corgea-cli 1.9.3__tar.gz → 1.10.0__tar.gz

{corgea_cli-1.9.3 → corgea_cli-1.10.0}/.github/workflows/test.yml

@@ -4,9 +4,11 @@ on:
   push:
     branches:
       - main
-      - master
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   rust-tests:
     runs-on: ubuntu-latest

{corgea_cli-1.9.3 → corgea_cli-1.10.0}/Cargo.lock

@@ -369,7 +369,7 @@ checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
 
 [[package]]
 name = "corgea"
-version = "1.9.3"
+version = "1.10.0"
 dependencies = [
  "chrono",
  "clap",

{corgea_cli-1.9.3 → corgea_cli-1.10.0}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "corgea"
-version = "1.9.3"
+version = "1.10.0"
 edition = "2021"
 readme = "README.md"
 

{corgea_cli-1.9.3 → corgea_cli-1.10.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: corgea-cli
-Version: 1.9.3
+Version: 1.10.0
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Environment :: Console
 Classifier: Intended Audience :: Developers

{corgea_cli-1.9.3 → corgea_cli-1.10.0}/skills/corgea/SKILL.md

@@ -35,8 +35,12 @@ corgea scan --scan-type policy --policy 1      # Specific policy ID
 corgea scan --fail-on CR                       # Exit 1 on critical issues (CR, HI, ME, LO)
 corgea scan --fail-on malicious                # Exit 1 if any dependency is classified malicious
 corgea scan --fail-on HI,malicious             # Comma-separated conditions combine
-corgea scan --fail                             # Exit 1 based on project blocking rules
+corgea scan --block-on criticals               # Exit 1 if the scan violates the named CI blocking rules
+corgea scan --block-on criticals,malicious-deps  # Comma-separated rule slugs
+corgea scan --fail                             # Deprecated: exit 1 based on every active blocking rule
 corgea scan --out-format json --out-file r.json   # Export (json, html, sarif, markdown)
+corgea scan --sbom                             # Also write a CycloneDX SBOM to bom.json
+corgea scan --sbom sbom.cdx.json               # SBOM to a custom file
 corgea scan --project-name my-service          # Override project name
 ```
 
@@ -44,7 +48,11 @@ Scan types: `blast` (base AI), `policy` (PolicyIQ), `malicious`, `secrets`, `pii
 
 `--fail-on` takes comma-separated conditions: severity thresholds `CR`, `HI`, `ME`, `LO` (trip at or above the level) and/or `malicious` (trips when any dependency in the scan is classified malicious). Use `malicious` to block supply-chain findings in CI across every ecosystem the scan covers, including those the `corgea npm`/`corgea pip` install gate does not.
 
-`--only-uncommitted` and `--target` are mutually exclusive. `--fail-on` and `--fail` are mutually exclusive.
+`--block-on` takes comma-separated blocking-rule slugs. Blocking rules are configured in the web app and each one applies either to pull requests or to CI. Only CI rules can be named by `--block-on`; a slug that is unknown, inactive, or scoped to pull requests is a hard error (exit 1) rather than a silently skipped gate. The slug is shown next to each rule in the web app and is derived from the rule name, so renaming a rule changes its slug. Name rules for the condition that trips them — `criticals`, not `no-criticals` — so that `--block-on` reads as a direct assertion rather than a double negative.
+
+`--fail` is deprecated. It evaluates every active blocking rule regardless of what it applies to; use `--block-on` to name the CI rules a pipeline should enforce.
+
+`--only-uncommitted` and `--target` are mutually exclusive. `--fail-on`, `--fail`, and `--block-on` are mutually exclusive.
 
 ### Upload — `corgea upload [report]`
 
@@ -75,6 +83,7 @@ corgea wait --scan-id SCAN_ID                  # Wait for specific scan
 corgea ls                                      # List scans
 corgea ls --issues --scan-id SCAN_ID           # Issues for a scan
 corgea ls --sca-issues                         # SCA (dependency) issues
+corgea ls --code-quality                       # Code quality issues
 corgea ls --issues --page 2 --page-size 10     # Pagination
 corgea ls --issues --scan-id SCAN_ID --json    # JSON output
 ```
@@ -83,6 +92,7 @@ corgea ls --issues --scan-id SCAN_ID --json    # JSON output
 |------|-------|-------------|
 | `--issues` | `-i` | List code/SAST issues |
 | `--sca-issues` | `-c` | List SCA issues |
+| `--code-quality` | `-q` | List code quality issues (alias `--quality`) |
 | `--scan-id` | `-s` | Filter to a scan |
 | `--page` | `-p` | Page number |
 | `--page-size` | | Items per page |
@@ -354,6 +364,7 @@ corgea inspect --issue --diff ISSUE_ID
 ```bash
 corgea scan --fail-on CR --out-format sarif --out-file results.sarif
 corgea scan --fail-on CR,malicious --out-format sarif --out-file results.sarif  # also block malicious dependencies
+corgea scan --block-on criticals --out-format sarif --out-file results.sarif  # gate on a CI blocking rule from the web app
 ```
 
