cloudg 0.3.0__tar.gz → 0.3.1__tar.gz

{cloudg-0.3.0 → cloudg-0.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: cloudg
-Version: 0.3.0
+Version: 0.3.1
 Summary: cloudg (cloud graphing) — multi-cloud infrastructure mapping, knowledge graphs and security intelligence for AWS, Azure and GCP
 Project-URL: Homepage, https://github.com/morpheuslord/cloudg
 Project-URL: Repository, https://github.com/morpheuslord/cloudg
@@ -75,7 +75,7 @@ Description-Content-Type: text/markdown
 <p align="center">
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-green.svg" alt="License: MIT"></a>
   <img src="https://img.shields.io/badge/python-3.11%2B-blue.svg" alt="Python 3.11+">
-  <img src="https://img.shields.io/badge/version-0.3.0-4c1.svg" alt="Version 0.3.0">
+  <img src="https://img.shields.io/badge/version-0.3.1-4c1.svg" alt="Version 0.3.1">
   <a href="https://github.com/astral-sh/uv"><img src="https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/uv/main/assets/badge/v0.json" alt="uv"></a>
 </p>
 
@@ -325,6 +325,3 @@ Python 3.11 or newer. The moto/aiobotocore incompatibility around async response
 
 ---
 
-## License
-
-MIT

{cloudg-0.3.0 → cloudg-0.3.1}/README.md

@@ -5,7 +5,7 @@
 <p align="center">
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-green.svg" alt="License: MIT"></a>
   <img src="https://img.shields.io/badge/python-3.11%2B-blue.svg" alt="Python 3.11+">
-  <img src="https://img.shields.io/badge/version-0.3.0-4c1.svg" alt="Version 0.3.0">
+  <img src="https://img.shields.io/badge/version-0.3.1-4c1.svg" alt="Version 0.3.1">
   <a href="https://github.com/astral-sh/uv"><img src="https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/uv/main/assets/badge/v0.json" alt="uv"></a>
 </p>
 
@@ -255,6 +255,3 @@ Python 3.11 or newer. The moto/aiobotocore incompatibility around async response
 
 ---
 
-## License
-
-MIT

{cloudg-0.3.0 → cloudg-0.3.1}/cloudg/__init__.py

@@ -1,6 +1,6 @@
 """cloudg — cloud graphing: multi-cloud mapping and security intelligence."""
 
-__version__ = "0.3.0"
+__version__ = "0.3.1"
 
 from cloudg.api import (
     AnalysisResult,

{cloudg-0.3.0 → cloudg-0.3.1}/cloudg/api.py

@@ -43,6 +43,34 @@ from cloudg.schema.models import (
 logger = logging.getLogger(__name__)
 
 
+def resolve_iac_dirs(
+    iac_dir: str | None,
+    config_dirs: list[str] | None,
+    terraform_dir: str | Path | None = None,
+) -> tuple[list[str], str | None]:
+    """Resolve which directories the IaC scanners (Checkov, Trivy fs) target.
+
+    Priority: explicit dir -> configured dirs -> the generated Terraform
+    recreation of the live infrastructure. There is deliberately no fallback
+    to "." any more: scanning whatever directory cloudg happens to run from
+    is not a scan of the cloud, and its zero findings read like a clean bill
+    of health.
+
+    Returns:
+        (dirs, source) where source is "cli", "config", "terraform", or
+        None when there is nothing for the IaC scanners to target.
+    """
+    if iac_dir:
+        return [iac_dir], "cli"
+    if config_dirs:
+        return list(config_dirs), "config"
+    if terraform_dir:
+        tf_path = Path(terraform_dir)
+        if tf_path.is_dir() and any(tf_path.glob("*.tf.json")):
+            return [str(tf_path)], "terraform"
+    return [], None
+
+
 # ---------------------------------------------------------------------------
 # Result dataclasses
 # ---------------------------------------------------------------------------
@@ -285,14 +313,37 @@ class CloudGEngine:
             logger.error("Graph analysis failed: %s", exc)
             self._emit_error("graph_analysis", exc)
 
