codeaudit 1.7.1__tar.gz → 1.8.0__tar.gz

{codeaudit-1.7.1 → codeaudit-1.8.0}/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Change Log
 
+## Version 1.8.0:
+
+
+**Added**
+
+* **Security Checks:** Added checks for `importlib.util.spec_from_file_location` and `importlib.util.module_from_spec` to mitigate recent CVE-2026-40156 vulnerabilities.
+* **Configuration:** Added `[tool.pytest]` section to `pyproject.toml`.
+
+**Changed**
+
+* **CLD Output for checks overview:** Sorted the `codeaudit` checks output now alphabetically by `Name`.
+* **Security:** Updated the secret list used for egress detection.
+
+**Fixed**
+
+* **Configuration:** Added the missing `homepage` field under `[project.urls]` in `pyproject.toml`.
+
+**Documentation**
+
+* **CLI Help:** Added help documentation for the CI command (`cimode`). *Big thanks to @jurgenwigg for [pull request #25](https://github.com/nocomplexity/codeaudit/pull/25)!*
+
 ## Version 1.7.1:
 
 

{codeaudit-1.7.1 → codeaudit-1.8.0}/PKG-INFO

@@ -1,7 +1,8 @@
 Metadata-Version: 2.4
 Name: codeaudit
-Version: 1.7.1
+Version: 1.8.0
 Summary: A modern Python security source code analyzer (SAST) based on distrust.
+Project-URL: Homepage, https://codeaudit.nocomplexity.com
 Project-URL: Documentation, https://github.com/nocomplexity/codeaudit#readme
 Project-URL: Issues, https://github.com/nocomplexity/codeaudit/issues
 Project-URL: Source, https://github.com/nocomplexity/codeaudit
@@ -51,9 +52,10 @@ Python Code Audit is a static application security testing (SAST) tool designed
 This tool is designed for anyone who uses or creates Python programs and wants to understand and mitigate potential security risks.
 
 This tool is created for:
-* Python Users who want to assess the security risks in the Python code they use.
-* Python Developers: Anyone, from professionals to hobbyists, who wants to deliver secure Python code.
-* Security-Conscious Users: People seeking a simple, fast way to gain insight into potential security vulnerabilities within Python packages or files.
+
+- Python Users who want to assess the security risks in the Python code they use.
+- Python Developers: Anyone, from professionals to hobbyists, who wants to deliver secure Python code.
+- Security-Conscious Users: People seeking a simple, fast way to gain insight into potential security vulnerabilities within Python packages or files.
 
 Creating secure software can be challenging. This tool, with its comprehensive [documentation](https://nocomplexity.com/documents/codeaudit/intro.html), acts as your helpful security colleague, making it easier to identify and address vulnerabilities.
 
@@ -61,32 +63,28 @@ Creating secure software can be challenging. This tool, with its comprehensive [
 
 Python Code Audit has the following features:
 
-* **Vulnerability Detection**: Identifies security vulnerabilities in Python files, essential for package security research.
-
-* **Complexity & Statistics**: Reports security-relevant complexity using a fast, lightweight [cyclomatic complexity](https://en.wikipedia.org/wiki/Cyclomatic_complexity) count via Python's AST.
-
-* **Module Usage & External Vulnerabilities**: Detects used modules and reports known vulnerabilities for used external modules.
-
-* **Inline Issue Reporting**: Shows potential security issues with line numbers and code snippets.
+- **Vulnerability Detection**: Identifies security vulnerabilities in Python files, essential for package security research.
 
+- **Complexity & Statistics**: Reports security-relevant complexity using a fast, lightweight [cyclomatic complexity](https://en.wikipedia.org/wiki/Cyclomatic_complexity) count via Python's AST.
 
-* **External Egress Detection**: Identifies embedded API keys and logic that enables communication with remote services, helping uncover hidden data exfiltration paths.
+- **Module Usage & External Vulnerabilities**: Detects used modules and reports known vulnerabilities for used external modules.
 
