conviso-ast 3.0.0.dev1__py3-none-any.whl → 3.0.1__py3-none-any.whl

{conviso_ast-3.0.0.dev1.dist-info → conviso_ast-3.0.1.dist-info}/METADATA

@@ -1,22 +1,22 @@
 Metadata-Version: 2.2
 Name: conviso-ast
-Version: 3.0.0.dev1
+Version: 3.0.1
 Maintainer: Conviso
 Maintainer-email: development@convisoappsec.com
 Project-URL: Source, https://github.com/convisoappsec/convisocli/
 Requires-Python: >=3.9
 Description-Content-Type: text/markdown
-Requires-Dist: GitPython==3.1.45
+Requires-Dist: GitPython==3.1.46
 Requires-Dist: click==8.1.8
 Requires-Dist: requests==2.32.5
-Requires-Dist: urllib3==2.4.0
+Requires-Dist: urllib3==2.6.3
 Requires-Dist: semantic-version==2.10.0
 Requires-Dist: docker==7.1.0
 Requires-Dist: PyYAML==6.0.3
 Requires-Dist: click-log==0.4.0
 Requires-Dist: transitions==0.9.2
 Requires-Dist: jsonschema==4.25.1
-Requires-Dist: giturlparse<=0.12.0
+Requires-Dist: giturlparse<=0.14.0
 Requires-Dist: jmespath==1.0.1
 Requires-Dist: setuptools==78.1.0
 Dynamic: description

