corgea-cli 1.9.3__tar.gz → 1.11.0__tar.gz

{corgea_cli-1.9.3 → corgea_cli-1.11.0}/.github/workflows/test.yml

@@ -4,9 +4,11 @@ on:
   push:
     branches:
       - main
-      - master
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   rust-tests:
     runs-on: ubuntu-latest

{corgea_cli-1.9.3 → corgea_cli-1.11.0}/Cargo.lock

@@ -369,7 +369,7 @@ checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
 
 [[package]]
 name = "corgea"
-version = "1.9.3"
+version = "1.11.0"
 dependencies = [
  "chrono",
  "clap",

{corgea_cli-1.9.3 → corgea_cli-1.11.0}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "corgea"
-version = "1.9.3"
+version = "1.11.0"
 edition = "2021"
 readme = "README.md"
 
@@ -17,7 +17,7 @@ test-stub = []
 
 [dev-dependencies]
 corgea = { path = ".", features = ["test-stub"] }
-tempfile = "3.12.0"
+tempfile = "3.20.0"
 
 [dependencies]
 clap = { version = "4.4.13", features = ["derive"] }
@@ -41,7 +41,7 @@ serde_derive = "1.0.195"
 uuid = { version = "1.7.0", features = ["v4"] }
 which = "6.0.0"
 zip = "2.3.0"
-tempfile = "3.12.0"
+tempfile = "3.20.0"
 quick-xml = "0.41"
 ignore = "0.4"
 globset = "0.4"

{corgea_cli-1.9.3 → corgea_cli-1.11.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: corgea-cli
-Version: 1.9.3
+Version: 1.11.0
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Environment :: Console
 Classifier: Intended Audience :: Developers

{corgea_cli-1.9.3 → corgea_cli-1.11.0}/README.md

@@ -31,6 +31,64 @@ Once the binary is installed, login with your token from the Corgea app.
 corgea login <token>
 ```
 
+## Scanning
+
+`corgea scan` uploads your project and waits for results. `corgea wait [scan_id]`
+attaches to a running scan; `corgea upload <report> --wait` does the same for a
+third-party report.
+
+All three exit 1 if the scan fails, printing the reason and the scanners that hit
+problems. A scan that completes with a scanner missing exits 0 with a warning.
+Waiting gives up after 10 hours; override with `CORGEA_SCAN_TIMEOUT_SECONDS`.
+`--fail`/`--block-on` then wait up to 15 minutes for blocking rules to be
+evaluated; override with `CORGEA_BLOCKING_RULES_TIMEOUT_SECONDS`.
+
+`--out-format`/`--out-file` and `--sbom` are honored whether or not a gate
+trips: both are written before `--fail`/`--block-on` are evaluated, so a scan
+that exits 1 on a blocking rule still leaves its report behind to ingest.
+
+### Skipping a re-scan of the same commit
+
+A pipeline that re-runs on an unchanged commit can reuse the scan it already
+has instead of paying for a duplicate:
+
+```bash
+corgea scan --skip-if-commit-scanned-recently --block-on criticals
+corgea scan --skip-if-commit-scanned-recently --scanned-within 4h   # 90s, 30m, 4h, 7d
+```
+
+When the project already has a completed scan of the current commit inside the
+window (24h by default), that scan takes the new scan's place: the results
+table, the `--block-on` gate and its exit code, and any `--out-file` report all
+come from it, so the pipeline behaves the same whether or not a scan ran. The
+window exists because unchanged code is still exposed to advisories published
+since it was last scanned.
+
+Two lines make the outcome scriptable — `CORGEA_SCAN_SKIPPED=true` plus
+`CORGEA_SCAN_ID=<id>` when a scan was reused, `CORGEA_SCAN_SKIPPED=false` when
+one ran — so a later step (an ingest, say) can branch on it.
+
+Only a scan that answers the same question is reused, which is stricter than
+"same commit". A candidate has to be a completed BLAST scan of that commit, on a
+branch rather than a pull request, from an explicitly clean worktree, with no
+scanner problems reported — and this run has to be a default whole-commit scan
+itself. Anything else runs a real scan: nothing inside the window, only a failed
+or still-running scan, a worktree that does not match the commit (including
+files the index hides from `git status`), or a lookup the platform could not
+answer.
+
+Two things are hard errors instead. An unresolvable commit (not a git
+repository, or no commits yet) exits 1 rather than silently scanning. And a run
+that changes what gets scanned cannot be matched against a candidate — the API
+exposes neither a scan's configured scan types and target policies nor whether
+it bundled a container image — so the flag is rejected alongside `--scan-type`,
+`--policy`, `--include-image`, `--only-uncommitted`, and `--target`.
+
+`--exclude` is allowed, and warns on a skip. A reused scan is one of the whole
+commit (an `--exclude` upload is recorded as not matching the commit exactly, so
+it is never itself reusable), which means the results and the gate can cover
+files this run would have skipped — over-reporting, never under-reporting.
+
 ## Dependency Inventory (offline)
 
 `corgea deps` builds a dependency inventory from npm, Python, and Java manifests

{corgea_cli-1.9.3 → corgea_cli-1.11.0}/skills/corgea/SKILL.md

@@ -35,16 +35,38 @@ corgea scan --scan-type policy --policy 1      # Specific policy ID
 corgea scan --fail-on CR                       # Exit 1 on critical issues (CR, HI, ME, LO)
 corgea scan --fail-on malicious                # Exit 1 if any dependency is classified malicious
 corgea scan --fail-on HI,malicious             # Comma-separated conditions combine
-corgea scan --fail                             # Exit 1 based on project blocking rules
+corgea scan --block-on criticals               # Exit 1 if the scan violates the named CI blocking rules
+corgea scan --block-on criticals,malicious-deps  # Comma-separated rule slugs
+corgea scan --fail                             # Deprecated: exit 1 based on every active blocking rule
 corgea scan --out-format json --out-file r.json   # Export (json, html, sarif, markdown)
+corgea scan --sbom                             # Also write a CycloneDX SBOM to bom.json
+corgea scan --sbom sbom.cdx.json               # SBOM to a custom file
+corgea scan --include-image myapp:1.2.3        # Also scan a fully built container image
+corgea scan --include-image myapp:1.2.3 --include-image ghcr.io/acme/api:latest  # Repeatable
 corgea scan --project-name my-service          # Override project name
+corgea scan --skip-if-commit-scanned-recently  # Reuse a recent scan of this commit instead of scanning again
+corgea scan --skip-if-commit-scanned-recently --scanned-within 4h  # Window for "recently" (default 24h)
 ```
 