 ### Upload third-party reports
@@ -367,6 +378,7 @@ corgea upload report.json --project-name my-app
 ```bash
 corgea scan --out-format html --out-file report.html
 corgea scan --out-format sarif --out-file report.sarif
+corgea scan --out-format sarif --out-file report.sarif --sbom bom.json  # SARIF + CycloneDX SBOM
 ```
 
 ## Severity Levels

{corgea_cli-1.9.3 → corgea_cli-1.10.0}/src/config.rs

@@ -4,6 +4,14 @@ use std::{env, fs, io};
 
 pub const DEFAULT_VULN_API_URL: &str = "https://cve-worker-staging.corgea.workers.dev";
 
+/// Whether `DEFAULT_VULN_API_URL` is an endpoint Corgea tokens belong to.
+/// The `-staging` hostname is historical: this worker serves as the production
+/// vuln-api, so a token may be sent to it and authenticated (fail-closed)
+/// verdicts apply by default. Set to `false` if the default is ever repointed
+/// at an endpoint that customer tokens should not reach — token-send and
+/// fail-closed then both require the explicit opt-in.
+pub const DEFAULT_VULN_API_URL_IS_PRODUCTION: bool = true;
+
 #[derive(Serialize, Deserialize, Clone)]
 pub struct Config {
     pub(crate) url: String,

{corgea_cli-1.9.3 → corgea_cli-1.10.0}/src/deps/ecosystems/maven.rs

@@ -5,7 +5,7 @@ use crate::deps::ecosystems::classify_constraint;
 use crate::deps::ecosystems::evaluate::{
     constraint_to_findings, dep001, file_in_dir, parent_dir, ScanContext,
 };
-use crate::deps::model::{DependencyNode, Ecosystem, PackageId, Scope, SourceType};
+use crate::deps::model::{DependencyEdge, DependencyNode, Ecosystem, PackageId, Scope, SourceType};
 use crate::deps::DepsError;
 
 pub fn scan_maven_projects(ctx: &mut ScanContext<'_>) -> Result<(), DepsError> {
@@ -68,6 +68,14 @@ fn scan_maven_pom(ctx: &mut ScanContext<'_>, dir: &Path, pom_path: &Path) -> Res
             Some(package_id.clone()),
             false,
         ));
+        ctx.graph.edges.push(DependencyEdge {
+            from: PackageId::root(),
+            to: package_id.clone(),
+            declared_constraint: declared.clone(),
+            resolved_version: Some(dep.version.clone()),
+            scope: dep.scope,
+            source_file: rel.clone(),
+        });
         ctx.graph.nodes.push(DependencyNode {
             id: package_id,
             name,
@@ -89,8 +97,178 @@ fn scan_maven_pom(ctx: &mut ScanContext<'_>, dir: &Path, pom_path: &Path) -> Res
     Ok(())
 }
 