{conviso_ast-3.0.0.dev1.dist-info → conviso_ast-3.0.1.dist-info}/RECORD

@@ -1,16 +1,16 @@
-conviso_ast-3.0.0.dev1.data/scripts/flow_bash_completer.sh,sha256=9q3HPuXq_FCUUV3IFGcOefsOLhPWatUkLY7txiBM7Uo,624
-conviso_ast-3.0.0.dev1.data/scripts/flow_fish_completer.fish,sha256=-wiuarawDJkms5N-rh99brIOzhy-ktsM1mi1ohQ3Mtg,147
-conviso_ast-3.0.0.dev1.data/scripts/flow_zsh_completer.sh,sha256=cAtTDGUs5sY4NAA7AjscmLWj0dbNZ9iZhLP6BTz6dEQ,844
+conviso_ast-3.0.1.data/scripts/flow_bash_completer.sh,sha256=9q3HPuXq_FCUUV3IFGcOefsOLhPWatUkLY7txiBM7Uo,624
+conviso_ast-3.0.1.data/scripts/flow_fish_completer.fish,sha256=-wiuarawDJkms5N-rh99brIOzhy-ktsM1mi1ohQ3Mtg,147
+conviso_ast-3.0.1.data/scripts/flow_zsh_completer.sh,sha256=cAtTDGUs5sY4NAA7AjscmLWj0dbNZ9iZhLP6BTz6dEQ,844
 convisoappsec/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 convisoappsec/logger.py,sha256=aTNebqOau9nEadBySMTXtnbGkOkJ_q2kyFlX1mzizeg,1132
-convisoappsec/version.py,sha256=_q16h_zrZcZaVMRK1AHfgnIFLcCc08iv7IslC4pt-r0,28
+convisoappsec/version.py,sha256=Ys8n4as2Wcnr8Aq6OV-e59RKmKVeyh9Oh2nzJ2FZPFk,22
 convisoappsec/common/__init__.py,sha256=QN7tV2C_jhTiWUrJHv2jbeq6ae3MssgLUWpQZwe8O2s,105
 convisoappsec/common/box.py,sha256=WTtPF3YWxkcdblPmFTzrzQlPPPUwVsDt2zoi6xFMy1U,7561
 convisoappsec/common/cleaner.py,sha256=Iy8BWCXj_v51oovcYzI_uhaJzLL-fCUyDxrbBglfwEs,2680
 convisoappsec/common/docker.py,sha256=SYkZCgKS_kuREyJS_Zb4d61MWb58HoiFbxkSRzLJr0g,12529
 convisoappsec/common/exceptions.py,sha256=Das7j6_nzB75-TY9xoVK12eswvxSntxI19nmXdjumzI,230
 convisoappsec/common/git_data_parser.py,sha256=-Ou1YC8D4bpmHUcibxLiJf2rxKi8-SuTuto-6nB-ML8,2167
-convisoappsec/common/retry_handler.py,sha256=MAwwD3QgxHZDJI87C8NPxYzxM4NBwGe3RflV7jRciAw,1495
+convisoappsec/common/retry_handler.py,sha256=NwBNRQrqwk3Ohz9vcls2vTqD6wqxDWjm4MWI5WIfyj8,1533
 convisoappsec/common/strings.py,sha256=JqBqW1redAfWTWtUFya2MvrW5T26Y07Vn0pbee-BpMo,185
 convisoappsec/common/graphql/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 convisoappsec/common/graphql/error_handlers.py,sha256=1KUBa1zYiN_Gs2uwPsjl4LovoRFboWc16U7f680FfNE,2058
@@ -44,13 +44,8 @@ convisoappsec/flow/graphql_api/v1/models/project.py,sha256=CDZlufsT-_iQIOgpOPAtd
 convisoappsec/flow/graphql_api/v1/schemas/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 convisoappsec/flow/graphql_api/v1/schemas/mutations/__init__.py,sha256=R9LgniQyj694h1MD7cn1-HJRDjI4PLiOrCmsqjp16ho,3251
 convisoappsec/flow/graphql_api/v1/schemas/resolvers/__init__.py,sha256=2jAgzA-8te6HyyV8RVAx0BnLDeZhFulZynbxm5JR8Sc,2713
-convisoappsec/flow/source_code_scanner/__init__.py,sha256=UvfLXNR1B8Fy6LuUwesQMXV0oMkLjVMhPs0SJ5nDR0k,227
-convisoappsec/flow/source_code_scanner/exceptions.py,sha256=6ehUyZaFfMIRMzKdh0MND8gfyTNyHY_wsprmxkxSJD0,57
-convisoappsec/flow/source_code_scanner/scc.py,sha256=O_kdWsw2x0czuKcLORD3gP5wbXsizj4Bb2Sbsk5n_Sw,1645
-convisoappsec/flow/source_code_scanner/source_code_scanner.py,sha256=L9LVZnUO-o_JvT8dHUxBXcbxQlxSqRP8CVUBgTUEV7s,4726
-convisoappsec/flow/util/__init__.py,sha256=rpu69qnn68rqrK3rhPcgrVYWCIW9WVSrQ5FyCeHxng4,160
+convisoappsec/flow/util/__init__.py,sha256=32E3AbPrBf0stKOzCIvz7BeWtBjAScIt7FNyERjN-p4,99
 convisoappsec/flow/util/ci_provider.py,sha256=VYDESwNFbtrRcWDtTEb8tYDN5qbnLksmQI_ntsciJ4I,2093
-convisoappsec/flow/util/metrics.py,sha256=4qGBMMR02OZN4ezFiB9iqtCuUYO8bXYqeUNDFRDpQaw,480
 convisoappsec/flow/util/source_code_compressor.py,sha256=b2iA8Exf8wVbxR1mnvwTbruDjdpYyVloUmSlyYLSJQU,508
 convisoappsec/flow/version_searchers/__init__.py,sha256=rJkVGlmWiiDHegvQl7d900RvnglzICXpTxuUiLlHSz0,294
 convisoappsec/flow/version_searchers/sorted_by_versioning_style.py,sha256=xLjaHy-WDOgY5jrASnaK-uM0UL-9sL3BALwzmM5PgSA,2657
@@ -71,7 +66,8 @@ convisoappsec/flowcli/assets/create.py,sha256=JDmxDH1WbyaQYLTxoi6dS_WosRm7kjvpJV
 convisoappsec/flowcli/assets/entrypoint.py,sha256=CEoev3d1ogclPNP3l31PBhGkoiZZ400kxsnnF02uxFk,310
 convisoappsec/flowcli/assets/ls.py,sha256=IYfKIca218BvZ5ecrtDgZ_T8xVg0XO3Eq1kK16BMBsc,1484
 convisoappsec/flowcli/ast/__init__.py,sha256=9SO9inH22PPm4jLlljVTJEeJKZujFKfwqTBbBo-TwFM,47
-convisoappsec/flowcli/ast/entrypoint.py,sha256=pwkXn9R1FNuUlTGrwUIMCacpklYSFR9BFDB59a_ivcU,15946
+convisoappsec/flowcli/ast/dry_run.py,sha256=pb0eM-jXE83UpWTBcw3ulVSgY0WhWvWbcb-58j2YjC4,3588
+convisoappsec/flowcli/ast/entrypoint.py,sha256=HI02I6r8v2cBYwCeOfQZLtFjGhTl3dF_83Tu2FXCM8Y,15999
 convisoappsec/flowcli/companies/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 convisoappsec/flowcli/companies/ls.py,sha256=0287VTXOkKnuXTaJh392crYjx0qank0pBvmESq3P_Bw,892
 convisoappsec/flowcli/container/__init__.py,sha256=Z666kQa4qVfbcuyLaW_hvORdAPtZ9dTQFcQb2H2Nkfg,59
@@ -89,8 +85,8 @@ convisoappsec/flowcli/deploy/create/with_/tag_tracker/context.py,sha256=IZjsKSze
 convisoappsec/flowcli/deploy/create/with_/tag_tracker/entrypoint.py,sha256=MUrx_fqAFQeJ2oUaAxRDPfk_qlgyNHKFMNZqmiDFWrU,675
