infrawise 0.3.0 → 0.4.1

package/README.md

@@ -160,6 +160,41 @@ To let Claude Code manage the server lifecycle automatically:
 
 ---
 
+## GitHub Action
+
+Add infrastructure analysis to any PR workflow. No `infrawise.yaml` required — the action auto-generates one from your AWS credentials.
+
+```yaml
+# .github/workflows/infrawise.yml
+name: Infrawise
+on: [pull_request]
+
+jobs:
+  analyze:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: Sidd27/infrawise@v1
+        with:
+          fail-on: high        # fail the PR on high severity findings (default)
+        env:
+          AWS_ACCESS_KEY_ID:     ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          AWS_REGION:            ${{ secrets.AWS_REGION }}
+```
+
+If `infrawise.yaml` is not present in the repo, the action generates a minimal config with DynamoDB, Lambda, SQS, SNS, SSM, Secrets Manager, and RDS enabled — using `AWS_REGION` from the environment. Add an `infrawise.yaml` to your repo to customize which services to include or to add database connections.
+
+Findings appear as annotations on the PR diff and in the job summary.
+
+| Input | Default | Description |
+|---|---|---|
+| `version` | `latest` | infrawise version to install |
+| `fail-on` | `high` | Exit code 1 if findings at or above this severity (`high`, `medium`, `low`, `never`) |
+| `config` | `infrawise.yaml` | Path to config file — auto-generated if not present |
+
+---
+
 ## CLI reference
 
 | Command | What it does |
@@ -176,6 +211,16 @@ To let Claude Code manage the server lifecycle automatically:
 
 `infrawise.yaml` is generated by `infrawise init` and lives in your repo root. Every service must be explicitly `enabled: true` — infrawise never connects to anything not listed in config.
 
+Connection strings support `${ENV_VAR}` substitution so passwords never need to be committed:
+
+```yaml
+postgres:
+  enabled: true
+  connectionString: postgresql://infrawise_ro:${DB_PASSWORD}@host:5432/mydb
+```
+
+Full example:
+
 ```yaml
 project: payments-service
 
@@ -191,7 +236,7 @@ dynamodb:
 
 postgres:
   enabled: true
-  connectionString: postgresql://infrawise_ro:password@host:5432/mydb
+  connectionString: postgresql://infrawise_ro:${DB_PASSWORD}@host:5432/mydb
 
 mysql:
   enabled: false
@@ -220,6 +265,9 @@ lambda:
 rds:
   enabled: false
 
+kafka:
+  enabled: false
+
 cloudwatchLogs:
   enabled: false
   logGroupPrefixes: []
@@ -284,6 +332,7 @@ Works from AWS APIs, database schema introspection, and IaC files — no depende
 | PostgreSQL / MySQL schema | Tables, indexes, column types |
 | MongoDB schema | Collections, indexes |
 | SQS | Missing DLQs, unencrypted queues, large backlogs |
+| Kafka (kafkajs) | Producer/consumer topic mapping from code |
 | Secrets Manager | Missing secret rotation |
 | Lambda | Default memory (128 MB), high timeouts |
 | RDS | Publicly accessible, no backups, unencrypted, no deletion protection, single-AZ |
@@ -309,7 +358,7 @@ Uses [ts-morph](https://ts-morph.com/) AST analysis to detect which functions ca
 
 Non-TypeScript/JavaScript projects still get full value from infrastructure-level analyzers — code correlation (function-to-table mapping, N+1 patterns) is skipped.
 
-The scanner supports: AWS SDK v3/v2 for DynamoDB, `pg`/Prisma/Knex for PostgreSQL, `mysql2`/Knex for MySQL, driver/Mongoose for MongoDB, and AWS SDK v3 for SQS/SNS/SSM/Secrets/Lambda.
+The scanner supports: AWS SDK v3/v2 for DynamoDB, `pg`/Prisma/Knex for PostgreSQL, `mysql2`/Knex for MySQL, driver/Mongoose for MongoDB, AWS SDK v3 for SQS/SNS/SSM/Secrets/Lambda, and `kafkajs` for Kafka topics (producer/consumer).