-* **CI/CD Ready:** Integrates seamlessly into any CI/CD workflow.
+- **Inline Issue Reporting**: Shows potential security issues with line numbers and code snippets.
 
-* **HTML Reports**: All output is saved in simple, static HTML reports viewable in any browser.
+- **External Egress Detection**: Identifies embedded API keys and logic that enables communication with remote services, helping uncover hidden data exfiltration paths.
 
+- **CI/CD Ready:** Integrates seamlessly into any CI/CD workflow.
 
+- **HTML Reports**: All output is saved in simple, static HTML reports viewable in any browser.
 
 > [!NOTE]
 > Python Code Audit uses the Python's Abstract Syntax Tree (AST) to get robust and reliable result. Using the Python AST makes contextual Vulnerability Detection possible and false positive are minimized.
 
-
 ## Installation
 
 > [!TIP]
 > Try it instantly—no installs, no setup, no excuses.
-> 
+>
 > 👉 Launch the browser version [here](https://nocomplexity.com/codeauditapp/dashboardapp.html)
 
 It runs 100% locally in your browser using WebAssembly (WASM). See the power of the tool in under 60 seconds.
@@ -98,12 +96,8 @@ Loved the browser version? Unlock the full power. For advanced security code ins
 pip install -U codeaudit
 ```
 
-
-
-
 If you have installed **Python Code Audit** previously and want to ensure you are using the latest validations and features, simply run this command again. Python Code Audit is frequently updated with new checks.
 
-
 ## Usage
 
 After installation you can get an overview of all implemented commands. Just type in your terminal:
@@ -116,7 +110,7 @@ This will show all commands:
 
 ```text
 ----------------------------------------------------
- _                    __             _             
+ _                    __             _
 |_) \/_|_|_  _ __    /   _  _| _    |_|    _| o _|_
 |   /  |_| |(_)| |   \__(_)(_|(/_   | ||_|(_| |  |_
 ----------------------------------------------------
@@ -125,13 +119,14 @@ Python Code Audit - A modern Python security source code analyzer based on distr
 
 
 Commands to evaluate Python source code:
-Usage: codeaudit COMMAND <directory|package>  [report.html] 
+Usage: codeaudit COMMAND <directory|package>  [report.html]
 
 Depending on the command, you must specify a local directory, a Python file, or a package name hosted on PyPI.org.Reporting: The results are generated as a static HTML report for viewing in a web browser.
 
 Commands:
   overview             Generates an overview report of code complexity and security indicators.
   filescan             Scans Python source code or PyPI packages for security weaknesses.
+  cimode               Run a SAST scan for CI workflows.
   modulescan           Generate a report on known vulnerabilities in Python modules and packages.
   checks               Creates an HTML report of all implemented security checks.
   version              Prints the module version. Or use codeaudit [-v] [--v] [-version] or [--version].
@@ -141,7 +136,7 @@ Use the Python Code Audit documentation (https://codeaudit.nocomplexity.com) to
 
 ## Example
 
-By running the `codeaudit filescan` command, detailed security information is determined for a Python file based on more than **80 validations** implemented. 
+By running the `codeaudit filescan` command, detailed security information is determined for a Python file based on more than **89 validations** implemented.
 
 The `codeaudit filescan` command shows all **potential** security issues that are detected in the source file in a HTML-report.
 
@@ -163,19 +158,17 @@ Paste the line below directly into your browser bar:
 
 ![Example view of filescan report](filescan.png)
 
-
 ## Contributing
 
 All contributions are welcome! Think of corrections on the documentation, code or more and better tests.
 
 Simple Guidelines:
 
-* Questions, Feature Requests, Bug Reports please use on the Github Issue Tracker.
-
-**Pull Requests are welcome!** 
+- Questions, Feature Requests, Bug Reports please use on the Github Issue Tracker.
 
-When you contribute to Codeaudit, your contributions are made under the same license as the file you are working on. 
+**Pull Requests are welcome!**
 
+When you contribute to Codeaudit, your contributions are made under the same license as the file you are working on.
 