 convisoappsec/flowcli/deploy/create/with_/tag_tracker/sort_by/__init__.py,sha256=c1sggCq3RGdgyq0tqdxx_yGW1iOeBti2aoNsoiMxKnc,56
 convisoappsec/flowcli/deploy/create/with_/tag_tracker/sort_by/entrypoint.py,sha256=J5dSGo0P__fKlPpeaVcAmyFnnAtZPi0E2y4Hv_U-ZQM,382
-convisoappsec/flowcli/deploy/create/with_/tag_tracker/sort_by/time_.py,sha256=Ipkz0bVXfJlbYHfPFICY3VUZYwlL2gxuHUqVVtvSyzQ,2721
-convisoappsec/flowcli/deploy/create/with_/tag_tracker/sort_by/versioning_style.py,sha256=-FJF4BOLzzpcJqYHlYJovRuvoUut7gLoxDWKnT6CzH0,3416
+convisoappsec/flowcli/deploy/create/with_/tag_tracker/sort_by/time_.py,sha256=Up4tgYC5UFoDCjLYUo-6dPkmhVlJqx_eg6zioNegjI8,2608
+convisoappsec/flowcli/deploy/create/with_/tag_tracker/sort_by/versioning_style.py,sha256=-BRqdRK-LFNjA6XiOrfoMKDo-ACetdsQaGEPQBTRcDo,3303
 convisoappsec/flowcli/findings/__init__.py,sha256=0wiNMaThYuum1QA9s9-LGtcmWFxUY-mWiYMtTSuaDqY,58
 convisoappsec/flowcli/findings/entrypoint.py,sha256=foc6wgD2BsoFZkJQiIuis260Zt-3DkTLsxej7cHv9Ko,344
 convisoappsec/flowcli/findings/create/__init__.py,sha256=l7eIySVkTKr3auZ8Fwe7G6AG6-pM06vnl3aZcEclVP4,54
@@ -101,16 +97,19 @@ convisoappsec/flowcli/findings/create/with_/version_tracker.py,sha256=NrnYx6OMQW
 convisoappsec/flowcli/findings/import_sarif/__init__.py,sha256=3iR7f9V9NdoIQTrD25EVu6OAYPPJ4RZEaM4P34BS0js,66
 convisoappsec/flowcli/findings/import_sarif/entrypoint.py,sha256=MIHi9ZWU2Jn2o7o5mDLp81xfb14gsa33aGnqh1YR7n8,13740
 convisoappsec/flowcli/iac/__init__.py,sha256=a3IZzSKpm987fMEliTECDeXO_Eduk7eg-aQzmaWvUXQ,47
-convisoappsec/flowcli/iac/entrypoint.py,sha256=vGsHdIss3KEWartTZkKl7k5w1qxhYIVqHGOJdklc3b8,241
-convisoappsec/flowcli/iac/run.py,sha256=q-bndWtZb9xYE9U_4aMHcZ3WtgHyXQBqUkjHTk-hdwI,11071
+convisoappsec/flowcli/iac/dry_run.py,sha256=xvC0Wb2Sxl37yEjFaFMGcRvLJ4Q8evrNQoUXuahHtCg,2990
+convisoappsec/flowcli/iac/entrypoint.py,sha256=WMlSwHd7cLxhUfy643OquQhUHEy4yNf7s0K5bkrXYno,295
+convisoappsec/flowcli/iac/run.py,sha256=Y86MYTM8kTcF3TdvZuGgGLmNOEx7EPVaidKnStSbVpE,11203
 convisoappsec/flowcli/sast/__init__.py,sha256=S4O78eZGhgpT2lZY3GSUIUTQJB5a62uAVirEqbf4EQY,49
-convisoappsec/flowcli/sast/entrypoint.py,sha256=7bvQ6mVLWvykGfjD-o0xbu7ybm8Hj2DTqvCv5CstIas,245
+convisoappsec/flowcli/sast/dry_run.py,sha256=lUi9LCfBlBjcAYm4v_Etl3raPZcTHVr5fVxGnB1eVSM,5787
+convisoappsec/flowcli/sast/entrypoint.py,sha256=XMu8WpZNwSujWOwbHUThk3JK_WtRWHau9kYD2ttjULY,300
 convisoappsec/flowcli/sast/run.py,sha256=7uX6K1VLASU8RnoCKNYIIqXSsNkF4JQ8OKhAG2CKjuI,16353
 convisoappsec/flowcli/sbom/__init__.py,sha256=qzwiPWniK41Y41XvJJhxtRZguHrSSenb57lhy64KnSc,49
 convisoappsec/flowcli/sbom/entrypoint.py,sha256=ax2WL5BtCu24NeZYe6zzCVZ2ujlviXkvtY7PZihlz3s,263
-convisoappsec/flowcli/sbom/generate.py,sha256=Oke4JX4vARqpsMlGC2cPye_LMapIMRDyZv2W14hoD8g,7170
+convisoappsec/flowcli/sbom/generate.py,sha256=YEhl4fVRXRscSApTMkTynyka3ygsVgJD7vhUHipUp18,7190
 convisoappsec/flowcli/sca/__init__.py,sha256=xnVoxwbpe4LrEemmWJ6svr3zdpo9S4kEIvM4HVRsLX8,47
-convisoappsec/flowcli/sca/entrypoint.py,sha256=LpFoiZ3iljhAyKzfMJ7pdBdHIUhnjh3ZguPgvWJZ-XA,241
+convisoappsec/flowcli/sca/dry_run.py,sha256=fZ_tgc1k8Mn1JMznFWyi_CExR-gpLHLHwQ2erNldnHY,3438
+convisoappsec/flowcli/sca/entrypoint.py,sha256=yEAANSG2fcD3HctUWebhx_win3CW-1Q2CO1i-ZIBUCk,295
 convisoappsec/flowcli/sca/run.py,sha256=FWnTHgMgnIRvJSpMIkFcb6YMtvWEjEpKJyXEkjAZpA4,16725
 convisoappsec/flowcli/vulnerability/__init__.py,sha256=c18E0J1KfZBBqpv8XGxF5dv7dxCDquFkjGkdnvFDSYI,67
 convisoappsec/flowcli/vulnerability/assert_security_rules.py,sha256=j7VcondMeZSRxWz118aWS9qUSGdvsq4Mg-_9UXp8Dyw,6075
@@ -121,8 +120,8 @@ convisoappsec/flowcli/vulnerability/run.py,sha256=6flmvr55cKxj-duX3w4PAFwJgC5AJ0
 convisoappsec/sast/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 convisoappsec/sast/decision.py,sha256=d7dcNr9yZMzyccpFS_peAmDo0ZtfsE1qXDdYrvCux2U,1025
 convisoappsec/sast/sastbox.py,sha256=hXZLiYh_F3f6yd1ydPYVOMKg-tNOQOZiBvKmWyedagI,11031
-conviso_ast-3.0.0.dev1.dist-info/METADATA,sha256=ovtqoagXc5odGexeVR84FxKioLo-cfy5XUlgxjpPhrA,1080
-conviso_ast-3.0.0.dev1.dist-info/WHEEL,sha256=In9FTNxeP60KnTkGw7wk6mJPYd_dQSjEZmXdBdMCI-8,91
-conviso_ast-3.0.0.dev1.dist-info/entry_points.txt,sha256=0IvamweR_V0uG4O5Fo9NpVHTHfpZRwUE9kn7KEVZ668,109
-conviso_ast-3.0.0.dev1.dist-info/top_level.txt,sha256=ju5r0RSCF1HA7m9JOG10jrQS4SnqQEJzl6-YMCxbSl4,14
-conviso_ast-3.0.0.dev1.dist-info/RECORD,,
+conviso_ast-3.0.1.dist-info/METADATA,sha256=BdZ7Ie84rkDmpp_x8q0H_ROeadkVM8QLidi9zadyDzU,1075
+conviso_ast-3.0.1.dist-info/WHEEL,sha256=In9FTNxeP60KnTkGw7wk6mJPYd_dQSjEZmXdBdMCI-8,91
+conviso_ast-3.0.1.dist-info/entry_points.txt,sha256=0IvamweR_V0uG4O5Fo9NpVHTHfpZRwUE9kn7KEVZ668,109
+conviso_ast-3.0.1.dist-info/top_level.txt,sha256=ju5r0RSCF1HA7m9JOG10jrQS4SnqQEJzl6-YMCxbSl4,14
+conviso_ast-3.0.1.dist-info/RECORD,,