+/// Sections whose contents are not the project's own coordinates or
+/// dependencies; stripped before any dependency or property extraction.
+const NON_DEPENDENCY_SECTIONS: &[&str] = &["profiles", "build", "reporting"];
+
 fn parse_pom_dependencies(content: &str) -> Result<Vec<MavenDep>, DepsError> {
-    Ok(parse_pom_regex(content))
+    let stripped = strip_sections(content, NON_DEPENDENCY_SECTIONS);
+    let props = parse_pom_properties(&stripped);
+    let (rest, management) = split_dependency_management(&stripped);
+    let managed: std::collections::HashMap<(String, String), String> = parse_pom_regex(management)
+        .into_iter()
+        .filter(|d| !d.version.is_empty())
+        .map(|d| ((d.group, d.artifact), d.version))
+        .collect();
+    let mut deps = parse_pom_regex(&rest);
+    for dep in &mut deps {
+        if dep.version.is_empty() {
+            if let Some(v) = managed.get(&(dep.group.clone(), dep.artifact.clone())) {
+                dep.version = v.clone();
+            }
+        }
+        dep.version = resolve_placeholders(&dep.version, &props);
+    }
+    Ok(deps)
+}
+
+/// Remove every `<tag>...</tag>` section. Their dependency blocks are not
+/// application dependencies, and a profile's `<properties>` or
+/// `<dependencyManagement>` must not affect the base dependency graph, so
+/// stripping runs before property and management extraction.
+fn strip_sections(content: &str, tags: &[&str]) -> String {
+    let mut content = content.to_string();
+    for tag in tags {
+        while let Some((rest, _)) = split_section(&content, tag) {
+            content = rest;
+        }
+    }
+    content
+}
+
+/// Split out the `<dependencyManagement>` section: its entries pin versions
+/// for the project's dependencies but are not dependencies themselves.
+/// Returns (pom without the section, the section's inner content).
+fn split_dependency_management(content: &str) -> (String, &str) {
+    split_section(content, "dependencyManagement").unwrap_or_else(|| (content.to_string(), ""))
+}
+
+/// Locate a `<tag>...</tag>` section and split content into (content with
+/// the section removed, the section's inner content). `None` if the tag
+/// isn't present or is malformed (close before open).
+fn split_section<'a>(content: &'a str, tag: &str) -> Option<(String, &'a str)> {
+    let open = format!("<{tag}>");
+    let close = format!("</{tag}>");
+    let s = content.find(&open)?;
+    let e = content.find(&close)?;
+    if s >= e {
+        return None;
+    }
+    let inner = &content[s + open.len()..e];
+    let rest = format!("{}{}", &content[..s], &content[e + close.len()..]);
+    Some((rest, inner))
+}
+
+/// Collect `<properties>` entries plus the built-in `project.version`.
+fn parse_pom_properties(content: &str) -> std::collections::HashMap<String, String> {
+    let mut props = std::collections::HashMap::new();
+    if let Some(start) = content.find("<properties>") {
+        let rest = &content[start + "<properties>".len()..];
+        if let Some(end) = rest.find("</properties>") {
+            let mut block = &rest[..end];
+            while let Some(open_start) = block.find('<') {
+                let after = &block[open_start + 1..];
+                let Some(open_end) = after.find('>') else {
+                    break;
+                };
+                let tag = after[..open_end].trim();
+                let body = &after[open_end + 1..];
+                if tag.starts_with('/') || tag.starts_with('!') || tag.ends_with('/') {
+                    block = body;
+                    continue;
+                }
+                let close = format!("</{tag}>");
+                match body.find(&close) {
+                    Some(close_pos) => {
+                        props.insert(tag.to_string(), body[..close_pos].trim().to_string());
+                        block = &body[close_pos + close.len()..];
+                    }
+                    None => block = body,
+                }
+            }
+        }
+    }
+    // Property values may reference other properties; resolve the map to a
+    // fixed point, bounded to guard against definition cycles.
+    resolve_props_fixed_point(&mut props);
+    let project_version = resolve_placeholders(&pom_project_version(content), &props);
+    if !project_version.is_empty() && !project_version.contains("${") {
+        props.insert("project.version".to_string(), project_version);
+    }
+    // Properties aliasing ${project.version} (e.g. `<shared.version>`) only
+    // resolve now that project.version itself is in the map.
+    resolve_props_fixed_point(&mut props);
+    props
+}
+
+/// Resolve `${...}` references among property values to a fixed point. A
+/// resolution chain can't be longer than the number of properties without
+/// a cycle, so bound the iteration count by the map size.
+fn resolve_props_fixed_point(props: &mut std::collections::HashMap<String, String>) {
+    for _ in 0..=props.len() {
+        let resolved: std::collections::HashMap<String, String> = props
+            .iter()
+            .map(|(k, v)| (k.clone(), resolve_placeholders(v, props)))
+            .collect();
+        if resolved == *props {
+            break;
+        }
+        *props = resolved;
+    }
+}
+
+/// The pom's own `<version>`: first `<version>` before `<dependencies>`,
+/// excluding the `<parent>` block. A child that inherits its version has
+/// none of its own, so fall back to the parent's (Maven's inheritance rule).
+fn pom_project_version(content: &str) -> String {
+    let head = content.split("<dependencies>").next().unwrap_or(content);
+    // The project's own <version> lives among its coordinates, before any
+    // nested section that may carry unrelated <version> tags of its own
+    // (plugin versions in <build>, managed versions in
+    // <dependencyManagement>, etc).
+    let nested_start = NON_DEPENDENCY_SECTIONS
+        .iter()
+        .copied()
+        .chain(["dependencyManagement"])
+        .filter_map(|tag| head.find(&format!("<{tag}>")))
+        .min();
+    let head = match nested_start {
+        Some(pos) => &head[..pos],
+        None => head,
+    };
+    if let Some((cleaned, parent)) = split_section(head, "parent") {
+        let own = extract_xml_tag(&cleaned, "version");
+        if !own.is_empty() {
+            return own;
+        }
+        return extract_xml_tag(parent, "version");
+    }
+    extract_xml_tag(head, "version")
+}
+
+/// Substitute `${name}` placeholders; unresolved ones pass through unchanged.
+fn resolve_placeholders(raw: &str, props: &std::collections::HashMap<String, String>) -> String {
+    if !raw.contains("${") {
+        return raw.to_string();
+    }
+    let mut out = String::new();
+    let mut rest = raw;
+    while let Some(start) = rest.find("${") {
+        out.push_str(&rest[..start]);
+        let after = &rest[start + 2..];
+        let Some(end) = after.find('}') else {
+            out.push_str(&rest[start..]);
+            return out;
+        };
+        let key = &after[..end];
+        match props.get(key) {
+            Some(v) => out.push_str(v),
+            None => out.push_str(&rest[start..start + 2 + end + 1]),
+        }
+        rest = &after[end + 1..];
+    }
+    out.push_str(rest);
+    out
 }
 