 Scan types: `blast` (base AI), `policy` (PolicyIQ), `malicious`, `secrets`, `pii`.
 
 `--fail-on` takes comma-separated conditions: severity thresholds `CR`, `HI`, `ME`, `LO` (trip at or above the level) and/or `malicious` (trips when any dependency in the scan is classified malicious). Use `malicious` to block supply-chain findings in CI across every ecosystem the scan covers, including those the `corgea npm`/`corgea pip` install gate does not.
 
-`--only-uncommitted` and `--target` are mutually exclusive. `--fail-on` and `--fail` are mutually exclusive.
+`--block-on` takes comma-separated blocking-rule slugs. Blocking rules are configured in the web app and each one applies either to pull requests or to CI. Only CI rules can be named by `--block-on`; a slug that is unknown, inactive, or scoped to pull requests is a hard error (exit 1) rather than a silently skipped gate. The slug is shown next to each rule in the web app and is derived from the rule name, so renaming a rule changes its slug. Name rules for the condition that trips them — `criticals`, not `no-criticals` — so that `--block-on` reads as a direct assertion rather than a double negative.
+
+`--fail` is deprecated. It evaluates every active blocking rule regardless of what it applies to; use `--block-on` to name the CI rules a pipeline should enforce.
+
+`--include-image` scans the image you actually ship. Without it, container scanning discovers the base images referenced by Dockerfiles and Compose files in the repo and scans those. With it, each image is exported to a tar archive with `docker save` (or `podman save`), bundled with the project, and scanned as a whole — base-image discovery is skipped for that scan. Images that aren't available locally are pulled first, so build (or pull) the image before the scan and stay logged in to its registry. Set `CORGEA_CONTAINER_ENGINE` to choose a specific container CLI. Container scanning must be enabled for your account.
+
+An included image is enough on its own: when it is combined with `--only-uncommitted` or `--target` and no source files match (a clean working tree, for example), the scan warns and covers just the image rather than failing. An archive named `corgea-image-scanning-*.tar` that is committed to the repository is ignored — only images passed on the command line are scanned.
+
+`--only-uncommitted` and `--target` are mutually exclusive. `--fail-on`, `--fail`, and `--block-on` are mutually exclusive.
+
+`--out-format`/`--out-file` and `--sbom` are honored regardless of the gate: the report and the SBOM are written before `--fail`/`--block-on` are evaluated, so a scan that exits 1 on a blocking rule still leaves the report file behind for the pipeline to ingest.
+
+`--skip-if-commit-scanned-recently` reuses the project's most recent reusable scan of the current commit instead of starting a duplicate, when one ran inside the `--scanned-within` window (default `24h`; accepts `90s`, `30m`, `4h`, `7d`, and a bare number as hours). The reused scan takes the new scan's place for the rest of the command — results table, `--block-on` gate and its exit code, `--out-file` report — so the pipeline behaves the same either way. It prints `CORGEA_SCAN_SKIPPED=true` plus `CORGEA_SCAN_ID=<id>` on a reuse and `CORGEA_SCAN_SKIPPED=false` when a scan runs, so a later step can branch on it.
+
+Reuse requires a candidate that answers the same question: a completed `corgea-blast` scan of that commit, on a branch rather than a pull request, from an explicitly clean worktree, reporting no scanner problems. Anything else runs a real scan (nothing in the window, a failed or still-running scan, a worktree that does not match the commit including files hidden from `git status`, or a failed lookup). An unresolvable commit is a hard error (exit 1). Because the API exposes neither a scan's configured scan types and target policies nor whether it bundled a container image, a run that changes what gets scanned cannot be matched against a candidate, so the flag cannot be combined with `--scan-type`, `--policy`, `--include-image`, `--only-uncommitted`, or `--target`. `--exclude` is allowed but warns on a skip: what gets reused is a scan of the whole commit, so the results and the gate can cover files the run would have skipped (over-reporting, never under-reporting).
 