convisoappsec/common/retry_handler.py

@@ -20,7 +20,7 @@ class RetryHandler:
         while retries < self.max_retries:
             try:
                 return func(*args, **kwargs)
-            except Exception:
+            except Exception as log_message:
                 retries += 1
                 time.sleep(delay)
                 delay *= self.backoff_factor
@@ -28,7 +28,7 @@ class RetryHandler:
                 if retries == self.max_retries:
                     full_trace = traceback.format_exc()
                     LOGGER.warning(
-                        "⚠️ Maximum retries reached. Our technical team has been notified."
+                        f"⚠️ Maximum retries reached. Our technical team has been notified. Error: {log_message}" 
                     )
 
                     try:

convisoappsec/flow/util/__init__.py

@@ -1,7 +1,5 @@
 from .source_code_compressor import SourceCodeCompressor
-from .metrics import project_metrics
 
 __all__ = [
-    'SourceCodeCompressor',
-    'project_metrics',
+    'SourceCodeCompressor'
 ]

convisoappsec/flowcli/ast/dry_run.py

@@ -0,0 +1,99 @@
+import click
+import json
+import traceback
+import sys
+from convisoappsec.flowcli import help_option
+from convisoappsec.flowcli.context import pass_flow_context
+from convisoappsec.logger import LOGGER
+from convisoappsec.flowcli.common import on_http_error
+from convisoappsec.common.cleaner import Cleaner
+from convisoappsec.sast.sastbox import SASTBox
+from convisoappsec.flowcli.sast.dry_run import execute_dry_run as execute_sast_dry_run
+from convisoappsec.flowcli.sca.dry_run import execute_dry_run as execute_sca_dry_run
+from convisoappsec.flowcli.iac.dry_run import execute_dry_run as execute_iac_dry_run
+
+@click.command(name='dry-run')
+@click.option(
+    "-s", "--start-commit", required=False,
+    help="If no value is set so the empty tree hash commit is used."
+)
+@click.option(
+    "-e", "--end-commit", required=False,
+    help="If no value is set so the HEAD commit from the current branch is used"
+)
+@click.option(
+    "-r", "--repository-dir", default=".", show_default=True,
+    type=click.Path(exists=True, resolve_path=True), required=False,
+    help="The source code repository directory."
+)
+@click.option(
+    "--sastbox-registry", default="", required=False, hidden=True,
+    envvar=("CONVISO_SASTBOX_REGISTRY", "FLOW_SASTBOX_REGISTRY"),
+)
+@click.option(
+    "--sastbox-repository-name", default="", required=False, hidden=True,
+    envvar=("CONVISO_SASTBOX_REPOSITORY_NAME", "FLOW_SASTBOX_REPOSITORY_NAME"),
+)
+@click.option(
+    "--sastbox-tag", default=SASTBox.DEFAULT_TAG, required=False, hidden=True,
+    envvar=("CONVISO_SASTBOX_TAG", "FLOW_SASTBOX_TAG"),
+)
+@click.option(
+    "--sastbox-skip-login/--sastbox-no-skip-login", default=False, required=False, hidden=True,
+    envvar=("CONVISO_SASTBOX_SKIP_LOGIN", "FLOW_SASTBOX_SKIP_LOGIN"),
+)
+@click.option(
+    "--custom-sca-tags", hidden=True, required=False, multiple=True, type=(str, str),
+    help="It should be passed as <repository_name> <image_tag>."
+)
+@click.option(
+    "--scanner-timeout", hidden=True, required=False, default=7200, type=int,
+    help="Set timeout for each scanner"
+)
+@click.option(
+    '--cleanup', default=False, is_flag=True, show_default=True,
+    help="Clean up system resources."
+)
+@help_option
+@pass_flow_context
+def dry_run(flow_context, end_commit, start_commit, repository_dir,
+            sastbox_registry, sastbox_repository_name, sastbox_tag, sastbox_skip_login,
+            custom_sca_tags, scanner_timeout, cleanup):
+    """
+    Perform a dry-run AST analysis (SAST, SCA, IaC).
+    Checks API Key, runs the scans, and outputs the results in JSON format to stdout.
+    Does NOT create assets or deploys on Conviso Platform.
+    """
+    try:
+        results = {}
+
+        # Run SAST
+        sast_results = execute_sast_dry_run(
+            flow_context, end_commit, start_commit, repository_dir,
+            sastbox_registry, sastbox_repository_name, sastbox_tag, sastbox_skip_login
+        )
+        results['sast'] = sast_results
+
+        # Run SCA
+        sca_results = execute_sca_dry_run(
+            flow_context, repository_dir, custom_sca_tags, scanner_timeout
+        )
+        results['sca'] = sca_results
+
+        # Run IaC
+        iac_results = execute_iac_dry_run(
+            flow_context, repository_dir, scanner_timeout
+        )
+        results['iac'] = iac_results
+
+        print(json.dumps(results, indent=2))
+
+        if cleanup:
+            LOGGER.info("🧹 Cleaning up ...")
+            cleaner = Cleaner()
+            cleaner.cleanup()
+
+    except Exception as e:
+        traceback.print_exc(file=sys.stderr)
+        on_http_error(e)
+        sys.exit(1)

convisoappsec/flowcli/ast/entrypoint.py

@@ -15,7 +15,7 @@ from convisoappsec.flow import GitAdapter
 from convisoappsec.flowcli.context import pass_flow_context
 from convisoappsec.logger import LOGGER, log_and_notify_ast_event
 from convisoappsec.common.cleaner import Cleaner
-
+from .dry_run import dry_run
 
 def get_default_params_values(cmd_params):
     """ Further information in https://click.palletsprojects.com/en/8.1.x/api/?highlight=params#click.Command.params
@@ -425,3 +425,4 @@ def ast():
 
 
 ast.add_command(run)
+ast.add_command(dry_run)

convisoappsec/flowcli/deploy/create/with_/tag_tracker/sort_by/time_.py

@@ -1,6 +1,5 @@
 import click
 # TODO: refactoring. all deploy create share some behavior
-from convisoappsec.flow.util import project_metrics
 from convisoappsec.flow.version_searchers import TimeBasedVersionSearcher
 from convisoappsec.flow.version_control_system_adapter import GitAdapter
 from convisoappsec.flowcli.context import pass_flow_context
@@ -72,7 +71,6 @@ def time_(flow_context, create_context, tag_tracker_context, attach_diff):
             previous_version=previous_version,
             diff_content=diff_content,
             metrics=deploy_metrics,
-            project_metrics=project_metrics(repository_dir),
             commit_authors=authors_data
         )
 

convisoappsec/flowcli/deploy/create/with_/tag_tracker/sort_by/versioning_style.py