 > [!NOTE]
 > This is an open community driven project. Contributors will be mentioned in the [documentation](https://nocomplexity.com/documents/codeaudit/intro.html).
@@ -184,7 +177,4 @@ We adopt the [Collective Code Construction Contract(C4)](https://rfc.zeromq.org/
 
 ## License
 
-
 `codeaudit` is distributed under the terms of the [GPL-3.0-or-later](https://spdx.org/licenses/GPL-3.0-or-later.html) license.
-
-

{codeaudit-1.7.1 → codeaudit-1.8.0}/README.md

@@ -17,9 +17,10 @@ Python Code Audit is a static application security testing (SAST) tool designed
 This tool is designed for anyone who uses or creates Python programs and wants to understand and mitigate potential security risks.
 
 This tool is created for:
-* Python Users who want to assess the security risks in the Python code they use.
-* Python Developers: Anyone, from professionals to hobbyists, who wants to deliver secure Python code.
-* Security-Conscious Users: People seeking a simple, fast way to gain insight into potential security vulnerabilities within Python packages or files.
+
+- Python Users who want to assess the security risks in the Python code they use.
+- Python Developers: Anyone, from professionals to hobbyists, who wants to deliver secure Python code.
+- Security-Conscious Users: People seeking a simple, fast way to gain insight into potential security vulnerabilities within Python packages or files.
 
 Creating secure software can be challenging. This tool, with its comprehensive [documentation](https://nocomplexity.com/documents/codeaudit/intro.html), acts as your helpful security colleague, making it easier to identify and address vulnerabilities.
 
@@ -27,32 +28,28 @@ Creating secure software can be challenging. This tool, with its comprehensive [
 
 Python Code Audit has the following features:
 
-* **Vulnerability Detection**: Identifies security vulnerabilities in Python files, essential for package security research.
-
-* **Complexity & Statistics**: Reports security-relevant complexity using a fast, lightweight [cyclomatic complexity](https://en.wikipedia.org/wiki/Cyclomatic_complexity) count via Python's AST.
-
-* **Module Usage & External Vulnerabilities**: Detects used modules and reports known vulnerabilities for used external modules.
-
-* **Inline Issue Reporting**: Shows potential security issues with line numbers and code snippets.
+- **Vulnerability Detection**: Identifies security vulnerabilities in Python files, essential for package security research.
 
+- **Complexity & Statistics**: Reports security-relevant complexity using a fast, lightweight [cyclomatic complexity](https://en.wikipedia.org/wiki/Cyclomatic_complexity) count via Python's AST.
 
-* **External Egress Detection**: Identifies embedded API keys and logic that enables communication with remote services, helping uncover hidden data exfiltration paths.
+- **Module Usage & External Vulnerabilities**: Detects used modules and reports known vulnerabilities for used external modules.
 
-* **CI/CD Ready:** Integrates seamlessly into any CI/CD workflow.
+- **Inline Issue Reporting**: Shows potential security issues with line numbers and code snippets.
 
-* **HTML Reports**: All output is saved in simple, static HTML reports viewable in any browser.
+- **External Egress Detection**: Identifies embedded API keys and logic that enables communication with remote services, helping uncover hidden data exfiltration paths.
 
+- **CI/CD Ready:** Integrates seamlessly into any CI/CD workflow.
 
+- **HTML Reports**: All output is saved in simple, static HTML reports viewable in any browser.
 
 > [!NOTE]
 > Python Code Audit uses the Python's Abstract Syntax Tree (AST) to get robust and reliable result. Using the Python AST makes contextual Vulnerability Detection possible and false positive are minimized.
 
