infrawise 0.4.0 → 0.4.2

package/README.md

@@ -160,6 +160,41 @@ To let Claude Code manage the server lifecycle automatically:
 
 ---
 
+## GitHub Action
+
+Add infrastructure analysis to any PR workflow. No `infrawise.yaml` required — the action auto-generates one from your AWS credentials.
+
+```yaml
+# .github/workflows/infrawise.yml
+name: Infrawise
+on: [pull_request]
+
+jobs:
+  analyze:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: Sidd27/infrawise@v0
+        with:
+          fail-on: high        # fail the PR on high severity findings (default)
+        env:
+          AWS_ACCESS_KEY_ID:     ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          AWS_REGION:            ${{ secrets.AWS_REGION }}
+```
+
+If `infrawise.yaml` is not present in the repo, the action generates a minimal config with DynamoDB, Lambda, SQS, SNS, SSM, Secrets Manager, and RDS enabled — using `AWS_REGION` from the environment. Add an `infrawise.yaml` to your repo to customize which services to include or to add database connections.
+
+Findings appear as annotations on the PR diff and in the job summary.
+
+| Input | Default | Description |
+|---|---|---|
+| `version` | `latest` | infrawise version to install |
+| `fail-on` | `high` | Exit code 1 if findings at or above this severity (`high`, `medium`, `low`, `never`) |
+| `config` | `infrawise.yaml` | Path to config file — auto-generated if not present |
+
+---
+
 ## CLI reference
 
 | Command | What it does |
@@ -176,6 +211,16 @@ To let Claude Code manage the server lifecycle automatically:
 
 `infrawise.yaml` is generated by `infrawise init` and lives in your repo root. Every service must be explicitly `enabled: true` — infrawise never connects to anything not listed in config.
 
+Connection strings support `${ENV_VAR}` substitution so passwords never need to be committed:
+
+```yaml
+postgres:
+  enabled: true
+  connectionString: postgresql://infrawise_ro:${DB_PASSWORD}@host:5432/mydb
+```
+
+Full example:
+
 ```yaml
 project: payments-service
 
@@ -191,7 +236,7 @@ dynamodb:
 
 postgres:
   enabled: true
-  connectionString: postgresql://infrawise_ro:password@host:5432/mydb
+  connectionString: postgresql://infrawise_ro:${DB_PASSWORD}@host:5432/mydb
 
 mysql:
   enabled: false
@@ -466,7 +511,8 @@ pnpm release minor    # 0.1.2 → 0.2.0  (new features, backwards compatible)
 pnpm release major    # 0.1.2 → 1.0.0  (breaking changes)
 pnpm release 1.5.0    # explicit version
 
-git push origin main --tags
+git push origin main v1.2.3
+git push origin v1 --force   # update the floating major tag
 ```
 
 Pushing a `v*.*.*` tag creates a draft GitHub release. Publishing that release triggers npm publish automatically.