@@ -1,6 +1,5 @@
 import click
 # TODO: refactoring. all deploy create share some behavior
-from convisoappsec.flow.util import project_metrics
 from convisoappsec.flowcli.context import pass_flow_context
 from convisoappsec.flow.version_searchers import SortedByVersioningStyle
 from convisoappsec.flow.version_control_system_adapter import GitAdapter
@@ -103,7 +102,6 @@ def versioning_style(
             previous_version=previous_version,
             diff_content=diff_content,
             metrics=deploy_metrics,
-            project_metrics=project_metrics(repository_dir),
             commit_authors=authors_data
         )
 

convisoappsec/flowcli/iac/dry_run.py

@@ -0,0 +1,94 @@
+import click
+import click_log
+import json
+import traceback
+import sys
+from convisoappsec.common.box import ContainerWrapper
+from convisoappsec.flowcli import help_option
+from convisoappsec.flowcli.context import pass_flow_context
+from convisoappsec.logger import LOGGER
+from convisoappsec.flowcli.common import on_http_error
+from convisoappsec.common.cleaner import Cleaner
+
+def execute_dry_run(flow_context, repository_dir, scanner_timeout):
+    REQUIRED_CODEBASE_PATH = '/code'
+    IAC_IMAGE_NAME = 'iac_scanner_checkov'
+    IAC_SCAN_FILENAME = '/{}.json'.format(IAC_IMAGE_NAME)
+    containers_map = {
+        IAC_IMAGE_NAME: {
+            'repository_dir': repository_dir,
+            'repository_name': IAC_IMAGE_NAME,
+            'tag': 'unstable',
+            'command': [
+                '-c', REQUIRED_CODEBASE_PATH,
+                '-o', IAC_SCAN_FILENAME,
+            ],
+        },
+    }
+
+    conviso_rest_api = flow_context.create_conviso_rest_api_client()
+    token = conviso_rest_api.docker_registry.get_sast_token()
+    
+    LOGGER.info('💬 Preparing Environment...')
+    scanners_wrapper = ContainerWrapper(
+        token=token,
+        containers_map=containers_map,
+        logger=LOGGER,
+        timeout=scanner_timeout
+    )
+
+    LOGGER.info('💬 Starting IaC...')
+    scanners_wrapper.run()
+
+    results_list = []
+    for r in scanners_wrapper.scanners:
+        report_filepath = r.results
+        if report_filepath:
+             try:
+                with open(report_filepath, 'r') as f:
+                    results_list.append(json.load(f))
+             except Exception as e:
+                click.echo(f"Error reading result file {report_filepath}: {e}", file=sys.stderr)
+
+    if len(results_list) == 1:
+        return results_list[0]
+    return results_list
+
+@click.command(name='dry-run')
+@click.option(
+    '-r', '--repository-dir', default=".", show_default=True,
+    type=click.Path(exists=True, resolve_path=True), required=False,
+    help="The source code repository directory."
+)
+@click.option(
+    "--scanner-timeout", hidden=True, required=False, default=7200, type=int,
+    help="Set timeout for each scanner"
+)
+@click.option(
+    '--cleanup', default=False, is_flag=True, show_default=True,
+    help="Clean up system resources."
+)
+@help_option
+@pass_flow_context
+def dry_run(flow_context, repository_dir, scanner_timeout, cleanup):
+    """
+    Perform a dry-run IAC analysis.
+    Checks API Key, runs the scan, and outputs the results in JSON format to stdout.
+    Does NOT create assets or deploys on Conviso Platform.
+    """
+    try:
+        results = execute_dry_run(flow_context, repository_dir, scanner_timeout)
+
+        if results:
+            print(json.dumps(results, indent=2))
+        else:
+            print(json.dumps({}, indent=2))
+
+        if cleanup:
+            LOGGER.info("🧹 Cleaning up ...")
+            cleaner = Cleaner()
+            cleaner.cleanup()
+
+    except Exception as e:
+        on_http_error(e)
+        sys.exit(1)

convisoappsec/flowcli/iac/entrypoint.py

@@ -2,6 +2,7 @@ import click
 
 from convisoappsec.flowcli import help_option
 from .run import run
+from .dry_run import dry_run
 
 
 @click.group()
@@ -11,6 +12,7 @@ def iac():
 
 
 iac.add_command(run)
+iac.add_command(dry_run)
 
 iac.epilog = '''
   Run flow iac COMMAND --help for more information on a command.

convisoappsec/flowcli/iac/run.py

@@ -142,6 +142,7 @@ def run(context, flow_context, asset_id, company_id, repository_dir, send_to_flo
 def deploy_results_to_conviso(
         conviso_api, results_filepaths, asset_id, company_id, flow_context, deploy_id, commit_ref=None, control_sync_status_id=None
 ):
+
     results_context = click.progressbar(results_filepaths, label="Sending results to the Conviso Platform...")
 
     with results_context as reports:
@@ -150,7 +151,7 @@ def deploy_results_to_conviso(
                 with open(report_path) as report_file:
                     data = parse_data(json.load(report_file))
             except Exception:
-                LOGGER.warn(f"⚠️ Error processing report file. Our technical team has been notified.")
+                LOGGER.warning(f"⚠️ Error processing report file. Our technical team has been notified.")
                 full_trace = traceback.format_exc()
                 log_and_notify_ast_event(
                     flow_context=flow_context, company_id=company_id, asset_id=asset_id,
@@ -181,6 +182,8 @@ def deploy_results_to_conviso(
                 except ResponseError as error:
                     if error.code == 'RECORD_NOT_UNIQUE':
                         continue
+                    elif error.code == "Record not found" or "Record not found" in str(error):
+                        continue
                     else:
                         retry_handler = RetryHandler(
                             flow_context=flow_context, company_id=company_id, asset_id=asset_id