-
 ## Installation
 
 > [!TIP]
 > Try it instantly—no installs, no setup, no excuses.
-> 
+>
 > 👉 Launch the browser version [here](https://nocomplexity.com/codeauditapp/dashboardapp.html)
 
 It runs 100% locally in your browser using WebAssembly (WASM). See the power of the tool in under 60 seconds.
@@ -64,12 +61,8 @@ Loved the browser version? Unlock the full power. For advanced security code ins
 pip install -U codeaudit
 ```
 
-
-
-
 If you have installed **Python Code Audit** previously and want to ensure you are using the latest validations and features, simply run this command again. Python Code Audit is frequently updated with new checks.
 
-
 ## Usage
 
 After installation you can get an overview of all implemented commands. Just type in your terminal:
@@ -82,7 +75,7 @@ This will show all commands:
 
 ```text
 ----------------------------------------------------
- _                    __             _             
+ _                    __             _
 |_) \/_|_|_  _ __    /   _  _| _    |_|    _| o _|_
 |   /  |_| |(_)| |   \__(_)(_|(/_   | ||_|(_| |  |_
 ----------------------------------------------------
@@ -91,13 +84,14 @@ Python Code Audit - A modern Python security source code analyzer based on distr
 
 
 Commands to evaluate Python source code:
-Usage: codeaudit COMMAND <directory|package>  [report.html] 
+Usage: codeaudit COMMAND <directory|package>  [report.html]
 
 Depending on the command, you must specify a local directory, a Python file, or a package name hosted on PyPI.org.Reporting: The results are generated as a static HTML report for viewing in a web browser.
 
 Commands:
   overview             Generates an overview report of code complexity and security indicators.
   filescan             Scans Python source code or PyPI packages for security weaknesses.
+  cimode               Run a SAST scan for CI workflows.
   modulescan           Generate a report on known vulnerabilities in Python modules and packages.
   checks               Creates an HTML report of all implemented security checks.
   version              Prints the module version. Or use codeaudit [-v] [--v] [-version] or [--version].
@@ -107,7 +101,7 @@ Use the Python Code Audit documentation (https://codeaudit.nocomplexity.com) to
 
 ## Example
 
-By running the `codeaudit filescan` command, detailed security information is determined for a Python file based on more than **80 validations** implemented. 
+By running the `codeaudit filescan` command, detailed security information is determined for a Python file based on more than **89 validations** implemented.
 
 The `codeaudit filescan` command shows all **potential** security issues that are detected in the source file in a HTML-report.
 
@@ -129,19 +123,17 @@ Paste the line below directly into your browser bar:
 
 ![Example view of filescan report](filescan.png)
 
-
 ## Contributing
 
 All contributions are welcome! Think of corrections on the documentation, code or more and better tests.
 
 Simple Guidelines:
 
-* Questions, Feature Requests, Bug Reports please use on the Github Issue Tracker.
-
-**Pull Requests are welcome!** 
+- Questions, Feature Requests, Bug Reports please use on the Github Issue Tracker.
 
-When you contribute to Codeaudit, your contributions are made under the same license as the file you are working on. 
+**Pull Requests are welcome!**
 
+When you contribute to Codeaudit, your contributions are made under the same license as the file you are working on.
 
 > [!NOTE]
 > This is an open community driven project. Contributors will be mentioned in the [documentation](https://nocomplexity.com/documents/codeaudit/intro.html).
@@ -150,7 +142,4 @@ We adopt the [Collective Code Construction Contract(C4)](https://rfc.zeromq.org/
 
 ## License
 
-
 `codeaudit` is distributed under the terms of the [GPL-3.0-or-later](https://spdx.org/licenses/GPL-3.0-or-later.html) license.
-
-

{codeaudit-1.7.1 → codeaudit-1.8.0}/docs/_config.yml

@@ -4,9 +4,8 @@
 # Created by Maikel Mardjan (nocomplexity.com)
 #######################################################################################
 # Book settings
-#title                       : SimplifiedNLP Documentation # The title of the book. Will be placed in the left navbar.
 title : ""
-author                      : '<a href="https://nocomplexity.com/">Maikel Mardjan (nocomplexity.com)</a>  and all contributors.' # The author of the book
+author                      : '<a href="https://nocomplexity.com/">Maikel Mardjan (nocomplexity.com)</a>  and all contributors.' 
 copyright                   : '2025- Maikel Mardjan - Business Management Support Foundation'  # Copyright year to be placed in the footer
 logo                        : "images/nocxbanner.png"  # A path to the book logo
 # Patterns to skip when building the book. Can be glob-style (e.g. "*skip.ipynb")