-        # Resolve IaC directories
-        resolved_iac_dirs: list[str] = []
-        if iac_dir:
-            resolved_iac_dirs = [iac_dir]
-        elif self.config.scanners.iac_directories:
-            resolved_iac_dirs = list(self.config.scanners.iac_directories)
-        else:
-            resolved_iac_dirs = ["."]
+        # Resolve IaC directories. When nothing is configured but Terraform
+        # recreation is enabled, generate it now and scan that: the IaC
+        # scanners then audit the live infrastructure via its Terraform
+        # representation instead of an unrelated local directory.
+        tf_dir: str | None = None
+        if (
+            not iac_dir
+            and not self.config.scanners.iac_directories
+            and self.config.terraform.enabled
+        ):
+            tf_dir = self.config.terraform.output_dir or str(out / "terraform")
+            try:
+                from cloudg.renderers.terraform_export import TerraformExporter
+
+                TerraformExporter(output_dir=tf_dir).export(assets, edges)
+            except Exception as exc:
+                logger.error("Terraform export for IaC scanning failed: %s", exc)
+                self._emit_error("terraform", exc)
+                tf_dir = None
+
+        resolved_iac_dirs, iac_source = resolve_iac_dirs(
+            iac_dir, self.config.scanners.iac_directories, tf_dir
+        )
+        if iac_source == "terraform":
+            logger.info("IaC scanners target the Terraform recreation at %s", resolved_iac_dirs[0])
+        elif not resolved_iac_dirs and "checkov" in scanner_list:
+            logger.warning(
+                "Skipping Checkov: no IaC directory configured. "
+                "Pass iac_dir, set scanners.iac_directories, or enable terraform "
+                "so the recreated infrastructure can be scanned."
+            )
 
         # Resolve images
         resolved_images: list[str] = images or list(self.config.scanners.trivy_images)

{cloudg-0.3.0 → cloudg-0.3.1}/cloudg/cli.py

@@ -567,15 +567,6 @@ def run(
     if "gcp" in cfg.providers:
         console.print(f"[bold]GCP regions:[/] {cfg.gcp.regions}")
 
-    # ── Resolve IaC directories: CLI flag → config → default "." ──
-    resolved_iac_dirs: list[str] = []
-    if iac_dir:
-        resolved_iac_dirs = [iac_dir]
-    elif cfg.scanners.iac_directories:
-        resolved_iac_dirs = list(cfg.scanners.iac_directories)
-    else:
-        resolved_iac_dirs = ["."]
-
     # ── Resolve container images: CLI flag → config ──
     resolved_images: list[str] = []
     if images:
@@ -653,6 +644,7 @@ def run(
             console.print(f"  [red]✗ RAG export failed: {exc}[/]")
 
     # Phase 2d: Terraform Recreation
+    tf_dir: str | None = None
     if terraform or cfg.terraform.enabled:
         console.print("\n[bold]Phase 2d: Terraform Recreation[/]")
         try:
@@ -673,6 +665,7 @@ def run(
             console.print(f"  [green]✓ Import: {tf_paths['import_commands']}[/]")
         except Exception as exc:
             console.print(f"  [red]✗ Terraform export failed: {exc}[/]")
+            tf_dir = None
 
     import concurrent.futures
 
@@ -680,6 +673,18 @@ def run(
     console.print("\n[bold]Phase 3: Security Scanning[/bold] (Running in parallel)")
     scanner_findings: list[Any] = []
 
+    # ── Resolve IaC scan targets: CLI flag → config → Terraform recreation ──
+    # No fallback to "." — scanning the directory cloudg runs from is not a
+    # scan of the cloud, and its zero findings look like a clean result.
+    from cloudg.api import resolve_iac_dirs
+
+    resolved_iac_dirs, iac_source = resolve_iac_dirs(iac_dir, cfg.scanners.iac_directories, tf_dir)
+    if iac_source == "terraform":
+        console.print(
+            "  [dim]IaC scanners target the Terraform recreation of the live "
+            f"infrastructure ({resolved_iac_dirs[0]})[/dim]"
+        )
+
     def run_prowler(prov: str) -> list[Any]:
         from cloudg.scanners.prowler import ProwlerScanner
 