convisoappsec/flowcli/sast/dry_run.py

@@ -0,0 +1,159 @@
+import sys
+import click
+import traceback
+import json
+from convisoappsec.sast.sastbox import SASTBox
+from docker.errors import APIError
+import time
+from convisoappsec.flow import GitAdapter
+from convisoappsec.flowcli import help_option
+from convisoappsec.flowcli.context import pass_flow_context
+from convisoappsec.logger import LOGGER
+from convisoappsec.common.cleaner import Cleaner
+from convisoappsec.flowcli.common import on_http_error
+
+class DryRunSASTBox(SASTBox):
+    def recovery_technologies_file(self):
+        # Skip technology recovery and update for dry-run
+        pass
+
+def perform_dry_run_sastbox_scan(
+    conviso_rest_api, sastbox_registry, sastbox_repository_name, sastbox_tag, sastbox_skip_login, repository_dir, end_commit, start_commit, logger
+):
+    max_retries = 5
+    retries = 0
+    sastbox = DryRunSASTBox(registry=sastbox_registry, repository_name=sastbox_repository_name, tag=sastbox_tag)
+    pull_progress_bar = click.progressbar(length=sastbox.size, label="Performing SAST download...")
+
+    while retries < max_retries:
+        try:
+            if not sastbox_skip_login:
+                logger("Checking SASTBox authorization...")
+                token = conviso_rest_api.docker_registry.get_sast_token()
+                sastbox.login(token)
+
+            with pull_progress_bar as progressbar:
+                for downloaded_chunk in sastbox.pull():
+                    progressbar.update(downloaded_chunk)
+            break
+        except APIError as e:
+            retries += 1
+            logger(f"Retrying {retries}/{max_retries}...")
+            time.sleep(1)
+
+            if retries == max_retries:
+                logger("Max retries reached. Failed to perform SAST download.")
+                raise Exception(f"Max retries reached. Could not complete the SAST download. Error: {str(e)}")
+
+    logger("Starting SAST scan diff...")
+
+    reports = sastbox.run_scan_diff(repository_dir, end_commit, start_commit, log=logger)
+
+    logger("SAST scan diff done.")
+
+    results_filepaths = []
+    for r in reports:
+        try:
+            file_path = str(r)
+            results_filepaths.append(file_path)
+        except Exception as e:
+            click.echo(f"Error decoding file path: {r} with error {e}.", file=sys.stderr)
+
+    return results_filepaths
+
+def log_func(msg, new_line=True):
+    click.echo(msg, nl=new_line, err=True)
+
+def execute_dry_run(flow_context, end_commit, start_commit, repository_dir,
+                    sastbox_registry, sastbox_repository_name, sastbox_tag, sastbox_skip_login):
+    git_adapter = GitAdapter(repository_dir)
+    end_commit = end_commit or git_adapter.head_commit
+    start_commit = start_commit or git_adapter.empty_repository_tree_commit
+
+    if start_commit == end_commit:
+        return {}
+
+    conviso_rest_api = flow_context.create_conviso_rest_api_client()
+
+    results_filepaths = perform_dry_run_sastbox_scan(
+        conviso_rest_api, sastbox_registry, sastbox_repository_name, sastbox_tag,
+        sastbox_skip_login, repository_dir, end_commit, start_commit, log_func
+    )
+    
+    results_list = []
+    for path in results_filepaths:
+        try:
+            with open(path, 'r') as f:
+                results_list.append(json.load(f))
+        except Exception as e:
+            click.echo(f"Error reading result file {path}: {e}", file=sys.stderr)
+
+    if len(results_list) == 1:
+        return results_list[0]
+    return results_list
+
+@click.command(name='dry-run')
+@click.option(
+    "-s", "--start-commit", required=False,
+    help="If no value is set so the empty tree hash commit is used."
+)
+@click.option(
+    "-e", "--end-commit", required=False,
+    help="If no value is set so the HEAD commit from the current branch is used"
+)
+@click.option(
+    "-r", "--repository-dir", default=".", show_default=True,
+    type=click.Path(exists=True, resolve_path=True), required=False,
+    help="The source code repository directory."
+)
+@click.option(
+    "--sastbox-registry", default="", required=False, hidden=True,
+    envvar=("CONVISO_SASTBOX_REGISTRY", "FLOW_SASTBOX_REGISTRY"),
+)
+@click.option(
+    "--sastbox-repository-name", default="", required=False, hidden=True,
+    envvar=("CONVISO_SASTBOX_REPOSITORY_NAME", "FLOW_SASTBOX_REPOSITORY_NAME"),
+)
+@click.option(
+    "--sastbox-tag", default=SASTBox.DEFAULT_TAG, required=False, hidden=True,
+    envvar=("CONVISO_SASTBOX_TAG", "FLOW_SASTBOX_TAG"),
+)
+@click.option(
+    "--sastbox-skip-login/--sastbox-no-skip-login", default=False, required=False, hidden=True,
+    envvar=("CONVISO_SASTBOX_SKIP_LOGIN", "FLOW_SASTBOX_SKIP_LOGIN"),
+)
+@click.option(
+    '--cleanup', default=False, is_flag=True, show_default=True,
+    help="Clean up system resources."
+)
+@click.option(
+    "-o", "--output", required=False, help="Output the results to a JSON file."
+)
+@help_option
+@pass_flow_context
+def dry_run(flow_context, end_commit, start_commit, repository_dir,
+            sastbox_registry, sastbox_repository_name, sastbox_tag, sastbox_skip_login, cleanup, output):
+    try:
+        results = execute_dry_run(
+            flow_context, end_commit, start_commit, repository_dir,
+            sastbox_registry, sastbox_repository_name, sastbox_tag, sastbox_skip_login
+        )
+
+        if output:
+            with open(output, "w") as f:
+                json.dump(results if results else {}, f, indent=2)
+            LOGGER.info(f"Results saved to {output}")
+        elif results:
+            print(json.dumps(results, indent=2))
+        else:
+            print(json.dumps({}, indent=2))
+            
+        if cleanup:
+            LOGGER.info("🧹 Cleaning up ...")
+            cleaner = Cleaner()
+            cleaner.cleanup()
+
+    except Exception as e:
+        traceback.print_exc(file=sys.stderr)
+        on_http_error(e)
+        sys.exit(1)

convisoappsec/flowcli/sast/entrypoint.py

@@ -2,6 +2,7 @@ import click
 
 from convisoappsec.flowcli import help_option
 from .run import run
+from .dry_run import dry_run
 
 
 @click.group()
@@ -11,6 +12,7 @@ def sast():
 
 
 sast.add_command(run)
+sast.add_command(dry_run)
 
 sast.epilog = '''
   Run flow sast COMMAND --help for more information on a command.