package/dist/cli/commands/analyze.js

@@ -37,6 +37,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.runAnalyze = runAnalyze;
+const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const chalk_1 = __importDefault(require("chalk"));
 const ora_1 = __importDefault(require("ora"));
@@ -52,16 +53,72 @@ const context_1 = require("../../context");
 const graph_1 = require("../../graph");
 const analyzers_1 = require("../../analyzers");
 const utils_1 = require("../utils");
+const SEVERITY_RANK = { high: 3, medium: 2, low: 1, never: 0 };
+function mkSpinner(text, ci) {
+    if (ci) {
+        return {
+            succeed: (msg) => console.log(`  ✓ ${msg}`),
+            warn: (msg) => console.log(`  ⚠ ${msg}`),
+        };
+    }
+    return (0, ora_1.default)({ text: chalk_1.default.dim(text), color: 'cyan' }).start();
+}
+function emitCIOutput(findings, failOn) {
+    for (const f of findings) {
+        const level = f.severity === 'high' ? 'error' : f.severity === 'medium' ? 'warning' : 'notice';
+        console.log(`::${level} title=Infrawise [${f.severity.toUpperCase()}]::${f.issue} — ${f.description}`);
+    }
+    const summaryPath = process.env['GITHUB_STEP_SUMMARY'];
+    if (summaryPath) {
+        const high = findings.filter((f) => f.severity === 'high').length;
+        const medium = findings.filter((f) => f.severity === 'medium').length;
+        const low = findings.filter((f) => f.severity === 'low').length;
+        const rows = findings.map((f) => {
+            const icon = f.severity === 'high' ? '🔴' : f.severity === 'medium' ? '🟡' : '🔵';
+            return `| ${icon} ${f.severity.toUpperCase()} | ${f.issue} | ${f.recommendation} |`;
+        }).join('\n');
+        const summary = findings.length === 0
+            ? '## ✅ Infrawise — no issues found\n'
+            : [
+                '## Infrawise Analysis',
+                '',
+                `**${high} high · ${medium} medium · ${low} low**`,
+                '',
+                '| Severity | Issue | Recommendation |',
+                '|---|---|---|',
+                rows,
+            ].join('\n');
+        fs.appendFileSync(summaryPath, summary + '\n');
+    }
+    const threshold = SEVERITY_RANK[failOn] ?? 3;
+    const maxFound = Math.max(0, ...findings.map((f) => SEVERITY_RANK[f.severity] ?? 0));
+    if (maxFound >= threshold && threshold > 0) {
+        process.exit(1);
+    }
+}
 async function runAnalyze(options = {}) {
-    (0, utils_1.printHeader)('Running Analysis');
+    const ci = options.ci ?? false;
+    const failOn = options.failOn ?? 'high';
+    if (!ci)
+        (0, utils_1.printHeader)('Running Analysis');
     let config;
+    let isFallback = false;
     try {
         config = (0, core_1.loadConfig)(options.config);
-        utils_1.log.success('Config loaded', options.config ?? 'infrawise.yaml');
+        if (!ci)
+            utils_1.log.success('Config loaded', options.config ?? 'infrawise.yaml');
     }
     catch (err) {
-        console.error((0, core_1.formatError)(err));
-        process.exit(1);
+        const isNotFound = err instanceof Error && err.message.includes('not found at');
+        if (ci && isNotFound) {
+            config = { project: path.basename(process.cwd()) };
+            isFallback = true;
+            console.log('  ✓ No infrawise.yaml — running code-only analysis (repo scan + IaC)');
+        }
+        else {
+            console.error((0, core_1.formatError)(err));
+            process.exit(1);
+        }
     }
     const repoPath = options.repo ?? process.cwd();
     const awsCfg = { region: config.aws?.region, profile: config.aws?.profile, endpoint: config.aws?.endpoint };
@@ -72,127 +129,127 @@ async function runAnalyze(options = {}) {
     const servicesMeta = {};
     // ── DynamoDB ────────────────────────────────────────────────────────────────
     if (config.dynamodb?.enabled === true) {
-        const spin = (0, ora_1.default)({ text: chalk_1.default.dim('Extracting DynamoDB tables...'), color: 'cyan' }).start();
+        const s = mkSpinner('Extracting DynamoDB tables...', ci);
         try {
             const result = await (0, dynamodb_1.extractDynamoMetadata)(config);
             dynamoMeta.push(...result);
-            spin.succeed(chalk_1.default.green('DynamoDB') + chalk_1.default.dim(`  ${result.length} table(s)`));
+            s.succeed(chalk_1.default.green('DynamoDB') + chalk_1.default.dim(`  ${result.length} table(s)`));
         }
         catch (err) {
-            spin.warn(chalk_1.default.yellow('DynamoDB skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+            s.warn(chalk_1.default.yellow('DynamoDB skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
         }
     }
     // ── PostgreSQL ──────────────────────────────────────────────────────────────
     if (config.postgres?.enabled && config.postgres.connectionString) {
-        const spin = (0, ora_1.default)({ text: chalk_1.default.dim('Extracting PostgreSQL schema...'), color: 'cyan' }).start();
+        const s = mkSpinner('Extracting PostgreSQL schema...', ci);
         try {
             const result = await (0, postgres_1.extractPostgresMetadata)(config.postgres.connectionString);