 
 ---
 
@@ -399,6 +448,7 @@ src/
 - Kubernetes workload graphing
 - VS Code extension
 - Infrastructure drift detection
+- MSK (Amazon Managed Streaming for Apache Kafka) — cluster metadata + topic listing via MSK API and Kafka admin client
 
 ### Under consideration
 - OpenTelemetry integration

package/dist/adapters/aws.js

@@ -244,7 +244,7 @@ async function extractRDSMetadata(cfg = {}) {
                     instanceClass: db.DBInstanceClass ?? '',
                     publiclyAccessible: db.PubliclyAccessible ?? false,
                     storageEncrypted: db.StorageEncrypted ?? false,
-                    backupRetentionPeriod: db.BackupRetentionPeriod ?? 0,
+                    backupRetentionDays: db.BackupRetentionPeriod ?? 0,
                     deletionProtection: db.DeletionProtection ?? false,
                     multiAZ: db.MultiAZ ?? false,
                     dbInstanceStatus: db.DBInstanceStatus ?? '',

package/dist/adapters/logs.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.extractLogsSummary = extractLogsSummary;
+exports.extractLogsMetadata = extractLogsMetadata;
 exports.validateLogsAccess = validateLogsAccess;
 const client_cloudwatch_logs_1 = require("@aws-sdk/client-cloudwatch-logs");
 const credential_providers_1 = require("@aws-sdk/credential-providers");
@@ -44,7 +44,7 @@ function topPatterns(messages, limit = 5) {
         .slice(0, limit)
         .map(([pattern, count]) => ({ pattern, count }));
 }
-async function extractLogsSummary(cfg = {}) {
+async function extractLogsMetadata(cfg = {}) {
     const client = new client_cloudwatch_logs_1.CloudWatchLogsClient(clientConfig(cfg));
     const windowMs = (cfg.windowHours ?? 24) * 60 * 60 * 1000;
     const startTime = Date.now() - windowMs;

package/dist/cli/commands/analyze.js

@@ -37,6 +37,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.runAnalyze = runAnalyze;
+const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const chalk_1 = __importDefault(require("chalk"));
 const ora_1 = __importDefault(require("ora"));
@@ -52,16 +53,72 @@ const context_1 = require("../../context");
 const graph_1 = require("../../graph");
 const analyzers_1 = require("../../analyzers");
 const utils_1 = require("../utils");
+const SEVERITY_RANK = { high: 3, medium: 2, low: 1, never: 0 };
+function mkSpinner(text, ci) {
+    if (ci) {
+        return {
+            succeed: (msg) => console.log(`  ✓ ${msg}`),
+            warn: (msg) => console.log(`  ⚠ ${msg}`),
+        };
+    }
+    return (0, ora_1.default)({ text: chalk_1.default.dim(text), color: 'cyan' }).start();
+}
+function emitCIOutput(findings, failOn) {
+    for (const f of findings) {
+        const level = f.severity === 'high' ? 'error' : f.severity === 'medium' ? 'warning' : 'notice';
+        console.log(`::${level} title=Infrawise [${f.severity.toUpperCase()}]::${f.issue} — ${f.description}`);
+    }
+    const summaryPath = process.env['GITHUB_STEP_SUMMARY'];
+    if (summaryPath) {
+        const high = findings.filter((f) => f.severity === 'high').length;
+        const medium = findings.filter((f) => f.severity === 'medium').length;
+        const low = findings.filter((f) => f.severity === 'low').length;
+        const rows = findings.map((f) => {
+            const icon = f.severity === 'high' ? '🔴' : f.severity === 'medium' ? '🟡' : '🔵';
+            return `| ${icon} ${f.severity.toUpperCase()} | ${f.issue} | ${f.recommendation} |`;
+        }).join('\n');
+        const summary = findings.length === 0
+            ? '## ✅ Infrawise — no issues found\n'
+            : [
+                '## Infrawise Analysis',
+                '',
+                `**${high} high · ${medium} medium · ${low} low**`,
+                '',
+                '| Severity | Issue | Recommendation |',
+                '|---|---|---|',
+                rows,
+            ].join('\n');
+        fs.appendFileSync(summaryPath, summary + '\n');
+    }
+    const threshold = SEVERITY_RANK[failOn] ?? 3;
+    const maxFound = Math.max(0, ...findings.map((f) => SEVERITY_RANK[f.severity] ?? 0));
+    if (maxFound >= threshold && threshold > 0) {
+        process.exit(1);
+    }
+}
 async function runAnalyze(options = {}) {
-    (0, utils_1.printHeader)('Running Analysis');
+    const ci = options.ci ?? false;
+    const failOn = options.failOn ?? 'high';
+    if (!ci)
+        (0, utils_1.printHeader)('Running Analysis');
     let config;
+    let isFallback = false;
     try {
         config = (0, core_1.loadConfig)(options.config);
-        utils_1.log.success('Config loaded', options.config ?? 'infrawise.yaml');
+        if (!ci)
+            utils_1.log.success('Config loaded', options.config ?? 'infrawise.yaml');
     }
     catch (err) {
-        console.error((0, core_1.formatError)(err));
-        process.exit(1);
+        const isNotFound = err instanceof Error && err.message.includes('not found at');
+        if (ci && isNotFound) {
+            config = { project: path.basename(process.cwd()) };
+            isFallback = true;
+            console.log('  ✓ No infrawise.yaml — running code-only analysis (repo scan + IaC)');
+        }
+        else {
+            console.error((0, core_1.formatError)(err));
+            process.exit(1);
+        }
     }
     const repoPath = options.repo ?? process.cwd();
     const awsCfg = { region: config.aws?.region, profile: config.aws?.profile, endpoint: config.aws?.endpoint };
@@ -72,145 +129,145 @@ async function runAnalyze(options = {}) {
     const servicesMeta = {};
     // ── DynamoDB ────────────────────────────────────────────────────────────────
     if (config.dynamodb?.enabled === true) {