convisoappsec/flowcli/sbom/generate.py

@@ -182,7 +182,7 @@ def generate(context, flow_context, asset_id, company_id, repository_dir, send_t
                 stderr=subprocess.DEVNULL
             )
             command = [f"./conviso/syft scan {repository_dir} -o cyclonedx-json={file_name} "
-                       f"--select-catalogers '{','.join(catalogers)}'"]
+                       f"--select-catalogers '{','.join(catalogers)}' --exclude ./conviso"]
 
             subprocess.run(command, shell=True, check=True, capture_output=True)
 

convisoappsec/flowcli/sca/dry_run.py

@@ -0,0 +1,108 @@
+import click
+import click_log
+import traceback
+import json
+import sys
+from convisoappsec.common.box import ContainerWrapper
+from convisoappsec.flowcli import help_option
+from convisoappsec.flowcli.context import pass_flow_context
+from convisoappsec.logger import LOGGER
+from convisoappsec.flowcli.common import on_http_error
+from convisoappsec.common.cleaner import Cleaner
+
+def log_func(msg, new_line=True):
+    click.echo(msg, nl=new_line, err=True)
+
+def execute_dry_run(flow_context, repository_dir, custom_sca_tags, scanner_timeout):
+    REQUIRED_CODEBASE_PATH = '/code'
+    OSV_SCANNER_IMAGE_NAME = 'osv_scanner'
+
+    scanners = {
+        OSV_SCANNER_IMAGE_NAME: {
+            'repository_name': OSV_SCANNER_IMAGE_NAME,
+            'tag': 'latest',
+            'command': [
+                '-c', REQUIRED_CODEBASE_PATH,
+                '-f', 'json',
+                '-o', '/{}.json'.format(OSV_SCANNER_IMAGE_NAME)
+            ],
+            'repository_dir': repository_dir
+        },
+    }
+
+    if custom_sca_tags:
+        for custom_tag in custom_sca_tags:
+            scan_name, tag = custom_tag
+            if scan_name in scanners.keys():
+                scanners[scan_name]['tag'] = tag
+
+    conviso_rest_api = flow_context.create_conviso_rest_api_client()
+    token = conviso_rest_api.docker_registry.get_sast_token()
+    
+    LOGGER.info('💬 Preparing Environment...')
+    scabox = ContainerWrapper(
+        token=token,
+        containers_map=scanners,
+        logger=LOGGER,
+        timeout=scanner_timeout
+    )
+    LOGGER.info('💬 Starting SCA...')
+    scabox.run()
+
+    results_list = []
+    for unit in scabox.scanners:
+        file_path = unit.results
+        if file_path:
+            try:
+                with open(file_path, 'r') as f:
+                    results_list.append(json.load(f))
+            except Exception as e:
+                click.echo(f"Error reading result file {file_path}: {e}", file=sys.stderr)
+
+    if len(results_list) == 1:
+        return results_list[0]
+    return results_list
+
+
+@click.command(name='dry-run')
+@click.option(
+    '-r', '--repository-dir', default=".", show_default=True,
+    type=click.Path(exists=True, resolve_path=True), required=False,
+    help="The source code repository directory."
+)
+@click.option(
+    "--custom-sca-tags", hidden=True, required=False, multiple=True, type=(str, str),
+    help="It should be passed as <repository_name> <image_tag>."
+)
+@click.option(
+    "--scanner-timeout", hidden=True, required=False, default=7200, type=int,
+    help="Set timeout for each scanner"
+)
+@click.option(
+    '--cleanup', default=False, is_flag=True, show_default=True,
+    help="Clean up system resources."
+)
+@help_option
+@pass_flow_context
+def dry_run(flow_context, repository_dir, custom_sca_tags, scanner_timeout, cleanup):
+    """
+    Perform a dry-run SCA analysis.
+    Checks API Key, runs the scan, and outputs the results in JSON format to stdout.
+    Does NOT create assets or deploys on Conviso Platform.
+    """
+    try:
+        results = execute_dry_run(flow_context, repository_dir, custom_sca_tags, scanner_timeout)
+
+        if results:
+             print(json.dumps(results, indent=2))
+        else:
+             print(json.dumps({}, indent=2))
+
+        if cleanup:
+            LOGGER.info("🧹 Cleaning up ...")
+            cleaner = Cleaner()
+            cleaner.cleanup()
+
+    except Exception as e:
+        on_http_error(e)
+        sys.exit(1)

convisoappsec/flowcli/sca/entrypoint.py

@@ -2,6 +2,7 @@ import click
 
 from convisoappsec.flowcli import help_option
 from .run import run
+from .dry_run import dry_run
 
 
 @click.group()
@@ -11,6 +12,7 @@ def sca():
 
 
 sca.add_command(run)
+sca.add_command(dry_run)
 
 sca.epilog = '''
   Run flow sca COMMAND --help for more information on a command.

convisoappsec/version.py

@@ -1 +1 @@
-__version__ = '3.0.0-dev.1'
+__version__ = '3.0.1'

convisoappsec/flow/source_code_scanner/__init__.py

@@ -1,9 +0,0 @@
-from .source_code_scanner import SourceCodeScanner # noqa
-from .exceptions import SourceCodeScannerException # noqa
-from .scc import SCC # noqa
-
-__all_ = [
-    'SourceCodeScanner',
-    'SourceCodeScannerException',
-    'SCC'
-]