 fn parse_pom_regex(content: &str) -> Vec<MavenDep> {

{corgea_cli-1.9.3 → corgea_cli-1.10.0}/src/deps/ecosystems/mod.rs

@@ -10,6 +10,16 @@ pub fn scan_all(ctx: &mut ScanContext<'_>) -> Result<(), DepsError> {
     evaluate::scan_all(ctx)
 }
 
+/// Whether `scan_all` builds graph nodes for this ecosystem. Keep in sync
+/// with the scanners wired in `evaluate::scan_all` — detect-only ecosystems
+/// (Go, Cargo) are found on disk but contribute nothing to the graph or SBOM.
+pub fn is_graphed(ecosystem: Ecosystem) -> bool {
+    matches!(
+        ecosystem,
+        Ecosystem::Npm | Ecosystem::PyPI | Ecosystem::Maven
+    )
+}
+
 use crate::deps::model::{ConstraintKind, Ecosystem};
 
 /// Classify a raw declared constraint string.

{corgea_cli-1.9.3 → corgea_cli-1.10.0}/src/deps/mod.rs

@@ -62,6 +62,13 @@ impl Inventory {
 
 /// Scan a directory tree: detect files, build the graph, evaluate policy.
 pub fn scan(root: &Path, policy: &Policy) -> Result<Inventory, DepsError> {
+    if !root.exists() {
+        return Err(DepsError(format!(
+            "path does not exist: {}",
+            root.display()
+        )));
+    }
+
     let detected = detect::detect_dependency_files(root);
     let mut graph = DependencyGraph::default();
     let mut findings = Vec::new();

