codeant-cli 0.2.4 → 0.2.5

package/src/index.js

@@ -49,26 +49,39 @@ if (process.argv.length === 2) {
 program
   .command('secrets')
   .description('Scan for secrets in your code')
-  .option('--staged', 'Scan only staged files (default)')
-  .option('--all', 'Scan all changed files')
-  .option('--uncommitted', 'Scan uncommitted changes')
+  .option('--all', 'Scan committed + uncommitted changes (default)')
+  .option('--committed', 'Scan only unpushed commits')
+  .option('--uncommitted', 'Scan only uncommitted changes (staged + unstaged + untracked)')
+  .option('--staged', 'Scan only staged files')
   .option('--last-commit', 'Scan last commit')
   .option('--last-n-commits <n>', 'Scan last n commits (max 5)', parseInt)
-  .option('--fail-on <level>', 'Fail only on HIGH, MEDIUM, or all (default: HIGH)', 'HIGH')
-  .option('--include <paths>', 'Comma-separated list of file paths regex to include')
-  .option('--exclude <paths>', 'Comma-separated list of file paths regex to exclude')
+  .option('--base <branch>', 'Compare against a specific base branch (e.g. --base develop)')
+  .option('--base-commit <commit>', 'Compare against a specific commit (e.g. --base-commit HEAD~3)')
+  .option('--fail-on <level>', 'Fail on issues at or above this level: BLOCKER, CRITICAL, MAJOR, MINOR, INFO (default: CRITICAL)', 'CRITICAL')
+  .option('--include <paths>', 'Comma-separated list of file paths glob patterns to include')
+  .option('--exclude <paths>', 'Comma-separated list of file paths glob patterns to exclude')
   .action((options) => {
-    let scanType = 'staged-only';
+    let scanType = 'all';
     let lastNCommits = 1;
+    let baseBranch = null;
+    let baseCommit = null;
 
+    if (options.base) {
+      scanType = 'base-branch';
+      baseBranch = options.base;
+    } else if (options.baseCommit) {
+      scanType = 'base-commit';
+      baseCommit = options.baseCommit;
     // Check !== undefined, not truthy — passing 0 is valid and shouldn't fall through
-    if (options.lastNCommits !== undefined) {
+    } else if (options.lastNCommits !== undefined) {
       scanType = 'last-n-commits';
       lastNCommits = Math.min(Math.max(1, options.lastNCommits), 5);
-    } else if (options.all) {
-      scanType = 'branch-diff';
+    } else if (options.committed) {
+      scanType = 'committed';
     } else if (options.uncommitted) {
       scanType = 'uncommitted';
+    } else if (options.staged) {
+      scanType = 'staged-only';
     } else if (options.lastCommit) {
       scanType = 'last-commit';
     }
@@ -81,9 +94,9 @@ program
       ? (Array.isArray(options.exclude) ? options.exclude : splitGlobs(options.exclude))
       : [];
 
-    const failOn = options.failOn?.toUpperCase() || 'HIGH';
+    const failOn = options.failOn?.toUpperCase() || 'CRITICAL';
 
-    render(React.createElement(Secrets, { scanType, failOn, include, exclude, lastNCommits }));
+    render(React.createElement(Secrets, { scanType, failOn, include, exclude, lastNCommits, baseBranch, baseCommit }));
   });
 
 program

package/src/utils/secretsApiHelper.js

@@ -1,4 +1,5 @@
 import CommonApiHelper from './commonApiHelper.js';
+import path from 'path';
 import { minimatch } from 'minimatch';
 