convisoappsec/flow/source_code_scanner/exceptions.py

@@ -1,2 +0,0 @@
-class SourceCodeScannerException(RuntimeError):
-    pass

convisoappsec/flow/source_code_scanner/scc.py

@@ -1,68 +0,0 @@
-import yaml
-import tempfile
-
-from .source_code_scanner import SourceCodeScanner
-from .exceptions import SourceCodeScannerException
-
-
-class SCC(SourceCodeScanner):
-
-    def __init__(
-        self, 
-        source_code_dir, 
-        container_source_dir = '/code', 
-        create_source_code_volume = True
-    ):
-        super().__init__(
-            source_code_dir, 
-            create_source_code_volume=create_source_code_volume
-        )
-        self.__scan_result = {}
-        self.__container_source_dir = container_source_dir
-
-    @property
-    def repository(self):
-        return 'convisoappsec/scc'
-
-    @property
-    def tag(self):
-        return 'latest'
-
-    @property
-    def container_source_dir(self):
-        return self.__container_source_dir
-
-    def _read_scan_stdout(self, stdout_generator):
-        with tempfile.TemporaryFile() as yaml_output:
-            for chunk in stdout_generator:
-                yaml_output.write(chunk)
-
-            yaml_output.seek(0)
-
-            self.__scan_result = yaml.load(
-                yaml_output,
-                Loader=yaml.FullLoader
-            )
-
-    @property
-    def summary(self):
-        summary = self.__scan_result.get('SUM')
-        if not summary:
-            raise SourceCodeScannerException(
-                'Unexpected error retrienving source code summary metrics'
-            )
-
-        return summary
-
-    @property
-    def total_source_code_lines(self):
-        return self.summary.get('code')
-
-    @property
-    def command(self):
-        return [
-            '--no-cocomo',
-            '--no-complexity',
-            '--format',
-            'cloc-yaml'
-        ]

convisoappsec/flow/source_code_scanner/source_code_scanner.py

@@ -1,177 +0,0 @@
-import docker
-from contextlib import suppress
-import tempfile
-from uuid import uuid4
-
-from convisoappsec.flow.util import SourceCodeCompressor
-from .exceptions import SourceCodeScannerException
-
-
-class SourceCodeScanner(object):
-    SUCCESS_EXIT_CODE = 0
-    '''
-    hooks:
-      def _pre_pull(self):
-          :return: void
-
-      def _capture_stdout(self, stdout_bytes)
-        :param stdout_bytes: chunks generated by stdout
-        :paramtype stdout_bytes: bytes
-        :return: void
-    _pre_scan
-    _scan_stdout
-    _post_scan
-    '''
-
-    def __init__(self, source_code_dir, create_source_code_volume = True):
-        uuid = str(uuid4())
-        self.docker = docker.from_env(version="auto")
-        self.__container_name = "source_code_scanner_{0}".format(
-            uuid
-        )
-        self.__source_code_dir = source_code_dir
-        self.__create_source_code_volume = create_source_code_volume
-
-        if self.__create_source_code_volume:
-            self.__source_code_volume_name = "source_code_scanner_src_{0}".format(
-                uuid
-            )
-        else:
-            self.__source_code_volume_name = None
-
-    @property
-    def repository(self):
-        raise Exception('Not implemented yet!')
-
-    @property
-    def tag(self):
-        raise Exception('Not implemented yet!')
-
-    @property
-    def command(self):
-        raise Exception('Not implemented yet!')
-
-    @property
-    def container_source_dir(self):
-        raise Exception('Not implemented yet!')
-
-    @property
-    def image(self):
-        return "{repository}:{tag}".format(
-            repository=self.repository,
-            tag=self.tag,
-        )
-
-    @property
-    def volumes(self):
-        if not self.__create_source_code_volume:
-            return {}
-
-        return {
-            self.__source_code_volume_name: {
-                'bind': self.container_source_dir,
-                'mode': 'rw',
-            }
-        }
-
-    def __get_container(self):
-        return self.docker.containers.get(
-            self.__container_name
-        )
-
-    def __get_source_code_volume(self):
-        return self.docker.volumes.get(
-            self.__source_code_volume_name
-        )
-
-    @property
-    def __container(self):
-        try:
-            return self.__get_container()
-        except docker.errors.NotFound:
-            return self.__create_container()
-
-    def __create_container(self):
-        return self.docker.containers.create(
-            self.image,
-            name=self.__container_name,
-            volumes=self.volumes,
-            detach=True,
-            command=self.command,
-            working_dir=self.container_source_dir if self.container_source_dir != '/code' else '/code'
-        )
-
-    def __pull_image(self):
-        if self.has_pre_pull:
-            self._pre_pull()
-
-        self.docker.images.pull(self.repository, self.tag)
-
-    def __load_source_code(self):
-        container = self.__container
-
-        with tempfile.TemporaryFile() as fileobj:
-            compressor = SourceCodeCompressor(
-                self.__source_code_dir
-            )
-
-            compressor.write_to(fileobj)
-            fileobj.seek(0)
-
-            container.put_archive(
-                self.container_source_dir,
-                fileobj
-            )
-
-    def scan(self):
-        self.__pull_image()
-        self.__load_source_code()
-        container = self.__container
-
-        container.start()
-
-        if self.has_read_scan_stderr:
-            self._read_scan_stderr(
-                container.logs(
-                    stream=True, stdout=False, stderr=True
-                )
-            )
-
-        if self.has_read_scan_stdout:
-            self._read_scan_stdout(
-                container.logs(
-                    stream=True, stdout=True, stderr=False
-                )
-            )
-
-        wait_result = container.wait()
-        status_code = wait_result.get('StatusCode')
-
-        if not status_code == self.SUCCESS_EXIT_CODE:
-            raise SourceCodeScannerException(
-                'Source code scanning fail'
-            )
-
-    def __has_method(self, method_name):
-        return hasattr(self, method_name)
-
-    @property
-    def has_read_scan_stdout(self):
-        return self.__has_method('_read_scan_stdout')
-
-    @property
-    def has_read_scan_stderr(self):
-        return self.__has_method('_read_scan_stderr')
-
-    @property
-    def has_pre_pull(self):
-        return self.__has_method('_pre_pull')
-
-    def __del__(self):
-        with suppress(Exception):
-            container = self.__get_container()
-            container.remove()
-
-        with suppress(Exception):
-            source_code_volume = self.__get_source_code_volume()
-            source_code_volume.remove()

convisoappsec/flow/util/metrics.py

@@ -1,16 +0,0 @@
-from convisoappsec.flow.source_code_scanner import SCC
-from convisoappsec.logger import LOGGER
-import docker
-
-def project_metrics(source_code_dir):
-    try:
-        scanner = SCC(source_code_dir, create_source_code_volume=False)
-        scanner.scan()
-        return {
-            'total_lines': scanner.total_source_code_lines
-        }
-    except docker.errors.APIError as e:
-        LOGGER.error('Error on fetch project metrics')
-        LOGGER.exception(e)
-        return {}
-