-        const spin = (0, ora_1.default)({ text: chalk_1.default.dim('Extracting DynamoDB tables...'), color: 'cyan' }).start();
+        const s = mkSpinner('Extracting DynamoDB tables...', ci);
         try {
             const result = await (0, dynamodb_1.extractDynamoMetadata)(config);
             dynamoMeta.push(...result);
-            spin.succeed(chalk_1.default.green('DynamoDB') + chalk_1.default.dim(`  ${result.length} table(s)`));
+            s.succeed(chalk_1.default.green('DynamoDB') + chalk_1.default.dim(`  ${result.length} table(s)`));
         }
         catch (err) {
-            spin.warn(chalk_1.default.yellow('DynamoDB skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+            s.warn(chalk_1.default.yellow('DynamoDB skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
         }
     }
     // ── PostgreSQL ──────────────────────────────────────────────────────────────
     if (config.postgres?.enabled && config.postgres.connectionString) {
-        const spin = (0, ora_1.default)({ text: chalk_1.default.dim('Extracting PostgreSQL schema...'), color: 'cyan' }).start();
+        const s = mkSpinner('Extracting PostgreSQL schema...', ci);
         try {
             const result = await (0, postgres_1.extractPostgresMetadata)(config.postgres.connectionString);
             postgresMeta.push(...result);
-            spin.succeed(chalk_1.default.green('PostgreSQL') + chalk_1.default.dim(`  ${result.length} table(s)`));
+            s.succeed(chalk_1.default.green('PostgreSQL') + chalk_1.default.dim(`  ${result.length} table(s)`));
         }
         catch (err) {
-            spin.warn(chalk_1.default.yellow('PostgreSQL skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+            s.warn(chalk_1.default.yellow('PostgreSQL skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
         }
     }
     // ── MySQL ───────────────────────────────────────────────────────────────────
     if (config.mysql?.enabled && config.mysql.connectionString) {
-        const spin = (0, ora_1.default)({ text: chalk_1.default.dim('Extracting MySQL schema...'), color: 'cyan' }).start();
+        const s = mkSpinner('Extracting MySQL schema...', ci);
         try {
             const result = await (0, mysql_1.extractMySQLMetadata)(config.mysql.connectionString);
             mysqlMeta.push(...result);
-            spin.succeed(chalk_1.default.green('MySQL') + chalk_1.default.dim(`  ${result.length} table(s)`));
+            s.succeed(chalk_1.default.green('MySQL') + chalk_1.default.dim(`  ${result.length} table(s)`));
         }
         catch (err) {
-            spin.warn(chalk_1.default.yellow('MySQL skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+            s.warn(chalk_1.default.yellow('MySQL skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
         }
     }
     // ── MongoDB ─────────────────────────────────────────────────────────────────
     if (config.mongodb?.enabled && config.mongodb.connectionString) {
-        const spin = (0, ora_1.default)({ text: chalk_1.default.dim('Extracting MongoDB schema...'), color: 'cyan' }).start();
+        const s = mkSpinner('Extracting MongoDB schema...', ci);
         try {
             const result = await (0, mongodb_1.extractMongoMetadata)(config.mongodb.connectionString, config.mongodb.databases);
             mongoMeta.push(...result);
-            spin.succeed(chalk_1.default.green('MongoDB') + chalk_1.default.dim(`  ${result.length} collection(s)`));
+            s.succeed(chalk_1.default.green('MongoDB') + chalk_1.default.dim(`  ${result.length} collection(s)`));
         }
         catch (err) {
-            spin.warn(chalk_1.default.yellow('MongoDB skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+            s.warn(chalk_1.default.yellow('MongoDB skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
         }
     }
     // ── SQS ─────────────────────────────────────────────────────────────────────
     if (config.sqs?.enabled === true) {
-        const spin = (0, ora_1.default)({ text: chalk_1.default.dim('Extracting SQS queues...'), color: 'cyan' }).start();
+        const s = mkSpinner('Extracting SQS queues...', ci);
         try {
             const result = await (0, aws_1.extractSQSMetadata)(awsCfg);
             servicesMeta.sqs = result;
-            spin.succeed(chalk_1.default.green('SQS') + chalk_1.default.dim(`  ${result.length} queue(s)`));
+            s.succeed(chalk_1.default.green('SQS') + chalk_1.default.dim(`  ${result.length} queue(s)`));
         }
         catch (err) {
-            spin.warn(chalk_1.default.yellow('SQS skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+            s.warn(chalk_1.default.yellow('SQS skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
         }
     }
     // ── SNS ─────────────────────────────────────────────────────────────────────
     if (config.sns?.enabled === true) {
-        const spin = (0, ora_1.default)({ text: chalk_1.default.dim('Extracting SNS topics...'), color: 'cyan' }).start();
+        const s = mkSpinner('Extracting SNS topics...', ci);
         try {
             const result = await (0, aws_1.extractSNSMetadata)(awsCfg);
             servicesMeta.sns = result;
-            spin.succeed(chalk_1.default.green('SNS') + chalk_1.default.dim(`  ${result.length} topic(s)`));
+            s.succeed(chalk_1.default.green('SNS') + chalk_1.default.dim(`  ${result.length} topic(s)`));
         }
         catch (err) {
-            spin.warn(chalk_1.default.yellow('SNS skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+            s.warn(chalk_1.default.yellow('SNS skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