 ### Upload — `corgea upload [report]`
 
@@ -66,15 +88,23 @@ By default `upload` prints the scan page URL so you can track the results. Pass
 
 ```bash
 corgea wait                                    # Wait for latest scan
-corgea wait --scan-id SCAN_ID                  # Wait for specific scan
+corgea wait SCAN_ID                            # Wait for a specific scan
 ```
 
+Waiting (`corgea scan`, `corgea wait`, `corgea upload --wait`) exits 1 if the
+scan fails, printing why. A scan missing one scanner's results exits 0 with a
+warning. Polling gives up after 10 hours; override with
+`CORGEA_SCAN_TIMEOUT_SECONDS`. `--fail`/`--block-on` then wait up to 15 minutes
+for blocking rules to be evaluated, and exit 1 if that runs out; override with
+`CORGEA_BLOCKING_RULES_TIMEOUT_SECONDS`.
+
 ### List — `corgea list` (alias: `corgea ls`)
 
 ```bash
 corgea ls                                      # List scans
 corgea ls --issues --scan-id SCAN_ID           # Issues for a scan
 corgea ls --sca-issues                         # SCA (dependency) issues
+corgea ls --code-quality                       # Code quality issues
 corgea ls --issues --page 2 --page-size 10     # Pagination
 corgea ls --issues --scan-id SCAN_ID --json    # JSON output
 ```
@@ -83,6 +113,7 @@ corgea ls --issues --scan-id SCAN_ID --json    # JSON output
 |------|-------|-------------|
 | `--issues` | `-i` | List code/SAST issues |
 | `--sca-issues` | `-c` | List SCA issues |
+| `--code-quality` | `-q` | List code quality issues (alias `--quality`) |
 | `--scan-id` | `-s` | Filter to a scan |
 | `--page` | `-p` | Page number |
 | `--page-size` | | Items per page |
@@ -336,6 +367,13 @@ corgea scan
 corgea scan --only-uncommitted --fail-on HI
 ```
 
+### Scan the container image a build produced
+
+```bash
+docker build -t myapp:1.2.3 .
+corgea scan --include-image myapp:1.2.3
+```
+
 ### Scan a PR diff
 
 ```bash
@@ -354,8 +392,13 @@ corgea inspect --issue --diff ISSUE_ID
 ```bash
 corgea scan --fail-on CR --out-format sarif --out-file results.sarif
 corgea scan --fail-on CR,malicious --out-format sarif --out-file results.sarif  # also block malicious dependencies
+corgea scan --block-on criticals --out-format sarif --out-file results.sarif  # gate on a CI blocking rule from the web app
+corgea scan --block-on criticals --skip-if-commit-scanned-recently  # re-runs of an already-scanned commit gate on that scan instead of rescanning
 ```
 
