary exception
+resource "aws_ebs_volume" "temporary" {
+  type = "gp2"
+}
+```
+
+Suppressed findings remain available in JSON output under `suppressed`, are counted in table output, and never fail CI
+gates. CloudFormation JSON does not support comments and therefore cannot contain inline suppressions.
+
 ### Discover
 
 Use `discover` to run the same rules against live AWS resources.
@@ -69,11 +100,14 @@ cloudburn discover --region eu-central-1
 cloudburn discover --config .cloudburn.yml --enabled-rules CLDBRN-AWS-EBS-1
 cloudburn discover --enabled-rules CLDBRN-AWS-TAGGING-1
 cloudburn discover --service ec2,s3
+cloudburn discover --fail-on high
 cloudburn --debug discover --region eu-central-1
 cloudburn rules list
-cloudburn rules list --service ec2 --source discovery
+cloudburn rules list --service ec2 --source discovery --severity high
 ```
 
+The discovery config equivalent is `discovery.fail-on`.
+
 The CLI targets one region per run. Multi-region discovery remains available through the SDK and still needs an AWS Resource Explorer aggregator plus an unfiltered default view in the aggregator region.
 `CLDBRN-AWS-TAGGING-1` is opt-in and requires an accessible aggregator; a local-only setup cannot run account-wide tagging discovery.
 Use `--debug` to print SDK and provider execution tracing to `stderr` without changing the normal `stdout` format.

package/dist/cli.js

@@ -531,13 +531,13 @@ var flattenScanResult = (result) => result.providers.flatMap(
       provider: providerGroup.provider,
       ruleId: ruleGroup.ruleId,
       service: ruleGroup.service,
+      severity: ruleGroup.severity,
       source: ruleGroup.source,
       message: ruleGroup.message,
       finding
     }))
   )
 );
-var countScanResultFindings = (result) => flattenScanResult(result).length;
 var getScanDiagnostics = (result) => result.diagnostics ?? [];
 
 // src/formatters/output.ts
@@ -548,6 +548,7 @@ var supportedOutputFormats = ["json", "table"];
 var scanColumns = [
   { key: "provider", header: "Provider" },
   { key: "ruleId", header: "RuleId" },
+  { key: "severity", header: "Severity" },
   { key: "source", header: "Source" },
   { key: "service", header: "Service" },
   { key: "resourceId", header: "ResourceId" },
@@ -571,6 +572,7 @@ var ruleListColumns = [
   { key: "ruleId", header: "RuleId" },
   { key: "provider", header: "Provider" },
   { key: "service", header: "Service" },
+  { key: "severity", header: "Severity" },
   { key: "supports", header: "Supports" },
   { key: "name", header: "Name" },
   { key: "description", header: "Description" }
@@ -649,20 +651,26 @@ ${regionsTable}`;
     case "scan-result": {
       const findingRows = projectFindingRows(response.result);
       const diagnosticRows = projectDiagnosticRows(response.result);
+      const suppressedCount = response.result.suppressed?.length ?? 0;
+      const withSuppressedCount = (content) => suppressedCount > 0 ? `${content}
+
+Suppressed: ${suppressedCount}` : content;
       if (findingRows.length === 0 && diagnosticRows.length === 0) {
-        return "No findings.";
+        return withSuppressedCount(suppressedCount > 0 ? "No active findings." : "No findings.");
       }
       if (findingRows.length === 0) {
-        return `Diagnostics
-${renderAsciiTable(diagnosticRows, diagnosticColumns)}`;
+        return withSuppressedCount(`Diagnostics
+${renderAsciiTable(diagnosticRows, diagnosticColumns)}`);
       }
       if (diagnosticRows.length === 0) {
-        return renderAsciiTable(findingRows, scanColumns);
+        return withSuppressedCount(renderAsciiTable(findingRows, scanColumns));
       }
-      return `${renderAsciiTable(findingRows, scanColumns)}
+      return withSuppressedCount(
+        `${renderAsciiTable(findingRows, scanColumns)}
 
 Diagnostics
-${renderAsciiTable(diagnosticRows, diagnosticColumns)}`;
+${renderAsciiTable(diagnosticRows, diagnosticColumns)}`
+      );
     }
     case "status":
       return renderAsciiTable(
@@ -679,7 +687,7 @@ ${renderAsciiTable(diagnosticRows, diagnosticColumns)}`;
       );
   }
 };
-var projectFindingRows = (result) => flattenScanResult(result).map(({ finding, message, provider, ruleId, service, source }) => ({
+var projectFindingRows = (result) => flattenScanResult(result).map(({ finding, message, provider, ruleId, service, severity, source }) => ({
   accountId: finding.accountId ?? "",
   message,
   path: finding.location?.path ?? "",
@@ -688,6 +696,7 @@ var projectFindingRows = (result) => flattenScanResult(result).map(({ finding, m
   resourceId: finding.resourceId,
   ruleId,
   service,
+  severity,
   source,
   column: finding.location?.column ?? "",
   line: finding.location?.line ?? ""
@@ -718,6 +727,7 @@ var renderRuleTable = (rules, emptyMessage) => {
       provider: rule.provider,
       ruleId: rule.id,
       service: rule.service,
+      severity: rule.severity,
       supports: rule.supports
     })),
     ruleListColumns
@@ -857,6 +867,7 @@ var starterConfig = `# Static IaC scan configuration.