         }
     }
     // ── SSM Parameter Store ──────────────────────────────────────────────────────
     if (config.ssm?.enabled === true) {
-        const spin = (0, ora_1.default)({ text: chalk_1.default.dim('Extracting SSM parameters...'), color: 'cyan' }).start();
+        const s = mkSpinner('Extracting SSM parameters...', ci);
         try {
             const result = await (0, aws_1.extractSSMMetadata)({ ...awsCfg, paths: config.ssm?.paths });
             servicesMeta.ssm = result;
-            spin.succeed(chalk_1.default.green('SSM') + chalk_1.default.dim(`  ${result.length} parameter(s)  `) + chalk_1.default.dim('(metadata only, no values)'));
+            s.succeed(chalk_1.default.green('SSM') + chalk_1.default.dim(`  ${result.length} parameter(s)  `) + chalk_1.default.dim('(metadata only, no values)'));
         }
         catch (err) {
-            spin.warn(chalk_1.default.yellow('SSM skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+            s.warn(chalk_1.default.yellow('SSM skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
         }
     }
     // ── Secrets Manager ──────────────────────────────────────────────────────────
     if (config.secretsManager?.enabled === true) {
-        const spin = (0, ora_1.default)({ text: chalk_1.default.dim('Extracting Secrets Manager metadata...'), color: 'cyan' }).start();
+        const s = mkSpinner('Extracting Secrets Manager metadata...', ci);
         try {
             const result = await (0, aws_1.extractSecretsMetadata)(awsCfg);
             servicesMeta.secrets = result;
-            spin.succeed(chalk_1.default.green('Secrets Manager') + chalk_1.default.dim(`  ${result.length} secret(s)  `) + chalk_1.default.dim('(names/rotation only, no values)'));
+            s.succeed(chalk_1.default.green('Secrets Manager') + chalk_1.default.dim(`  ${result.length} secret(s)  `) + chalk_1.default.dim('(names/rotation only, no values)'));
         }
         catch (err) {
-            spin.warn(chalk_1.default.yellow('Secrets Manager skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+            s.warn(chalk_1.default.yellow('Secrets Manager skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
         }
     }
     // ── Lambda ───────────────────────────────────────────────────────────────────
     if (config.lambda?.enabled === true) {
-        const spin = (0, ora_1.default)({ text: chalk_1.default.dim('Extracting Lambda functions...'), color: 'cyan' }).start();
+        const s = mkSpinner('Extracting Lambda functions...', ci);
         try {
             const result = await (0, aws_1.extractLambdaMetadata)(awsCfg);
             servicesMeta.lambda = result;
-            spin.succeed(chalk_1.default.green('Lambda') + chalk_1.default.dim(`  ${result.length} function(s)`));
+            s.succeed(chalk_1.default.green('Lambda') + chalk_1.default.dim(`  ${result.length} function(s)`));
         }
         catch (err) {
-            spin.warn(chalk_1.default.yellow('Lambda skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+            s.warn(chalk_1.default.yellow('Lambda skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
         }
     }
     // ── RDS ──────────────────────────────────────────────────────────────────────
     if (config.rds?.enabled === true) {
-        const spin = (0, ora_1.default)({ text: chalk_1.default.dim('Extracting RDS instances...'), color: 'cyan' }).start();
+        const s = mkSpinner('Extracting RDS instances...', ci);
         try {
             const result = await (0, aws_1.extractRDSMetadata)(awsCfg);
             servicesMeta.rds = result;
-            spin.succeed(chalk_1.default.green('RDS') + chalk_1.default.dim(`  ${result.length} instance(s)`));
+            s.succeed(chalk_1.default.green('RDS') + chalk_1.default.dim(`  ${result.length} instance(s)`));
         }
         catch (err) {
-            spin.warn(chalk_1.default.yellow('RDS skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+            s.warn(chalk_1.default.yellow('RDS skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
         }
     }
     // ── CloudWatch Logs ──────────────────────────────────────────────────────────
     if (config.cloudwatchLogs?.enabled) {
-        const spin = (0, ora_1.default)({ text: chalk_1.default.dim('Sampling CloudWatch Logs (errors only, max 50 groups)...'), color: 'cyan' }).start();
+        const s = mkSpinner('Sampling CloudWatch Logs (errors only, max 50 groups)...', ci);
         try {
-            const result = await (0, logs_1.extractLogsSummary)({
+            const result = await (0, logs_1.extractLogsMetadata)({
                 ...awsCfg,
                 logGroupPrefixes: config.cloudwatchLogs.logGroupPrefixes,
                 windowHours: config.cloudwatchLogs.windowHours,
             });
             servicesMeta.logs = result;
             const errorGroups = result.filter((lg) => lg.errorCount > 0).length;
-            spin.succeed(chalk_1.default.green('CloudWatch Logs') + chalk_1.default.dim(`  ${result.length} group(s), ${errorGroups} with errors`));
+            s.succeed(chalk_1.default.green('CloudWatch Logs') + chalk_1.default.dim(`  ${result.length} group(s), ${errorGroups} with errors`));
         }
         catch (err) {
-            spin.warn(chalk_1.default.yellow('CloudWatch Logs skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+            s.warn(chalk_1.default.yellow('CloudWatch Logs skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
         }
     }
     // ── IaC schema (Terraform / CloudFormation / CDK) ────────────────────────────
     let iacDriftAnalyzer;
     {