corgea_cli-1.10.0/src/deps/report.rs

@@ -0,0 +1,261 @@
+use serde_json::{json, Value};
+use std::fmt::Write as _;
+
+use crate::deps::detect::DetectedFile;
+use crate::deps::model::{DependencyGraph, Ecosystem, PackageId};
+use crate::deps::Inventory;
+
+/// Load the policy at `root`, scan the tree, and emit a CycloneDX SBOM.
+pub fn sbom(root: &std::path::Path) -> Result<Value, crate::deps::DepsError> {
+    let policy = crate::deps::run::load_policy(root)?;
+    let inv = crate::deps::scan(root, &policy)?;
+    warn_unsupported_ecosystems(&inv.detected_files);
+    Ok(to_cyclonedx(&inv))
+}
+
+/// Print one deduplicated stderr warning per detected ecosystem that
+/// `to_cyclonedx` does not emit components for (currently Go and Cargo),
+/// so `deps sbom` / `scan --sbom` don't silently produce an empty-looking
+/// SBOM for those trees.
+pub fn warn_unsupported_ecosystems(detected: &[DetectedFile]) {
+    let mut by_ecosystem: std::collections::BTreeMap<
+        &'static str,
+        std::collections::BTreeSet<String>,
+    > = std::collections::BTreeMap::new();
+
+    for f in detected {
+        let Some(label) = unsupported_ecosystem_label(f.ecosystem) else {
+            continue;
+        };
+        let file_name = f
+            .path
+            .file_name()
+            .map(|n| n.to_string_lossy().into_owned())
+            .unwrap_or_default();
+        by_ecosystem.entry(label).or_default().insert(file_name);
+    }
+
+    for (label, files) in by_ecosystem {
+        let files: Vec<String> = files.into_iter().collect();
+        eprintln!(
+            "Warning: detected {} but {} is not yet included in SBOMs",
+            files.join(", "),
+            label
+        );
+    }
+}
+
+fn unsupported_ecosystem_label(ecosystem: Ecosystem) -> Option<&'static str> {
+    if crate::deps::ecosystems::is_graphed(ecosystem) {
+        return None;
+    }
+    Some(match ecosystem {
+        Ecosystem::Go => "Go",
+        Ecosystem::Cargo => "Cargo",
+        _ => "this ecosystem",
+    })
+}
+
+pub fn to_json(inv: &Inventory) -> Value {
+    inventory_to_json(inv)
+}
+
+pub fn to_sarif(inv: &Inventory) -> Value {
+    let rules: Vec<Value> = inv
+        .findings
+        .iter()
+        .map(|f| {
+            json!({
+                "id": f.id,
+                "name": f.title,
+                "shortDescription": { "text": f.title },
+            })
+        })
+        .collect();
+
+    let results: Vec<Value> = inv
+        .findings
+        .iter()
+        .map(|f| {
+            json!({
+                "ruleId": f.id,
+                "level": severity_to_sarif(f.severity),
+                "message": { "text": f.recommendation },
+            })
+        })
+        .collect();
+
+    json!({
+        "version": "2.1.0",
+        "runs": [{
+            "tool": {
+                "driver": {
+                    "name": "corgea-deps",
+                    "rules": rules,
+                }
+            },
+            "results": results,
+        }]
+    })
+}
+
+fn severity_to_sarif(sev: crate::deps::model::Severity) -> &'static str {
+    use crate::deps::model::Severity;
+    match sev {
+        Severity::Critical | Severity::High => "error",
+        Severity::Medium => "warning",
+        Severity::Low | Severity::Info => "note",
+    }
+}
+
+/// A version is resolved when it names a concrete release — not empty, not
+/// the `?` placeholder for lockfile-less manifests, not an unsubstituted
+/// `${...}` Maven property. Unresolved versions (and the purls fabricated
+/// from them) must be omitted, or the document fails CycloneDX 1.7 validation.
+fn is_resolved_version(version: &str) -> bool {
+    !version.is_empty() && version != "?" && !version.contains("${")
+}
+
+pub fn to_cyclonedx(inv: &Inventory) -> Value {
+    let graph = &inv.graph;
+    // Deduplicate by bom-ref: multi-module trees list the same package once
+    // per manifest, but the schema sets uniqueItems on components.
+    let mut components: std::collections::BTreeMap<&str, Value> = std::collections::BTreeMap::new();
+    for n in graph.nodes.iter().filter(|n| *n.id() != PackageId::root()) {