{codeaudit-1.7.1 → codeaudit-1.8.0}/docs/checks/dynamicimport_check.md

@@ -6,7 +6,8 @@ Especially if you can not validate upfront what is imported.
 Python Code Audit checks on:
 * `__import__`: This builtin function SHOULD never be used anymore. This is an advanced function that is not needed in everyday Python programming. 
 * `importlib.import_module` use. Using this function should be validated upfront.
-
+* `importlib.util.spec_from_file_location`
+* `importlib.util.module_from_spec`
 
 Using the dynamic imports can be a potential security issue, especially when the module name comes from an untrusted source. Often modules are fetches from internet or are imported by cleaver user input constructs in the code. But an attacker could also import the `os` module and then find a way to call functions to run commands on the system. 
 
@@ -26,6 +27,10 @@ This offers a better way to handle dynamic imports. Avoid using `__import__`.
 
 * Using `importlib.import_module()` keeps dynamic import logic contained within the `importlib module`, which is maintained by the core Python developers. This is from a security point of view  preferred over directly using the low-level built-in function `__import__`.
 
+* Using `importlib.util.spec_from_file_location()` in combination with `importlib.util.module_from_spec` can bypass the normal Python import mechanism and allow arbitrary Python files to be executed. 
+
+
+
 ## Mitigation
 
 There is always a security risk when `importlib.import_module()` is used. 
@@ -37,6 +42,11 @@ Possible mitigations:
 * If you do not trust it: Call a security expert to help you! See the [sponsor](../sponsors) page for companies that could help you!
 
 
+While `importlib.util.spec_from_file_location` is frequently seen in legacy plugin systems, it carries substantial security risks. Modern Python plugin architectures provide much safer mechanisms to prevent the execution of arbitrary files from untrusted locations.
+
+
 ## References
 
-* https://docs.python.org/3/library/functions.html#import__ 
+* https://docs.python.org/3/library/functions.html#import__ 
+* [CVE-2026-40156](https://nvd.nist.gov/vuln/detail/CVE-2026-40156) and see all [details](https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-2g3w-cpc4-chr4).
+* [Python Security Handbook](https://nocomplexity.github.io/pythonsecurity/)

{codeaudit-1.7.1 → codeaudit-1.8.0}/docs/checks/exception_check.md

@@ -1,6 +1,6 @@
 ## Exception Statements
 
-Codeaudit detects the use of `pass` within an `except` block.
+Python Code Audit  detects the use of `pass` within an `except` block.
 
 The Python pattern:
 ```python
@@ -10,7 +10,7 @@ except Exception:
     pass
 ```
 
-presents potential security risks due to:
+Presents potential security risks due to:
 - **Overly broad exception handling** – catching `Exception` masks virtually all errors
 - **Silent failure** – using `pass` suppresses all evidence that something went wrong
 
@@ -21,10 +21,16 @@ This security concern also applies when using `continue` inside an exception blo
 - `pass` statements in exception clauses
 - `continue` statements in exception clauses
 
+:::{important} 
+Treat the detection of `pass` and `continue` in exception handlers as a **signal** rather than proof of a security issue. Always examine whether the exception handler catches exceptions that are too broad (for example, `except:` or `except Exception:`).
+
+No static analysis tool can determine with 100% confidence whether a particular exception handler represents a security risk. Due to Python's dynamic nature. The intent of the code, the surrounding context, and the runtime behavior all influence whether suppressing an exception is appropriate.
+:::
+
 
 ## Background
 
-Checking exception statements in Python code for possible security issues should be done.
+Checking exception statements in Python code for possible security issues should always be done.
 Reasons are e.g.:
 