 # disabled-rules removes specific rule IDs from the selected set.
 # services restricts scans to rules for the listed services.
 # format sets the default output format when --format is not passed.
+# fail-on gates CI on findings at or above high, medium, or low severity.
 iac:
   enabled-rules:
     - CLDBRN-AWS-EBS-1
@@ -866,6 +877,7 @@ iac:
     - ebs
     - ec2
   format: table
+  # fail-on: high
 
 # Live AWS discovery configuration.
 # Use the same rule controls here to tune discover runs separately from IaC scans.
@@ -878,6 +890,7 @@ discovery:
     - ebs
     - s3
   format: json
+  # fail-on: high
 `;
 var resolveExplicitOutputFormat = (command) => {
   const options = typeof command.optsWithGlobals === "function" ? command.optsWithGlobals() : command.opts();
@@ -1063,6 +1076,15 @@ var resolveCliDebugLogger = (command) => {
   };
 };
 
+// src/policy.ts
+import { evaluateScanPolicy } from "@cloudburn/sdk";
+var hasPolicyViolation = (result, options) => {
+  if (options.failOn !== void 0) {
+    return evaluateScanPolicy(result, options.failOn).violated;
+  }
+  return options.exitCode === true ? evaluateScanPolicy(result).violated : result.policy?.violated ?? false;
+};
+
 // src/progress.ts
 var resolveCliDiscoveryProgressLogger = (command) => {
   if (isDebugEnabled(command) || process.stderr.isTTY !== true) {
@@ -1078,7 +1100,7 @@ var resolveCliDiscoveryProgressLogger = (command) => {
 };
 
 // src/commands/config-options.ts
-import { builtInRuleMetadata } from "@cloudburn/sdk";
+import { builtInRuleMetadata, SEVERITIES } from "@cloudburn/sdk";
 import { InvalidArgumentError as InvalidArgumentError2 } from "commander";
 var parseCommaSeparatedList = (value, itemLabel) => {
   const items = value.split(",").map((item) => item.trim()).filter((item) => item.length > 0);
@@ -1087,6 +1109,13 @@ var parseCommaSeparatedList = (value, itemLabel) => {
   }
   return items;
 };
+var parseSeverity = (value) => {
+  const severity = value.toLowerCase();
+  if (!SEVERITIES.includes(severity)) {
+    throw new InvalidArgumentError2(`Unknown severity "${value}". Allowed severities: ${SEVERITIES.join(", ")}.`);
+  }
+  return severity;
+};
 var parseRuleIdList = (value) => {
   return parseCommaSeparatedList(value, "rule ID");
 };
@@ -1216,7 +1245,7 @@ var registerDiscoverCommand = (program) => {
       "--region <region>",
       "AWS region to discover. Defaults to the current AWS region from AWS_REGION when omitted.",
       parseAwsRegion
-    ).option("--config <path>", "Explicit CloudBurn config file to load").option(
+    ).option("--config <path>", "Explicit CloudBurn config file to load (required for config files in CI)").option(
       "--enabled-rules <ruleIds>",
       "Comma-separated rule IDs to enable. When set, CloudBurn checks only these rules. By default, AWS Core preset rules are enabled.",
       parseRuleIdList
@@ -1228,7 +1257,7 @@ var registerDiscoverCommand = (program) => {
       "--service <services>",
       "Comma-separated services to include in the discovery rule set.",
       parseDiscoveryServiceList
-    ).option("--exit-code", "Exit with code 1 when findings exist").action(async (options, command) => {
+    ).option("--exit-code", "Exit with code 1 when findings exist").option("--fail-on <severity>", "Exit with code 1 for findings at or above this severity.", parseSeverity).action(async (options, command) => {
       await runCommand(async () => {
         const debugLogger = resolveCliDebugLogger(command);
         const onProgress = resolveCliDiscoveryProgressLogger(command);
@@ -1252,7 +1281,10 @@ var registerDiscoverCommand = (program) => {
         const output = renderResponse({ kind: "scan-result", result }, format);
         process.stdout.write(`${output}
 `);
-        if (options.exitCode && countScanResultFindings(result) > 0) {
+        if (hasPolicyViolation(result, {
+          exitCode: options.exitCode,
+          failOn: options.failOn
+        })) {
           return EXIT_CODE_POLICY_VIOLATION;
         }
         return EXIT_CODE_OK;
@@ -1427,12 +1459,15 @@ var filterRules = (options) => {
     if (options.source !== void 0 && !options.source.some((source) => rule.supports.includes(source))) {
       return false;
     }
+    if (options.severity !== void 0 && rule.severity !== options.severity) {
+      return false;
+    }
     return true;
   });
 };
 var registerRulesListCommand = (program) => {
   const rulesCommand = registerParentCommand(program, "rules", "Inspect built-in CloudBurn rules");