+        let mut c = json!({
+            "type": "library",
+            "bom-ref": n.id().0,
+            "name": n.name(),
+        });
+        if let Some(v) = n.version().filter(|v| is_resolved_version(v)) {
+            c["version"] = json!(v);
+            c["purl"] = json!(n.id().0);
+        }
+        components.entry(&n.id().0).or_insert(c);
+    }
+    let components: Vec<Value> = components.into_values().collect();
+
+    let mut depends_on: std::collections::BTreeMap<&str, std::collections::BTreeSet<&str>> =
+        std::collections::BTreeMap::new();
+    for e in &graph.edges {
+        depends_on.entry(&e.from.0).or_default().insert(&e.to.0);
+    }
+    let deps: Vec<Value> = depends_on
+        .iter()
+        .map(|(from, tos)| {
+            json!({
+                "ref": from,
+                "dependsOn": tos,
+            })
+        })
+        .collect();
+
+    let root_name = std::fs::canonicalize(&inv.root)
+        .ok()
+        .and_then(|p| p.file_name().map(|n| n.to_string_lossy().into_owned()))
+        .unwrap_or_else(|| "project".to_string());
+
+    json!({
+        "bomFormat": "CycloneDX",
+        "specVersion": "1.7",
+        "serialNumber": format!("urn:uuid:{}", uuid::Uuid::new_v4()),
+        "version": 1,
+        "metadata": {
+            "timestamp": chrono::Utc::now().to_rfc3339_opts(chrono::SecondsFormat::Secs, true),
+            "tools": {
+                "components": [{
+                    "type": "application",
+                    "name": "corgea",
+                    "version": env!("CARGO_PKG_VERSION"),
+                }]
+            },
+            "component": {
+                "type": "application",
+                "bom-ref": "root",
+                "name": root_name,
+            },
+        },
+        "components": components,
+        "dependencies": deps,
+    })
+}
+
+pub fn graph_nodes_json(graph: &DependencyGraph) -> Vec<Value> {
+    graph
+        .nodes
+        .iter()
+        .map(|n| {
+            json!({
+                "id": n.id().0,
+                "name": n.name(),
+                "version": n.version(),
+                "direct": n.is_direct(),
+                "scope": format!("{:?}", n.scope()),
+                "depth": n.depth(),
+            })
+        })
+        .collect()
+}
+
+pub fn inventory_to_json(inv: &Inventory) -> Value {
+    let nodes = graph_nodes_json(&inv.graph);
+
+    let findings: Vec<Value> = inv
+        .findings
+        .iter()
+        .map(|f| {
+            json!({
+                "id": f.id,
+                "severity": format!("{:?}", f.severity),
+                "title": f.title,
+                "package": f.package.as_ref().map(|p| p.0.clone()),
+                "reproducible": f.reproducible,
+                "recommendation": f.recommendation,
+            })
+        })
+        .collect();
+
+    json!({
+        "root": inv.root,
+        "nodes": nodes,
+        "findings": findings,
+    })
+}
+
+pub fn table_output(inv: &Inventory) -> String {
+    let mut out = String::new();
+    writeln!(&mut out, "Corgea dependency inventory\n").unwrap();
+    writeln!(
+        &mut out,
+        "Detected {} dependency file(s)",
+        inv.detected_files.len()
+    )
+    .unwrap();
+    writeln!(
+        &mut out,
+        "Inventory: {} packages, {} findings\n",
+        inv.graph.nodes.len(),
+        inv.findings.len()
+    )
+    .unwrap();
+
+    let mut by_sev: std::collections::BTreeMap<String, usize> = std::collections::BTreeMap::new();
+    for f in &inv.findings {
+        *by_sev.entry(format!("{:?}", f.severity)).or_default() += 1;
+    }
+    for (sev, count) in by_sev {
+        writeln!(&mut out, "  {sev}: {count}").unwrap();
+    }
+
+    for f in &inv.findings {
+        let pkg = f.package.as_ref().map(|p| p.name()).unwrap_or("project");
+        writeln!(&mut out, "\n  {}  {:?}  {}", f.id, f.severity, f.title).unwrap();
+        writeln!(&mut out, "    package: {pkg}").unwrap();
+        writeln!(&mut out, "    {}", f.recommendation).unwrap();
+    }
+    out
+}
+
+pub fn print_table(inv: &Inventory) {
+    print!("{}", table_output(inv));
+}