 1.  **Masking of Critical Errors and Vulnerabilities:**
@@ -66,8 +72,11 @@ Reasons are e.g.:
         # Optionally, re-raise the exception if the program cannot continue meaningfully
         # raise
     ```
+
   * **Avoid `pass`:** Only use `pass` if the exception is truly expected and handling it means doing nothing, and you have documented why that's the case. Such scenarios are rare.
+
   * **Use `finally` for Cleanup:** If resources need to be released regardless of whether an exception occurs, use a `finally` block or context managers (`with` statements).
+
     ```python
     try:
         f = open("my_file.txt", "r")
@@ -92,3 +101,4 @@ Reasons are e.g.:
 ## More info
 
 * [CWE-703: Improper Check or Handling of Exceptional Conditions](https://cwe.mitre.org/data/definitions/703.html)
+* [Python Security Handbook, Exception Statements](https://nocomplexity.github.io/pythonsecurity/constructs/exceptions/)

{codeaudit-1.7.1 → codeaudit-1.8.0}/docs/cimode.md

@@ -10,16 +10,14 @@ If you have improvements or CI configuration tips, contributions via pull reques
 [Data Exfiltration Detection functionality](data_exfiltration_detection) is not yet available in CI pipelines.
 :::
 
-
 :::{admonition} By default, CI scan mode uses the same analysis engine as the CLI version
 :class: important
 
 So Keep in mind:
 
-* [Some directories are excluded from SAST scanning](excluded_directories)
-* Findings marked with [markissues-label](markissues-label) are ignored by default in CI mode
-:::
-
+- [Some directories are excluded from SAST scanning](excluded_directories)
+- Findings marked with [markissues-label](markissues-label) are ignored by default in CI mode
+  :::
 
 ## CI Mode Command
 
@@ -31,10 +29,8 @@ codeaudit cimode [file|directory] [--output text|html|json] [--nosec True|False]
 
 ### Default behaviour
 
-* Output format: `text`
-* `nosec=True` (ignores lines marked with `# nosec`)
-
-
+- Output format: `text`
+- `nosec=True` (ignores lines marked with `# nosec`)
 
 ### Quick Test Run
 
@@ -46,30 +42,22 @@ codeaudit cimode .
 
 Here, `.` represents the current working directory.
 
-
 ### Command Options
 
-
 | Option         | Description                                                |
-| -------------- | ---------------------------------------------------------- |
+| :------------- | :--------------------------------------------------------- |
 | `-o, --output` | Output format: `text`, `html`, or `json` (default: `text`) |
 | `-n, --nosec`  | Ignore findings marked with `# nosec` (default: `True`)    |
 
-
-
-
 ## GitLab CI Integration
 
-
 Integrating Python Code Audit with [GitLab.com](https://gitlab.com) is straightforward and can be completed in just a few minutes.
 
 For GitLab CI jobs, it is recommended to always save **artifacts**, even when the job fails. This ensures that scan results are available for review in all cases. It is especially useful when using the HTML report format, as it allows you to quickly view findings directly in the browser via the CI artifacts interface.
 
 If needed, you can also export the `json` output for further processing in a separate secure environment, for example to integrate results into dashboards, ticketing systems, or additional analysis pipelines.
 
-
-### HTML report example 
-
+### HTML report example
 
 ```yaml
 # SAST scan with Python Code Audit on GitLab.com
@@ -88,7 +76,7 @@ codeaudit-scan:
     - pip install codeaudit
     - codeaudit --version
     - codeaudit cimode . --output html > codeaudit-output.html
-    
+
   allow_failure: true
 
   artifacts:
@@ -102,8 +90,7 @@ codeaudit-scan:
 
 If a scan detects security weaknesses, the job will fail by default. In many workflows, it is common to allow CI failures so that issues are visible without blocking all development activity.
 
-After the job completes, results are available in the CI **artifacts**. Use *Browse artifacts* to open the HTML report directly in your browser.
-
+After the job completes, results are available in the CI **artifacts**. Use _Browse artifacts_ to open the HTML report directly in your browser.
 
