ikanban 0.4.4 → 0.4.5

package/lib/pipeline.js

@@ -5,6 +5,8 @@
 //       Pipelines view (secrets masked first), posts running → passed/failed, and exits
 //       with the command's own exit code. iKanban being down never fails the command.
 //   ikanban pipeline event --task IKA-1 --stage deploy --status passed [--url U] [--sha S] [--detail D]
+//   ikanban pipeline event --by-url --stage checks --status passed --url U
+//       the end of a CI run, to every task whose stage is still open on that run link
 //   ikanban pipeline log   --task IKA-1 --stage build   < output.txt
 //
 // Team: --team or IKANBAN_TEAM (identifier like IKA, or its id). Key: VIBE_API_TOKEN.
@@ -31,6 +33,9 @@ function masker(values) {
   return (line) => values.reduce((s, v) => s.split(v).join("***"), line);
 }
 
+/** Options that take no value. */
+const FLAGS = ["--by-url"];
+
 function parse(args) {
   const opts = { _: [] };
   for (let i = 0; i < args.length; i++) {
@@ -40,6 +45,7 @@ function parse(args) {
       break;
     }
     if (!a.startsWith("--")) opts._.push(a);
+    else if (FLAGS.includes(a)) opts[a.slice(2)] = true;
     else opts[a.slice(2)] = args[++i];
   }
   return opts;
@@ -80,7 +86,7 @@ function connection(opts) {
       const [task, run] = t.split("@");
       return { task, run: run || opts.run || process.env.IKANBAN_RUN || undefined };
     });
-  if (!tasks.length) throw new Error("set --task (for example IKA-123; several: IKA-1,IKA-2; with a run: IKA-1@pr-159)");
+  if (!tasks.length && !opts["by-url"]) throw new Error("set --task (for example IKA-123; several: IKA-1,IKA-2; with a run: IKA-1@pr-159)");
   if (!opts.stage) throw new Error("set --stage (for example build, deploy, smoke)");
   return {
     base: apiOrigin(opts["base-url"] || process.env.IKANBAN_BASE_URL || "https://api.i-kanban.com"),
@@ -192,8 +198,15 @@ async function run(args) {
   if (sub === "event") {
     const conn = connection(opts);
     if (!opts.status) throw new Error("set --status (queued, running, passed, failed, skipped, held, cancelled)");
+    if (opts["by-url"] && !opts.url) throw new Error("--by-url needs --url (the run's link)");
     const tid = await teamId(conn, conn.team);
     try {
+      if (opts["by-url"]) {
+        const body = { stage: opts.stage, status: opts.status, url: opts.url, commit_sha: opts.sha, detail: opts.detail, source: conn.source, actor: conn.actor };
+        const done = await api(`/api/teams/${tid}/pipeline-events/by-url`, { ...conn, method: "POST", body });
+        console.log(`${opts.stage} ${opts.status}: ${(done && done.tasks ? done.tasks.length : 0)} open task(s) on that link`);
+        return 0;
+      }
       for (const t of conn.tasks) {
         await postEvent(conn, tid, t, { stage: opts.stage, status: opts.status, url: opts.url, commit_sha: opts.sha, detail: opts.detail });
       }
@@ -221,6 +234,8 @@ async function run(args) {
 const HELP = `Usage:
   ikanban pipeline run   --task IKA-1[@pr-159][,IKA-2] --stage build [--url U] [--sha S] [--mask NAME,...] -- <command> [args...]
   ikanban pipeline event --task IKA-1 --stage deploy --status passed [--url U] [--sha S] [--detail D]
+  ikanban pipeline event --by-url --stage checks --status passed --url U
+      (the end of a CI run, to every task whose stage is still open on that link)
   ikanban pipeline log   --task IKA-1 --stage build < output.txt
 Every command also takes --run R (the run: a PR like pr-159, or a branch), --source S (where:
 github, gitlab, laptop, ci) and --actor A (who). One run per task: IKA-1@pr-159.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ikanban",
-  "version": "0.4.4",
+  "version": "0.4.5",
   "description": "iKanban CLI: AI and security scans of your own repo, with results filed into iKanban",
   "bin": { "ikanban": "bin/ikanban.js" },
   "files": ["bin", "lib", "hooks", "scanners", "README.md", "LICENSE.md"],

package/scanners/ikanban-aiscan.py

@@ -57,7 +57,7 @@ PROMPTFOO_VERSION = "0.123.1"
 # so this string is the release identity. Bump it when publishing a release —
 # a customer pinning a version is pinning this value, and re-uploading different
 # bytes under a version someone already fetched defeats the sha256 they pinned.
-AISCAN_VERSION = "0.6.1"
+AISCAN_VERSION = "0.6.2"
 
 # The ten categories, their labels, and their plugins -- the forward map, copied
 # from promptfoo's OWASP_LLM_TOP_10_MAPPING (src/redteam/constants/frameworks.ts).
@@ -663,6 +663,29 @@ class _NoRedirect(urllib.request.HTTPRedirectHandler):
 _OPENER = urllib.request.build_opener(_NoRedirect)
 
 
+def api(method: str, path: str, base_url: str, token: str, payload=None):
+    """(ok, data | error text | None for 404). Same helper as secscan's; the Pipelines code
+    below calls it (seen on dev: without it `--task` crashed with a NameError)."""
+    req = urllib.request.Request(
+        f"{ikanban_api(base_url)}/api{path}",
+        data=json.dumps(payload).encode() if payload is not None else None,
+        headers={"Authorization": f"Bearer {token}",
+                 "Content-Type": "application/json"},
+        method=method,
+    )
+    try:
+        with _OPENER.open(req, timeout=30) as r:
+            body = json.loads(r.read().decode() or "{}")
+        return True, body.get("data", body)
+    except urllib.error.HTTPError as e:
+        detail = e.read().decode()[:300]
+        if e.code in (404, 405) and not detail.strip():
+            return False, None
+        return False, f"HTTP {e.code}: {detail}"
+    except Exception as e:  # noqa: BLE001 — surface any transport failure verbatim
+        return False, str(e)
+
+
 def publish(findings, run_id, base_url, token, team_id, coverage, plugin_results):
     payload = {
         "scan_run_id": run_id,