-        const spin = (0, ora_1.default)({ text: chalk_1.default.dim('Extracting IaC schema (Terraform / CloudFormation / CDK)...'), color: 'cyan' }).start();
+        const s = mkSpinner('Extracting IaC schema (Terraform / CloudFormation / CDK)...', ci);
         try {
             const iacSchema = await (0, terraform_1.extractIaCSchema)(repoPath);
             const total = iacSchema.dynamoTables.length + iacSchema.rdsInstances.length +
@@ -219,52 +276,52 @@ async function runAnalyze(options = {}) {
                 iacSchema.secrets.length + iacSchema.apiGateways.length;
             iacDriftAnalyzer = new analyzers_1.IaCDriftAnalyzer();
             iacDriftAnalyzer.setIaCSchema(iacSchema);
-            spin.succeed(chalk_1.default.green('IaC schema') + chalk_1.default.dim(`  ${total} resource(s) across TF/CFN/CDK`));
+            s.succeed(chalk_1.default.green('IaC schema') + chalk_1.default.dim(`  ${total} resource(s) across TF/CFN/CDK`));
         }
         catch (err) {
-            spin.warn(chalk_1.default.yellow('IaC scan skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+            s.warn(chalk_1.default.yellow('IaC scan skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
         }
     }
     // ── Repository scan ──────────────────────────────────────────────────────────
     let operations;
     {
-        const spin = (0, ora_1.default)({ text: chalk_1.default.dim(`Scanning ${path.basename(repoPath)} for service usage...`), color: 'cyan' }).start();
+        const s = mkSpinner(`Scanning ${path.basename(repoPath)} for service usage...`, ci);
         try {
             operations = await (0, context_1.scanRepository)(repoPath);
-            spin.succeed(chalk_1.default.green('Repository scanned') + chalk_1.default.dim(`  ${operations.length} service operation(s) found`));
+            s.succeed(chalk_1.default.green('Repository scanned') + chalk_1.default.dim(`  ${operations.length} service operation(s) found`));
         }
         catch (err) {
-            spin.warn(chalk_1.default.yellow('Repository scan failed') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+            s.warn(chalk_1.default.yellow('Repository scan failed') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
             operations = [];
         }
     }
     // ── Build graph ──────────────────────────────────────────────────────────────
     let graph;
     {
-        const spin = (0, ora_1.default)({ text: chalk_1.default.dim('Building infrastructure graph...'), color: 'cyan' }).start();
+        const s = mkSpinner('Building infrastructure graph...', ci);
         graph = (0, graph_1.buildGraph)(operations, dynamoMeta, postgresMeta, mysqlMeta, mongoMeta, servicesMeta);
-        spin.succeed(chalk_1.default.green('Graph built') + chalk_1.default.dim(`  ${graph.nodes.length} nodes, ${graph.edges.length} edges`));
+        s.succeed(chalk_1.default.green('Graph built') + chalk_1.default.dim(`  ${graph.nodes.length} nodes, ${graph.edges.length} edges`));
     }
     // ── Run analyzers ────────────────────────────────────────────────────────────
     let findings;
     {
-        const spin = (0, ora_1.default)({ text: chalk_1.default.dim('Running analyzers...'), color: 'cyan' }).start();
+        const s = mkSpinner('Running analyzers...', ci);
         const analyzers = [
-            ...(config.dynamodb?.enabled === true ? [
+            ...(config.dynamodb?.enabled === true || isFallback ? [
                 new analyzers_1.FullTableScanAnalyzer(),
                 new analyzers_1.MissingGSIAnalyzer(),
                 new analyzers_1.HotPartitionAnalyzer(),
             ] : []),
-            ...(config.postgres?.enabled ? [
+            ...(config.postgres?.enabled || isFallback ? [
                 new analyzers_1.MissingIndexAnalyzer(),
                 new analyzers_1.NplusOneAnalyzer(),
                 new analyzers_1.LargeSelectAnalyzer(),
             ] : []),
-            ...(config.mysql?.enabled ? [
+            ...(config.mysql?.enabled || isFallback ? [
                 new analyzers_1.MissingMySQLIndexAnalyzer(),
                 new analyzers_1.MySQLFullTableScanAnalyzer(),
             ] : []),
-            ...(config.mongodb?.enabled ? [
+            ...(config.mongodb?.enabled || isFallback ? [
                 new analyzers_1.MissingMongoIndexAnalyzer(),
                 new analyzers_1.MongoCollectionScanAnalyzer(),
             ] : []),
@@ -293,13 +350,17 @@ async function runAnalyze(options = {}) {
             ...(iacDriftAnalyzer ? [iacDriftAnalyzer] : []),
         ];
         findings = await (0, analyzers_1.runAllAnalyzers)(graph, analyzers);
-        spin.succeed(chalk_1.default.green('Analysis complete') + chalk_1.default.dim(`  ${findings.length} finding(s)`));
+        s.succeed(chalk_1.default.green('Analysis complete') + chalk_1.default.dim(`  ${findings.length} finding(s)`));
     }
     // ── Cache ─────────────────────────────────────────────────────────────────────
     (0, core_1.writeCache)('graph', graph);
     (0, core_1.writeCache)('findings', findings);
     (0, core_1.writeCache)('operations', operations);
     // ── Output ────────────────────────────────────────────────────────────────────
+    if (ci) {
+        emitCIOutput(findings, failOn);
+        return;
+    }
     console.log('');
     if (findings.length === 0) {
         console.log(`  ${chalk_1.default.green.bold('✓ No issues found!')}  ${chalk_1.default.dim('Your infrastructure looks clean.')}`);

package/dist/cli/index.js

@@ -37,12 +37,17 @@ program
     .option('-c, --config <path>', 'Path to infrawise.yaml', 'infrawise.yaml')
     .option('-r, --repo <path>', 'Path to repository to scan', process.cwd())