             postgresMeta.push(...result);
-            spin.succeed(chalk_1.default.green('PostgreSQL') + chalk_1.default.dim(`  ${result.length} table(s)`));
+            s.succeed(chalk_1.default.green('PostgreSQL') + chalk_1.default.dim(`  ${result.length} table(s)`));
         }
         catch (err) {
-            spin.warn(chalk_1.default.yellow('PostgreSQL skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+            s.warn(chalk_1.default.yellow('PostgreSQL skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
         }
     }
     // ── MySQL ───────────────────────────────────────────────────────────────────
     if (config.mysql?.enabled && config.mysql.connectionString) {
-        const spin = (0, ora_1.default)({ text: chalk_1.default.dim('Extracting MySQL schema...'), color: 'cyan' }).start();
+        const s = mkSpinner('Extracting MySQL schema...', ci);
         try {
             const result = await (0, mysql_1.extractMySQLMetadata)(config.mysql.connectionString);
             mysqlMeta.push(...result);
-            spin.succeed(chalk_1.default.green('MySQL') + chalk_1.default.dim(`  ${result.length} table(s)`));
+            s.succeed(chalk_1.default.green('MySQL') + chalk_1.default.dim(`  ${result.length} table(s)`));
         }
         catch (err) {
-            spin.warn(chalk_1.default.yellow('MySQL skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+            s.warn(chalk_1.default.yellow('MySQL skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
         }
     }
     // ── MongoDB ─────────────────────────────────────────────────────────────────
     if (config.mongodb?.enabled && config.mongodb.connectionString) {
-        const spin = (0, ora_1.default)({ text: chalk_1.default.dim('Extracting MongoDB schema...'), color: 'cyan' }).start();
+        const s = mkSpinner('Extracting MongoDB schema...', ci);
         try {
             const result = await (0, mongodb_1.extractMongoMetadata)(config.mongodb.connectionString, config.mongodb.databases);
             mongoMeta.push(...result);
-            spin.succeed(chalk_1.default.green('MongoDB') + chalk_1.default.dim(`  ${result.length} collection(s)`));
+            s.succeed(chalk_1.default.green('MongoDB') + chalk_1.default.dim(`  ${result.length} collection(s)`));
         }
         catch (err) {
-            spin.warn(chalk_1.default.yellow('MongoDB skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+            s.warn(chalk_1.default.yellow('MongoDB skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
         }
     }
     // ── SQS ─────────────────────────────────────────────────────────────────────
     if (config.sqs?.enabled === true) {
-        const spin = (0, ora_1.default)({ text: chalk_1.default.dim('Extracting SQS queues...'), color: 'cyan' }).start();
+        const s = mkSpinner('Extracting SQS queues...', ci);
         try {
             const result = await (0, aws_1.extractSQSMetadata)(awsCfg);
             servicesMeta.sqs = result;
-            spin.succeed(chalk_1.default.green('SQS') + chalk_1.default.dim(`  ${result.length} queue(s)`));
+            s.succeed(chalk_1.default.green('SQS') + chalk_1.default.dim(`  ${result.length} queue(s)`));
         }
         catch (err) {
-            spin.warn(chalk_1.default.yellow('SQS skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+            s.warn(chalk_1.default.yellow('SQS skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
         }
     }
     // ── SNS ─────────────────────────────────────────────────────────────────────
     if (config.sns?.enabled === true) {
-        const spin = (0, ora_1.default)({ text: chalk_1.default.dim('Extracting SNS topics...'), color: 'cyan' }).start();
+        const s = mkSpinner('Extracting SNS topics...', ci);
         try {
             const result = await (0, aws_1.extractSNSMetadata)(awsCfg);
             servicesMeta.sns = result;
-            spin.succeed(chalk_1.default.green('SNS') + chalk_1.default.dim(`  ${result.length} topic(s)`));
+            s.succeed(chalk_1.default.green('SNS') + chalk_1.default.dim(`  ${result.length} topic(s)`));
         }
         catch (err) {
-            spin.warn(chalk_1.default.yellow('SNS skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+            s.warn(chalk_1.default.yellow('SNS skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
         }
     }
     // ── SSM Parameter Store ──────────────────────────────────────────────────────
     if (config.ssm?.enabled === true) {
-        const spin = (0, ora_1.default)({ text: chalk_1.default.dim('Extracting SSM parameters...'), color: 'cyan' }).start();
+        const s = mkSpinner('Extracting SSM parameters...', ci);
         try {
             const result = await (0, aws_1.extractSSMMetadata)({ ...awsCfg, paths: config.ssm?.paths });
             servicesMeta.ssm = result;
-            spin.succeed(chalk_1.default.green('SSM') + chalk_1.default.dim(`  ${result.length} parameter(s)  `) + chalk_1.default.dim('(metadata only, no values)'));