 /**
@@ -15,6 +16,58 @@ import { minimatch } from 'minimatch';
  *   ]
  * }
  */
+
+const EXCLUDED_FILENAMES = new Set([
+  'package-lock.json',
+  'yarn.lock',
+  'pnpm-lock.yaml',
+  'composer.lock',
+  'Gemfile.lock',
+  'Cargo.lock',
+  'poetry.lock',
+  'Pipfile.lock',
+  'go.sum',
+  '.DS_Store',
+  'Thumbs.db',
+]);
+
+const EXCLUDED_EXTENSIONS = new Set([
+  // Images
+  '.png', '.jpg', '.jpeg', '.gif', '.bmp', '.ico', '.svg', '.webp', '.avif',
+  // Fonts
+  '.woff', '.woff2', '.ttf', '.eot', '.otf',
+  // Binary / compiled
+  '.exe', '.dll', '.so', '.dylib', '.bin', '.o', '.a', '.class', '.pyc', '.pyo',
+  '.wasm', '.jar', '.war', '.ear',
+  // Archives
+  '.zip', '.tar', '.gz', '.bz2', '.7z', '.rar',
+  // Media
+  '.mp3', '.mp4', '.wav', '.avi', '.mov', '.flv', '.wmv', '.ogg', '.webm',
+  // Data / generated
+  '.min.js', '.min.css', '.map',
+  '.pb', '.proto.bin',
+  // PDF / docs
+  '.pdf', '.doc', '.docx', '.xls', '.xlsx', '.ppt', '.pptx',
+]);
+
+const MAX_FILE_LINES = 5000;
+
+function isScannableFile(filePath) {
+  const basename = path.basename(filePath);
+
+  if (EXCLUDED_FILENAMES.has(basename)) return false;
+
+  const ext = path.extname(basename).toLowerCase();
+  if (EXCLUDED_EXTENSIONS.has(ext)) return false;
+
+  if (basename.endsWith('.min.js') || basename.endsWith('.min.css')) return false;
+
+  // Skip markdown files
+  if (ext === '.md') return false;
+
+  return true;
+}
+
 class SecretsApiHelper extends CommonApiHelper {
   /**
    * Transform diff info array to API format
@@ -124,10 +177,65 @@ class SecretsApiHelper extends CommonApiHelper {
       files = [];
     }
 
+    const totalChanged = files.length;
+    const skipped = [];
+
+    // Filter out non-scannable files (binary, lock files, markdown, etc.)
+    files = files.filter(fileObj => {
+      const filePath = fileObj.file_path;
+
+      if (!isScannableFile(filePath)) {
+        skipped.push({ file: filePath, reason: 'binary/generated' });
+        return false;
+      }
+
+      // Skip test files — backend filters these out anyway
+      if (filePath.toLowerCase().includes('test')) {
+        skipped.push({ file: filePath, reason: 'test file' });
+        return false;
+      }
+
+      // Skip deleted files (empty code)
+      if (fileObj.code === '' || fileObj.code === undefined) {
+        skipped.push({ file: filePath, reason: 'deleted' });
+        return false;
+      }
+
+      // Skip files exceeding line limit
+      if (fileObj.code) {
+        const lineCount = fileObj.code.split('\n').length;
+        if (lineCount > MAX_FILE_LINES) {
+          skipped.push({ file: filePath, reason: `too large (${lineCount} lines, max ${MAX_FILE_LINES})` });
+          return false;
+        }
+      }
+
+      return true;
+    });
+
     // Apply include/exclude filters
+    const beforePatternFilter = files.length;
     files = this._filterFiles(files, includePatterns, excludePatterns);
 
-    return { files };
+    // Track pattern-excluded files
+    if (files.length < beforePatternFilter) {
+      // We don't have exact file names for pattern-excluded, but the count is in skipped
+      const patternExcluded = beforePatternFilter - files.length;
+      if (patternExcluded > 0) {
+        skipped.push({ file: `${patternExcluded} file(s)`, reason: 'excluded by pattern' });
+      }
+    }
+
+    const scannedFiles = files.map(f => f.file_path);
+
+    return {
+      files,
+      _meta: {
+        scanned_files: scannedFiles,
+        total_changed: totalChanged,
+        skipped,
+      },
+    };
   }
 }