     .option('--no-cache', 'Skip reading/writing the cache')
+    .option('--ci', 'CI mode: GitHub annotations output, job summary, exit code on findings')
+    .option('--fail-on <severity>', 'Exit 1 if findings at or above this severity (high|medium|low|never)', 'high')
     .action(async (options) => {
-    (0, utils_1.printBanner)();
+    if (!options.ci)
+        (0, utils_1.printBanner)();
     await (0, analyze_1.runAnalyze)({
         config: options.config !== 'infrawise.yaml' ? options.config : undefined,
         repo: options.repo,
         noCache: !options.cache,
+        ci: options.ci ?? false,
+        failOn: options.failOn ?? 'high',
     });
 });
 program

package/dist/context/index.js

@@ -82,6 +82,11 @@ const MONGO_COLLECTION_METHODS = new Set(['collection']);
 // ── AWS service patterns ──────────────────────────────────────────────────────
 const SQS_COMMANDS = new Set(['SendMessageCommand', 'SendMessageBatchCommand', 'ReceiveMessageCommand', 'DeleteMessageCommand', 'sendMessage', 'sendMessageBatch', 'receiveMessage']);
 const SNS_COMMANDS = new Set(['PublishCommand', 'PublishBatchCommand', 'publish', 'publishBatch']);
+// kafkajs patterns — detection relies on variable naming (producer/consumer/kafka)
+const KAFKA_PRODUCER_METHODS = new Set(['send', 'sendBatch']);
+const KAFKA_CONSUMER_METHODS = new Set(['subscribe']);
+const KAFKA_CLIENT_PATTERNS = ['kafka', 'producer', 'consumer'];
+const KAFKA_TOPIC_KEYS = ['topic'];
 const SSM_COMMANDS = new Set(['GetParameterCommand', 'GetParametersCommand', 'GetParametersByPathCommand', 'getParameter', 'getParameters', 'getParametersByPath']);
 const SECRETS_COMMANDS = new Set(['GetSecretValueCommand', 'getSecretValue']);
 const LAMBDA_COMMANDS = new Set(['InvokeCommand', 'InvokeAsyncCommand', 'invoke', 'invokeAsync']);
@@ -158,7 +163,7 @@ function detectDynamoOperations(callExpr, filePath) {
                     return {
                         functionName: getEnclosingFunctionName(callExpr),
                         operationType: className,
-                        databaseType: 'dynamodb',
+                        serviceType: 'dynamodb',
                         target: tableName,
                         filePath,
                     };
@@ -173,7 +178,7 @@ function detectDynamoOperations(callExpr, filePath) {
                 return {
                     functionName: getEnclosingFunctionName(callExpr),
                     operationType: methodName,
-                    databaseType: 'dynamodb',
+                    serviceType: 'dynamodb',
                     target: tableName,
                     filePath,
                 };
@@ -229,7 +234,7 @@ function detectPostgresOperations(callExpr, filePath) {
             return {
                 functionName: getEnclosingFunctionName(callExpr),
                 operationType: 'query',
-                databaseType: 'postgres',
+                serviceType: 'postgres',
                 target: tableName,
                 filePath,
             };
@@ -245,7 +250,7 @@ function detectPostgresOperations(callExpr, filePath) {
                 return {
                     functionName: getEnclosingFunctionName(callExpr),
                     operationType: methodName,
-                    databaseType: 'postgres',
+                    serviceType: 'postgres',
                     target: modelName,
                     filePath,
                 };
@@ -262,7 +267,7 @@ function detectPostgresOperations(callExpr, filePath) {
             return {
                 functionName: getEnclosingFunctionName(callExpr),
                 operationType: methodName,
-                databaseType: 'postgres',
+                serviceType: 'postgres',
                 target: 'unknown',
                 filePath,
             };
@@ -278,7 +283,7 @@ function detectPostgresOperations(callExpr, filePath) {
                 return {
                     functionName: getEnclosingFunctionName(callExpr),
                     operationType: methodName,
-                    databaseType: 'postgres',
+                    serviceType: 'postgres',
                     target: tableName,
                     filePath,
                 };
@@ -315,7 +320,7 @@ function detectMySQLOperations(callExpr, filePath) {
             return {
                 functionName: getEnclosingFunctionName(callExpr),
                 operationType: 'query',
-                databaseType: 'mysql',
+                serviceType: 'mysql',
                 target: tableName,
                 filePath,
             };
@@ -334,7 +339,7 @@ function detectMySQLOperations(callExpr, filePath) {
             return {
                 functionName: getEnclosingFunctionName(callExpr),
                 operationType: methodName,
-                databaseType: 'mysql',
+                serviceType: 'mysql',
                 target: tableName,
                 filePath,
             };
@@ -382,7 +387,7 @@ function detectMongoOperations(callExpr, filePath) {
             return {
                 functionName: getEnclosingFunctionName(callExpr),
                 operationType: opType,
-                databaseType: 'mongodb',
+                serviceType: 'mongodb',
                 target: collectionName,
                 filePath,
             };
@@ -399,7 +404,7 @@ function detectMongoOperations(callExpr, filePath) {
             return {
                 functionName: getEnclosingFunctionName(callExpr),
                 operationType: 'query',
-                databaseType: 'mongodb',
+                serviceType: 'mongodb',
                 target: collectionName,
                 filePath,
             };