+            s.succeed(chalk_1.default.green('SSM') + chalk_1.default.dim(`  ${result.length} parameter(s)  `) + chalk_1.default.dim('(metadata only, no values)'));
         }
         catch (err) {
-            spin.warn(chalk_1.default.yellow('SSM skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+            s.warn(chalk_1.default.yellow('SSM skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
         }
     }
     // ── Secrets Manager ──────────────────────────────────────────────────────────
     if (config.secretsManager?.enabled === true) {
-        const spin = (0, ora_1.default)({ text: chalk_1.default.dim('Extracting Secrets Manager metadata...'), color: 'cyan' }).start();
+        const s = mkSpinner('Extracting Secrets Manager metadata...', ci);
         try {
             const result = await (0, aws_1.extractSecretsMetadata)(awsCfg);
             servicesMeta.secrets = result;
-            spin.succeed(chalk_1.default.green('Secrets Manager') + chalk_1.default.dim(`  ${result.length} secret(s)  `) + chalk_1.default.dim('(names/rotation only, no values)'));
+            s.succeed(chalk_1.default.green('Secrets Manager') + chalk_1.default.dim(`  ${result.length} secret(s)  `) + chalk_1.default.dim('(names/rotation only, no values)'));
         }
         catch (err) {
-            spin.warn(chalk_1.default.yellow('Secrets Manager skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+            s.warn(chalk_1.default.yellow('Secrets Manager skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
         }
     }
     // ── Lambda ───────────────────────────────────────────────────────────────────
     if (config.lambda?.enabled === true) {
-        const spin = (0, ora_1.default)({ text: chalk_1.default.dim('Extracting Lambda functions...'), color: 'cyan' }).start();
+        const s = mkSpinner('Extracting Lambda functions...', ci);
         try {
             const result = await (0, aws_1.extractLambdaMetadata)(awsCfg);
             servicesMeta.lambda = result;
-            spin.succeed(chalk_1.default.green('Lambda') + chalk_1.default.dim(`  ${result.length} function(s)`));
+            s.succeed(chalk_1.default.green('Lambda') + chalk_1.default.dim(`  ${result.length} function(s)`));
         }
         catch (err) {
-            spin.warn(chalk_1.default.yellow('Lambda skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+            s.warn(chalk_1.default.yellow('Lambda skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
         }
     }
     // ── RDS ──────────────────────────────────────────────────────────────────────
     if (config.rds?.enabled === true) {
-        const spin = (0, ora_1.default)({ text: chalk_1.default.dim('Extracting RDS instances...'), color: 'cyan' }).start();
+        const s = mkSpinner('Extracting RDS instances...', ci);
         try {
             const result = await (0, aws_1.extractRDSMetadata)(awsCfg);
             servicesMeta.rds = result;
-            spin.succeed(chalk_1.default.green('RDS') + chalk_1.default.dim(`  ${result.length} instance(s)`));
+            s.succeed(chalk_1.default.green('RDS') + chalk_1.default.dim(`  ${result.length} instance(s)`));
         }
         catch (err) {
-            spin.warn(chalk_1.default.yellow('RDS skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+            s.warn(chalk_1.default.yellow('RDS skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
         }
     }
     // ── CloudWatch Logs ──────────────────────────────────────────────────────────
     if (config.cloudwatchLogs?.enabled) {
-        const spin = (0, ora_1.default)({ text: chalk_1.default.dim('Sampling CloudWatch Logs (errors only, max 50 groups)...'), color: 'cyan' }).start();
+        const s = mkSpinner('Sampling CloudWatch Logs (errors only, max 50 groups)...', ci);
         try {
             const result = await (0, logs_1.extractLogsMetadata)({
                 ...awsCfg,
@@ -201,16 +258,16 @@ async function runAnalyze(options = {}) {
             });
             servicesMeta.logs = result;
             const errorGroups = result.filter((lg) => lg.errorCount > 0).length;
-            spin.succeed(chalk_1.default.green('CloudWatch Logs') + chalk_1.default.dim(`  ${result.length} group(s), ${errorGroups} with errors`));
+            s.succeed(chalk_1.default.green('CloudWatch Logs') + chalk_1.default.dim(`  ${result.length} group(s), ${errorGroups} with errors`));
         }
         catch (err) {
-            spin.warn(chalk_1.default.yellow('CloudWatch Logs skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+            s.warn(chalk_1.default.yellow('CloudWatch Logs skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
         }
     }
     // ── IaC schema (Terraform / CloudFormation / CDK) ────────────────────────────
     let iacDriftAnalyzer;
     {
-        const spin = (0, ora_1.default)({ text: chalk_1.default.dim('Extracting IaC schema (Terraform / CloudFormation / CDK)...'), color: 'cyan' }).start();
+        const s = mkSpinner('Extracting IaC schema (Terraform / CloudFormation / CDK)...', ci);
         try {
             const iacSchema = await (0, terraform_1.extractIaCSchema)(repoPath);