 ### Plain Text Output Example
 
@@ -132,7 +119,6 @@ codeaudit-scan:
     expose_as: "Python Code Audit Report"
 ```
 
-
 ### JSON Output Example
 
 For structured processing or integration with other tools:
@@ -160,6 +146,36 @@ codeaudit-scan:
     expose_as: "Python Code Audit Report"
 ```
 
+### GitLab CI Component Example
+
+`codeaudit` can be easily fitted as a GitLab CI component for easy integration into the GitLab pipelines.
+Example code for a `codeaudit-scan` component:
+
+```yaml
+spec:
+  inputs:
+    python_version:
+      default: "3.14"
+      description: "Python version to use for the scan"
+    stage:
+      default: "scan"
+      description: "Stage to run the scan in"
+    src_dir:
+      default: "."
+      description: "Directory to scan"
+---
+codeaudit-scan:
+  image: python:$[[ inputs.python_version ]]-alpine
+  stage: $[[ inputs.stage ]]
+  before_script:
+    - python -m venv venv
+    - source venv/bin/activate
+    - pip install --upgrade pip codeaudit
+  script:
+    - codeaudit cimode $[[ inputs.src_dir ]]
+```
+
+Example above enforces projects to react on found issues. Intentionally results are not redirected to the file to not cover found issues.
 
 ## GitHub.com CI Integration
 
@@ -200,20 +216,17 @@ jobs:
 
       - name: Run SAST scan
         run: |
-           codeaudit cimode . --output text | tee codeaudit-output.text
-           exit ${PIPESTATUS[0]}
-        
+          codeaudit cimode . --output text | tee codeaudit-output.text
+          exit ${PIPESTATUS[0]}
+
       - name: Upload scan artifact
         uses: actions/upload-artifact@v4
         with:
           name: codeaudit-${{ github.ref_name }}
           path: codeaudit-output.text
-
 ```
 
-
-### HTML output 
-
+### HTML output
 
 ```yaml
 # SAST scan with Python Code Audit on GitHub Actions
@@ -242,7 +255,7 @@ jobs:
 
       - name: Install Python Code Audit
         run: pip install codeaudit
-        
+
       - name: Show version
         run: codeaudit --version
 
@@ -254,11 +267,9 @@ jobs:
         with:
           name: codeaudit-${{ github.ref_name }}
           path: codeaudit-output.html
-
 ```
 
-On GitHub Actions, HTML reports are **not rendered directly in the browser** like a live page. They are stored as **workflow artifacts**. 
-
+On GitHub Actions, HTML reports are **not rendered directly in the browser** like a live page. They are stored as **workflow artifacts**.
 
 To download SAST result artifacts from the workflow run:
 
@@ -271,6 +282,3 @@ After the job finishes:
 5. Download the artifact (usually a `.zip` file)
 6. Extract it locally
 7. Open `codeaudit-output.html` in your browser
-
-
-

{codeaudit-1.7.1 → codeaudit-1.8.0}/docs/codeauditcommands.md

@@ -1,9 +1,9 @@
 % THIS FILE IS GENERATED! - Use CLIcommands.ipynb to make it better!
 # Commands Overview
-Python Code Audit commands for: version: 1.7.1
+Python Code Audit commands for: version: 1.8.0
 ```
 ----------------------------------------------------
- _                    __             _             
+ _                    __             _
 |_) \/_|_|_  _ __    /   _  _| _    |_|    _| o _|_
 |   /  |_| |(_)| |   \__(_)(_|(/_   | ||_|(_| |  |_
 ----------------------------------------------------
@@ -18,6 +18,7 @@ Depending on the command, you must specify a local directory, a Python file, or
 Commands:
   overview             Generates an overview report of code complexity and security indicators.
   filescan             Scans Python source code or PyPI packages for security weaknesses.
+  cimode               Run a SAST scan for CI workflows.
   modulescan           Generate a report on known vulnerabilities in Python modules and packages.
   checks               Creates an HTML report of all implemented security checks.
   version              Prints the module version. Or use codeaudit [-v] [--v] [-version] or [--version].