@@ -422,6 +427,35 @@ function extractArgValue(arg, ...keys) {
     }
     return 'unknown';
 }
+function detectKafkaOperations(callExpr, filePath) {
+    const expr = callExpr.getExpression();
+    const args = callExpr.getArguments();
+    if (!ts_morph_1.Node.isPropertyAccessExpression(expr))
+        return null;
+    const methodName = expr.getName();
+    const objText = expr.getExpression().getText().toLowerCase();
+    if (!KAFKA_CLIENT_PATTERNS.some((p) => objText.includes(p)))
+        return null;
+    if (KAFKA_PRODUCER_METHODS.has(methodName)) {
+        return {
+            functionName: getEnclosingFunctionName(callExpr),
+            operationType: methodName,
+            serviceType: 'kafka',
+            target: args.length > 0 ? extractArgValue(args[0], ...KAFKA_TOPIC_KEYS) : 'unknown',
+            filePath,
+        };
+    }
+    if (KAFKA_CONSUMER_METHODS.has(methodName)) {
+        return {
+            functionName: getEnclosingFunctionName(callExpr),
+            operationType: methodName,
+            serviceType: 'kafka',
+            target: args.length > 0 ? extractArgValue(args[0], ...KAFKA_TOPIC_KEYS) : 'unknown',
+            filePath,
+        };
+    }
+    return null;
+}
 function detectAWSServiceOperations(callExpr, filePath) {
     const expr = callExpr.getExpression();
     const args = callExpr.getArguments();
@@ -435,7 +469,7 @@ function detectAWSServiceOperations(callExpr, filePath) {
                 return {
                     functionName: getEnclosingFunctionName(callExpr),
                     operationType: className,
-                    databaseType: 'sqs',
+                    serviceType: 'sqs',
                     target: cmdArgs.length > 0 ? extractArgValue(cmdArgs[0], ...SQS_ARG_KEYS) : 'unknown',
                     filePath,
                 };
@@ -444,7 +478,7 @@ function detectAWSServiceOperations(callExpr, filePath) {
                 return {
                     functionName: getEnclosingFunctionName(callExpr),
                     operationType: className,
-                    databaseType: 'sns',
+                    serviceType: 'sns',
                     target: cmdArgs.length > 0 ? extractArgValue(cmdArgs[0], ...SNS_ARG_KEYS) : 'unknown',
                     filePath,
                 };
@@ -453,7 +487,7 @@ function detectAWSServiceOperations(callExpr, filePath) {
                 return {
                     functionName: getEnclosingFunctionName(callExpr),
                     operationType: className,
-                    databaseType: 'ssm',
+                    serviceType: 'ssm',
                     target: cmdArgs.length > 0 ? extractArgValue(cmdArgs[0], ...SSM_ARG_KEYS) : 'unknown',
                     filePath,
                 };
@@ -462,7 +496,7 @@ function detectAWSServiceOperations(callExpr, filePath) {
                 return {
                     functionName: getEnclosingFunctionName(callExpr),
                     operationType: className,
-                    databaseType: 'secretsmanager',
+                    serviceType: 'secretsmanager',
                     target: cmdArgs.length > 0 ? extractArgValue(cmdArgs[0], ...SECRETS_ARG_KEYS) : 'unknown',
                     filePath,
                 };
@@ -471,7 +505,7 @@ function detectAWSServiceOperations(callExpr, filePath) {
                 return {
                     functionName: getEnclosingFunctionName(callExpr),
                     operationType: className,
-                    databaseType: 'lambda',
+                    serviceType: 'lambda',
                     target: cmdArgs.length > 0 ? extractArgValue(cmdArgs[0], ...LAMBDA_ARG_KEYS) : 'unknown',
                     filePath,
                 };
@@ -486,7 +520,7 @@ function detectAWSServiceOperations(callExpr, filePath) {
             return {
                 functionName: getEnclosingFunctionName(callExpr),
                 operationType: methodName,
-                databaseType: 'sqs',
+                serviceType: 'sqs',
                 target: args.length > 0 ? extractArgValue(args[0], ...SQS_ARG_KEYS) : 'unknown',
                 filePath,
             };
@@ -495,7 +529,7 @@ function detectAWSServiceOperations(callExpr, filePath) {
             return {
                 functionName: getEnclosingFunctionName(callExpr),
                 operationType: methodName,
-                databaseType: 'sns',
+                serviceType: 'sns',
                 target: args.length > 0 ? extractArgValue(args[0], ...SNS_ARG_KEYS) : 'unknown',
                 filePath,
             };
@@ -504,7 +538,7 @@ function detectAWSServiceOperations(callExpr, filePath) {
             return {
                 functionName: getEnclosingFunctionName(callExpr),
                 operationType: methodName,
-                databaseType: 'ssm',
+                serviceType: 'ssm',
                 target: args.length > 0 ? extractArgValue(args[0], ...SSM_ARG_KEYS) : 'unknown',
                 filePath,
             };
@@ -513,7 +547,7 @@ function detectAWSServiceOperations(callExpr, filePath) {
             return {
                 functionName: getEnclosingFunctionName(callExpr),
                 operationType: methodName,
-                databaseType: 'secretsmanager',
+                serviceType: 'secretsmanager',
                 target: args.length > 0 ? extractArgValue(args[0], ...SECRETS_ARG_KEYS) : 'unknown',
                 filePath,
             };
@@ -522,7 +556,7 @@ function detectAWSServiceOperations(callExpr, filePath) {
             return {
                 functionName: getEnclosingFunctionName(callExpr),
                 operationType: methodName,