             const total = iacSchema.dynamoTables.length + iacSchema.rdsInstances.length +
@@ -219,52 +276,52 @@ async function runAnalyze(options = {}) {
                 iacSchema.secrets.length + iacSchema.apiGateways.length;
             iacDriftAnalyzer = new analyzers_1.IaCDriftAnalyzer();
             iacDriftAnalyzer.setIaCSchema(iacSchema);
-            spin.succeed(chalk_1.default.green('IaC schema') + chalk_1.default.dim(`  ${total} resource(s) across TF/CFN/CDK`));
+            s.succeed(chalk_1.default.green('IaC schema') + chalk_1.default.dim(`  ${total} resource(s) across TF/CFN/CDK`));
         }
         catch (err) {
-            spin.warn(chalk_1.default.yellow('IaC scan skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+            s.warn(chalk_1.default.yellow('IaC scan skipped') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
         }
     }
     // ── Repository scan ──────────────────────────────────────────────────────────
     let operations;
     {
-        const spin = (0, ora_1.default)({ text: chalk_1.default.dim(`Scanning ${path.basename(repoPath)} for service usage...`), color: 'cyan' }).start();
+        const s = mkSpinner(`Scanning ${path.basename(repoPath)} for service usage...`, ci);
         try {
             operations = await (0, context_1.scanRepository)(repoPath);
-            spin.succeed(chalk_1.default.green('Repository scanned') + chalk_1.default.dim(`  ${operations.length} service operation(s) found`));
+            s.succeed(chalk_1.default.green('Repository scanned') + chalk_1.default.dim(`  ${operations.length} service operation(s) found`));
         }
         catch (err) {
-            spin.warn(chalk_1.default.yellow('Repository scan failed') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+            s.warn(chalk_1.default.yellow('Repository scan failed') + chalk_1.default.dim(`  ${err instanceof Error ? err.message : String(err)}`));
             operations = [];
         }
     }
     // ── Build graph ──────────────────────────────────────────────────────────────
     let graph;
     {
-        const spin = (0, ora_1.default)({ text: chalk_1.default.dim('Building infrastructure graph...'), color: 'cyan' }).start();
+        const s = mkSpinner('Building infrastructure graph...', ci);
         graph = (0, graph_1.buildGraph)(operations, dynamoMeta, postgresMeta, mysqlMeta, mongoMeta, servicesMeta);
-        spin.succeed(chalk_1.default.green('Graph built') + chalk_1.default.dim(`  ${graph.nodes.length} nodes, ${graph.edges.length} edges`));
+        s.succeed(chalk_1.default.green('Graph built') + chalk_1.default.dim(`  ${graph.nodes.length} nodes, ${graph.edges.length} edges`));
     }
     // ── Run analyzers ────────────────────────────────────────────────────────────
     let findings;
     {
-        const spin = (0, ora_1.default)({ text: chalk_1.default.dim('Running analyzers...'), color: 'cyan' }).start();
+        const s = mkSpinner('Running analyzers...', ci);
         const analyzers = [
-            ...(config.dynamodb?.enabled === true ? [
+            ...(config.dynamodb?.enabled === true || isFallback ? [
                 new analyzers_1.FullTableScanAnalyzer(),
                 new analyzers_1.MissingGSIAnalyzer(),
                 new analyzers_1.HotPartitionAnalyzer(),
             ] : []),
-            ...(config.postgres?.enabled ? [
+            ...(config.postgres?.enabled || isFallback ? [
                 new analyzers_1.MissingIndexAnalyzer(),
                 new analyzers_1.NplusOneAnalyzer(),
                 new analyzers_1.LargeSelectAnalyzer(),
             ] : []),
-            ...(config.mysql?.enabled ? [
+            ...(config.mysql?.enabled || isFallback ? [
                 new analyzers_1.MissingMySQLIndexAnalyzer(),
                 new analyzers_1.MySQLFullTableScanAnalyzer(),
             ] : []),
-            ...(config.mongodb?.enabled ? [
+            ...(config.mongodb?.enabled || isFallback ? [
                 new analyzers_1.MissingMongoIndexAnalyzer(),
                 new analyzers_1.MongoCollectionScanAnalyzer(),
             ] : []),
@@ -293,13 +350,17 @@ async function runAnalyze(options = {}) {
             ...(iacDriftAnalyzer ? [iacDriftAnalyzer] : []),
         ];
         findings = await (0, analyzers_1.runAllAnalyzers)(graph, analyzers);
-        spin.succeed(chalk_1.default.green('Analysis complete') + chalk_1.default.dim(`  ${findings.length} finding(s)`));
+        s.succeed(chalk_1.default.green('Analysis complete') + chalk_1.default.dim(`  ${findings.length} finding(s)`));
     }
     // ── Cache ─────────────────────────────────────────────────────────────────────
     (0, core_1.writeCache)('graph', graph);
     (0, core_1.writeCache)('findings', findings);
     (0, core_1.writeCache)('operations', operations);
     // ── Output ────────────────────────────────────────────────────────────────────
+    if (ci) {
+        emitCIOutput(findings, failOn);
+        return;
+    }
     console.log('');
     if (findings.length === 0) {
         console.log(`  ${chalk_1.default.green.bold('✓ No issues found!')}  ${chalk_1.default.dim('Your infrastructure looks clean.')}`);