@@ -780,24 +785,36 @@ def run(
         else:
             console.print("  [dim]⊘ ScoutSuite: not enabled[/dim]")
 
-        # Checkov — always runs against resolved IaC directories
+        # Checkov — runs against resolved IaC directories
         if "checkov" in scanner_list:
-            for d in resolved_iac_dirs:
-                future_to_scanner[executor.submit(run_checkov, d)] = f"Checkov ({d})"
+            if resolved_iac_dirs:
+                for d in resolved_iac_dirs:
+                    future_to_scanner[executor.submit(run_checkov, d)] = f"Checkov ({d})"
+            else:
+                console.print(
+                    "  [yellow]⊘ Checkov: nothing to scan — pass --iac-dir, set "
+                    "scanners.iac_directories, or enable --terraform to scan the "
+                    "recreated infrastructure[/yellow]"
+                )
         else:
             console.print("  [dim]⊘ Checkov: not enabled[/dim]")
 
-        # Trivy — runs against container images if available, otherwise falls back to filesystem scan
+        # Trivy — scans container images if configured, else the IaC targets
         if "trivy" in scanner_list:
             if resolved_images:
                 future_to_scanner[executor.submit(run_trivy, resolved_images)] = "Trivy (images)"
-            else:
+            elif resolved_iac_dirs:
                 console.print(
                     "  [yellow]⊘ Trivy: no images configured, falling back to filesystem scan[/yellow]"
                 )
                 future_to_scanner[executor.submit(run_trivy_fs, resolved_iac_dirs)] = (
                     "Trivy (filesystem)"
                 )
+            else:
+                console.print(
+                    "  [yellow]⊘ Trivy: nothing to scan — configure --images, "
+                    "--iac-dir, or enable --terraform[/yellow]"
+                )
         else:
             console.print("  [dim]⊘ Trivy: not enabled[/dim]")
 

{cloudg-0.3.0 → cloudg-0.3.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "cloudg"
-version = "0.3.0"
+version = "0.3.1"
 description = "cloudg (cloud graphing) — multi-cloud infrastructure mapping, knowledge graphs and security intelligence for AWS, Azure and GCP"
 readme = "README.md"
 license = { text = "MIT" }

{cloudg-0.3.0 → cloudg-0.3.1}/tests/test_scanner_orchestration.py

@@ -252,3 +252,43 @@ class TestIaCDirResolution:
             resolved = ["."]
 
         assert resolved == ["."]
+
+
+class TestResolveIacDirs:
+    """IaC target resolution: CLI dir -> config dirs -> terraform recreation, never '.'."""
+
+    def test_cli_dir_wins(self, tmp_path):
+        from cloudg.api import resolve_iac_dirs
+
+        dirs, source = resolve_iac_dirs("./infra", ["./other"], str(tmp_path))
+        assert dirs == ["./infra"]
+        assert source == "cli"
+
+    def test_config_dirs_used_when_no_cli_dir(self):
+        from cloudg.api import resolve_iac_dirs
+
+        dirs, source = resolve_iac_dirs(None, ["./a", "./b"], None)
+        assert dirs == ["./a", "./b"]
+        assert source == "config"
+
+    def test_terraform_recreation_used_as_fallback(self, tmp_path):
+        from cloudg.api import resolve_iac_dirs
+
+        (tmp_path / "main.tf.json").write_text("{}")
+        dirs, source = resolve_iac_dirs(None, [], tmp_path)
+        assert dirs == [str(tmp_path)]
+        assert source == "terraform"
+
+    def test_terraform_dir_without_tf_json_is_ignored(self, tmp_path):
+        from cloudg.api import resolve_iac_dirs
+
+        dirs, source = resolve_iac_dirs(None, [], tmp_path)
+        assert dirs == []
+        assert source is None
+
+    def test_no_targets_means_skip_not_cwd(self):
+        from cloudg.api import resolve_iac_dirs
+
+        dirs, source = resolve_iac_dirs(None, [], None)
+        assert dirs == []
+        assert source is None