-                databaseType: 'lambda',
+                serviceType: 'lambda',
                 target: args.length > 0 ? extractArgValue(args[0], ...LAMBDA_ARG_KEYS) : 'unknown',
                 filePath,
             };
@@ -586,6 +620,11 @@ async function scanRepository(repoPath) {
                 operations.push(mongoOp);
                 continue;
             }
+            const kafkaOp = detectKafkaOperations(callExpr, filePath);
+            if (kafkaOp) {
+                operations.push(kafkaOp);
+                continue;
+            }
             const awsOp = detectAWSServiceOperations(callExpr, filePath);
             if (awsOp) {
                 operations.push(awsOp);

package/dist/core/config.js

@@ -109,6 +109,11 @@ function loadConfig(configPath) {
     catch (err) {
         throw new ConfigError(`Unable to read configuration file: ${resolvedPath}`, [String(err)]);
     }
+    // Expand ${ENV_VAR} references — lets users store secrets in env, not in the YAML file
+    rawContent = rawContent.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g, (match, name) => {
+        const val = process.env[name];
+        return val !== undefined ? val : match;
+    });
     let parsedYaml;
     try {
         parsedYaml = yaml.load(rawContent);

package/dist/graph/index.js

@@ -140,7 +140,7 @@ function buildGraph(operations, dynamoMeta, postgresMeta, mysqlMeta = [], mongoM
             instanceClass: db.instanceClass,
             publiclyAccessible: db.publiclyAccessible,
             storageEncrypted: db.storageEncrypted,
-            backupRetentionDays: db.backupRetentionPeriod,
+            backupRetentionDays: db.backupRetentionDays,
             deletionProtection: db.deletionProtection,
             multiAZ: db.multiAZ,
         });
@@ -153,31 +153,38 @@ function buildGraph(operations, dynamoMeta, postgresMeta, mysqlMeta = [], mongoM
             nodeIds.add(funcNodeId);
         }
         // AWS service operations create edges to service nodes
-        if (op.databaseType === 'sqs') {
+        if (op.serviceType === 'sqs') {
             const queueId = `queue:aws:${op.target}`;
             addNode({ id: queueId, type: 'queue', name: op.target, provider: 'aws', hasDLQ: false, encrypted: false });
             edges.push({ from: funcNodeId, to: queueId, type: 'publishes_to' });
             continue;
         }
-        if (op.databaseType === 'sns') {
+        if (op.serviceType === 'sns') {
             const topicId = `topic:aws:${op.target}`;
             addNode({ id: topicId, type: 'topic', name: op.target, provider: 'aws', encrypted: false });
             edges.push({ from: funcNodeId, to: topicId, type: 'publishes_to' });
             continue;
         }
-        if (op.databaseType === 'ssm') {
+        if (op.serviceType === 'kafka') {
+            const topicId = `topic:kafka:${op.target}`;
+            addNode({ id: topicId, type: 'topic', name: op.target, provider: 'kafka', encrypted: false });
+            const edgeType = op.operationType === 'subscribe' ? 'subscribes_to' : 'publishes_to';
+            edges.push({ from: funcNodeId, to: topicId, type: edgeType });
+            continue;
+        }
+        if (op.serviceType === 'ssm') {
             const paramId = `parameter:aws:${op.target}`;
             addNode({ id: paramId, type: 'parameter', name: op.target, provider: 'aws', paramType: 'String', tier: 'Standard' });
             edges.push({ from: funcNodeId, to: paramId, type: 'reads_parameter' });
             continue;
         }
-        if (op.databaseType === 'secretsmanager') {
+        if (op.serviceType === 'secretsmanager') {
             const secretId = `secret:aws:${op.target}`;
             addNode({ id: secretId, type: 'secret', name: op.target, provider: 'aws', rotationEnabled: false });
             edges.push({ from: funcNodeId, to: secretId, type: 'reads_secret' });
             continue;
         }
-        if (op.databaseType === 'lambda') {
+        if (op.serviceType === 'lambda') {
             const lambdaId = `lambda:aws:${op.target}`;
             addNode({ id: lambdaId, type: 'lambda', name: op.target });
             edges.push({ from: funcNodeId, to: lambdaId, type: 'triggers' });
@@ -185,16 +192,16 @@ function buildGraph(operations, dynamoMeta, postgresMeta, mysqlMeta = [], mongoM
         }
         // Database operations
         let tableNodeId;
-        if (op.databaseType === 'dynamodb') {
+        if (op.serviceType === 'dynamodb') {
             tableNodeId = `table:dynamo:${op.target}`;
             addNode({ id: tableNodeId, type: 'table', name: op.target, databaseType: 'dynamodb' });
         }
-        else if (op.databaseType === 'mysql') {
+        else if (op.serviceType === 'mysql') {
             const q = op.target.includes('.') ? op.target : `default.${op.target}`;
             tableNodeId = `table:mysql:${q}`;
             addNode({ id: tableNodeId, type: 'table', name: q, databaseType: 'mysql' });
         }
-        else if (op.databaseType === 'mongodb') {
+        else if (op.serviceType === 'mongodb') {
             const q = op.target.includes('.') ? op.target : `default.${op.target}`;
             tableNodeId = `table:mongodb:${q}`;
             addNode({ id: tableNodeId, type: 'table', name: q, databaseType: 'mongodb' });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "infrawise",
-  "version": "0.3.0",
+  "version": "0.4.1",
   "description": "CLI-first infrastructure intelligence platform — analyzes DynamoDB, PostgreSQL, MySQL, MongoDB, SQS, SNS, SSM, Secrets Manager, Lambda, CloudWatch Logs and exposes findings as an MCP server for Claude Code",
   "keywords": [
     "infrastructure",