-  rulesCommand.command("list").description("List built-in CloudBurn rules").option("--service <services>", "Comma-separated services to include.", parseRulesListServiceList).option("--source <sources>", "Comma-separated sources to include (`iac`, `discovery`).", parseRulesListSourceList).action(function(options) {
+  rulesCommand.command("list").description("List built-in CloudBurn rules").option("--service <services>", "Comma-separated services to include.", parseRulesListServiceList).option("--severity <severity>", "Severity to include (`high`, `medium`, `low`).", parseSeverity).option("--source <sources>", "Comma-separated sources to include (`iac`, `discovery`).", parseRulesListSourceList).action(function(options) {
     const output = renderResponse(
       {
         kind: "rule-list",
@@ -1463,7 +1498,7 @@ var toScanConfigOverride = (options) => {
 };
 var registerScanCommand = (program) => {
   setCommandExamples(
-    program.command("scan").description("Run an autodetected static IaC scan").argument("[path]", "Terraform file, CloudFormation template, or directory to scan").option("--config <path>", "Explicit CloudBurn config file to load").option(
+    program.command("scan").description("Run an autodetected static IaC scan").argument("[path]", "Terraform file, CloudFormation template, or directory to scan").option("--config <path>", "Explicit CloudBurn config file to load (required for config files in CI)").option(
       "--enabled-rules <ruleIds>",
       "Comma-separated rule IDs to enable. When set, CloudBurn checks only these rules. By default, AWS Core preset rules are enabled.",
       parseRuleIdList
@@ -1471,7 +1506,7 @@ var registerScanCommand = (program) => {
       "--disabled-rules <ruleIds>",
       "Comma-separated rule IDs to disable from the default AWS Core preset.",
       parseRuleIdList
-    ).option("--service <services>", "Comma-separated services to include in the scan rule set.", parseIaCServiceList).option("--exit-code", "Exit with code 1 when findings exist").action(async (path, options, command) => {
+    ).option("--service <services>", "Comma-separated services to include in the scan rule set.", parseIaCServiceList).option("--exit-code", "Exit with code 1 when findings exist").option("--fail-on <severity>", "Exit with code 1 for findings at or above this severity.", parseSeverity).action(async (path, options, command) => {
       try {
         const debugLogger = resolveCliDebugLogger(command);
         const scanner = new CloudBurnClient2({ debugLogger });
@@ -1483,7 +1518,10 @@ var registerScanCommand = (program) => {
         const output = renderResponse({ kind: "scan-result", result }, format);
         process.stdout.write(`${output}
 `);
-        if (options.exitCode && countScanResultFindings(result) > 0) {
+        if (hasPolicyViolation(result, {
+          exitCode: options.exitCode,
+          failOn: options.failOn
+        })) {
           process.exitCode = EXIT_CODE_POLICY_VIOLATION;
           return;
         }
@@ -1514,7 +1552,7 @@ var isCliEntrypoint = (moduleUrl, argvEntry = process.argv[1]) => {
 };
 var createProgram = () => {
   const program = createCliCommand();
-  program.name("cloudburn").usage("[command]").description("Know what you spend. Fix what you waste.").version("0.10.1").option("--debug", "Write execution trace messages to stderr").option("--format <format>", OUTPUT_FORMAT_OPTION_DESCRIPTION, parseOutputFormat);
+  program.name("cloudburn").usage("[command]").description("Know what you spend. Fix what you waste.").version("0.11.1").option("--debug", "Write execution trace messages to stderr").option("--format <format>", OUTPUT_FORMAT_OPTION_DESCRIPTION, parseOutputFormat);
   configureCliHelp(program);
   program.exitOverride();
   registerCompletionCommand(program);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cloudburn",
-  "version": "0.10.1",
+  "version": "0.11.1",
   "description": "Cloudburn CLI for cloud cost optimization",
   "homepage": "https://cloudburn.io/docs",
   "bugs": {
@@ -20,10 +20,10 @@
   ],
   "dependencies": {
     "commander": "^13.1.0",
-    "@cloudburn/sdk": "0.24.1"
+    "@cloudburn/sdk": "0.26.0"
   },
   "devDependencies": {
-    "@biomejs/biome": "^2.5.4",
+    "@biomejs/biome": "^2.5.3",
     "@types/node": "^24",
     "@vitest/coverage-v8": "^4.0.18",
     "tsup": "^8.5.1",
@@ -51,7 +51,7 @@
     "build": "tsup",
     "typecheck": "tsc --noEmit",
     "test": "vitest run",
-    "lint": "biome check .",
+    "lint": "biome check --error-on-warnings .",
     "lint:fix": "biome check --write .",
     "clean": "rm -rf dist",
     "dev": "tsup --watch"