{corgea_cli-1.9.3 → corgea_cli-1.10.0}/src/deps/run.rs

@@ -9,7 +9,7 @@ use serde_json::{json, Value};
 use crate::deps::findings::Finding;
 use crate::deps::model::{DependencyNode, Severity};
 use crate::deps::policy::Policy;
-use crate::deps::report::{graph_nodes_json, table_output, to_cyclonedx, to_json, to_sarif};
+use crate::deps::report::{graph_nodes_json, table_output, to_json, to_sarif};
 use crate::deps::{scan, DepsError};
 
 #[derive(Subcommand, Debug, Clone)]
@@ -236,13 +236,10 @@ fn run_inner(sub: DepsSubcommand) -> Result<u8, DepsError> {
             Ok(0)
         }
         DepsSubcommand::Sbom { format, path, out } => {
-            let root = Path::new(&path);
-            let policy = load_policy(root)?;
-            let inv = scan(root, &policy)?;
             if format != "cyclonedx" {
                 return Err(DepsError(format!("unsupported SBOM format: {format}")));
             }
-            let sbom = to_cyclonedx(&inv.graph).to_string();
+            let sbom = crate::deps::report::sbom(Path::new(&path))?.to_string();
             if let Some(out_path) = out {
                 std::fs::write(&out_path, sbom)
                     .map_err(|e| DepsError(format!("write sbom: {e}")))?;
@@ -728,7 +725,7 @@ fn shell_word(value: &str) -> String {
     format!("'{}'", value.replace('\'', "'\\''"))
 }
 
-fn load_policy(root: &Path) -> Result<Policy, DepsError> {
+pub(crate) fn load_policy(root: &Path) -> Result<Policy, DepsError> {
     let policy_path = root.join(".corgea").join("deps.yml");
     if !policy_path.exists() {
         return Ok(Policy::default());