package/dist/cli/index.js

@@ -37,12 +37,17 @@ program
     .option('-c, --config <path>', 'Path to infrawise.yaml', 'infrawise.yaml')
     .option('-r, --repo <path>', 'Path to repository to scan', process.cwd())
     .option('--no-cache', 'Skip reading/writing the cache')
+    .option('--ci', 'CI mode: GitHub annotations output, job summary, exit code on findings')
+    .option('--fail-on <severity>', 'Exit 1 if findings at or above this severity (high|medium|low|never)', 'high')
     .action(async (options) => {
-    (0, utils_1.printBanner)();
+    if (!options.ci)
+        (0, utils_1.printBanner)();
     await (0, analyze_1.runAnalyze)({
         config: options.config !== 'infrawise.yaml' ? options.config : undefined,
         repo: options.repo,
         noCache: !options.cache,
+        ci: options.ci ?? false,
+        failOn: options.failOn ?? 'high',
     });
 });
 program

package/dist/core/config.js

@@ -109,6 +109,11 @@ function loadConfig(configPath) {
     catch (err) {
         throw new ConfigError(`Unable to read configuration file: ${resolvedPath}`, [String(err)]);
     }
+    // Expand ${ENV_VAR} references — lets users store secrets in env, not in the YAML file
+    rawContent = rawContent.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g, (match, name) => {
+        const val = process.env[name];
+        return val !== undefined ? val : match;
+    });
     let parsedYaml;
     try {
         parsedYaml = yaml.load(rawContent);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "infrawise",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "description": "CLI-first infrastructure intelligence platform — analyzes DynamoDB, PostgreSQL, MySQL, MongoDB, SQS, SNS, SSM, Secrets Manager, Lambda, CloudWatch Logs and exposes findings as an MCP server for Claude Code",
   "keywords": [
     "infrastructure",