+The report is written whether or not the gate trips, so a pipeline can both fail
+on policy and ingest the results file.
+
 ### Upload third-party reports
 
 ```bash
@@ -367,6 +410,7 @@ corgea upload report.json --project-name my-app
 ```bash
 corgea scan --out-format html --out-file report.html
 corgea scan --out-format sarif --out-file report.sarif
+corgea scan --out-format sarif --out-file report.sarif --sbom bom.json  # SARIF + CycloneDX SBOM
 ```
 
 ## Severity Levels

{corgea_cli-1.9.3 → corgea_cli-1.11.0}/src/config.rs

@@ -4,6 +4,14 @@ use std::{env, fs, io};
 
 pub const DEFAULT_VULN_API_URL: &str = "https://cve-worker-staging.corgea.workers.dev";
 
+/// Whether `DEFAULT_VULN_API_URL` is an endpoint Corgea tokens belong to.
+/// The `-staging` hostname is historical: this worker serves as the production
+/// vuln-api, so a token may be sent to it and authenticated (fail-closed)
+/// verdicts apply by default. Set to `false` if the default is ever repointed
+/// at an endpoint that customer tokens should not reach — token-send and
+/// fail-closed then both require the explicit opt-in.
+pub const DEFAULT_VULN_API_URL_IS_PRODUCTION: bool = true;
+
 #[derive(Serialize, Deserialize, Clone)]
 pub struct Config {
     pub(crate) url: String,

{corgea_cli-1.9.3 → corgea_cli-1.11.0}/src/deps/ecosystems/maven.rs

@@ -5,7 +5,7 @@ use crate::deps::ecosystems::classify_constraint;
 use crate::deps::ecosystems::evaluate::{
     constraint_to_findings, dep001, file_in_dir, parent_dir, ScanContext,
 };
-use crate::deps::model::{DependencyNode, Ecosystem, PackageId, Scope, SourceType};
+use crate::deps::model::{DependencyEdge, DependencyNode, Ecosystem, PackageId, Scope, SourceType};
 use crate::deps::DepsError;
 
 pub fn scan_maven_projects(ctx: &mut ScanContext<'_>) -> Result<(), DepsError> {
@@ -68,6 +68,14 @@ fn scan_maven_pom(ctx: &mut ScanContext<'_>, dir: &Path, pom_path: &Path) -> Res
             Some(package_id.clone()),
             false,
         ));
+        ctx.graph.edges.push(DependencyEdge {
+            from: PackageId::root(),
+            to: package_id.clone(),
+            declared_constraint: declared.clone(),
+            resolved_version: Some(dep.version.clone()),
+            scope: dep.scope,
+            source_file: rel.clone(),
+        });
         ctx.graph.nodes.push(DependencyNode {
             id: package_id,
             name,
@@ -89,8 +97,178 @@ fn scan_maven_pom(ctx: &mut ScanContext<'_>, dir: &Path, pom_path: &Path) -> Res
     Ok(())
 }
 
+/// Sections whose contents are not the project's own coordinates or
+/// dependencies; stripped before any dependency or property extraction.
+const NON_DEPENDENCY_SECTIONS: &[&str] = &["profiles", "build", "reporting"];
+
 fn parse_pom_dependencies(content: &str) -> Result<Vec<MavenDep>, DepsError> {
-    Ok(parse_pom_regex(content))
+    let stripped = strip_sections(content, NON_DEPENDENCY_SECTIONS);
+    let props = parse_pom_properties(&stripped);
+    let (rest, management) = split_dependency_management(&stripped);
+    let managed: std::collections::HashMap<(String, String), String> = parse_pom_regex(management)
+        .into_iter()
+        .filter(|d| !d.version.is_empty())
+        .map(|d| ((d.group, d.artifact), d.version))
+        .collect();
+    let mut deps = parse_pom_regex(&rest);
+    for dep in &mut deps {
+        if dep.version.is_empty() {
+            if let Some(v) = managed.get(&(dep.group.clone(), dep.artifact.clone())) {
+                dep.version = v.clone();
+            }
+        }
+        dep.version = resolve_placeholders(&dep.version, &props);
+    }
+    Ok(deps)
+}
+
+/// Remove every `<tag>...</tag>` section. Their dependency blocks are not
+/// application dependencies, and a profile's `<properties>` or
+/// `<dependencyManagement>` must not affect the base dependency graph, so
+/// stripping runs before property and management extraction.
+fn strip_sections(content: &str, tags: &[&str]) -> String {
+    let mut content = content.to_string();
+    for tag in tags {
+        while let Some((rest, _)) = split_section(&content, tag) {
+            content = rest;
+        }
+    }
+    content
+}
+
+/// Split out the `<dependencyManagement>` section: its entries pin versions
+/// for the project's dependencies but are not dependencies themselves.
+/// Returns (pom without the section, the section's inner content).
+fn split_dependency_management(content: &str) -> (String, &str) {
+    split_section(content, "dependencyManagement").unwrap_or_else(|| (content.to_string(), ""))
+}
+
+/// Locate a `<tag>...</tag>` section and split content into (content with
+/// the section removed, the section's inner content). `None` if the tag
+/// isn't present or is malformed (close before open).
+fn split_section<'a>(content: &'a str, tag: &str) -> Option<(String, &'a str)> {
+    let open = format!("<{tag}>");
+    let close = format!("</{tag}>");
+    let s = content.find(&open)?;
+    let e = content.find(&close)?;
+    if s >= e {
+        return None;
+    }
+    let inner = &content[s + open.len()..e];
+    let rest = format!("{}{}", &content[..s], &content[e + close.len()..]);
+    Some((rest, inner))
+}
+
+/// Collect `<properties>` entries plus the built-in `project.version`.
+fn parse_pom_properties(content: &str) -> std::collections::HashMap<String, String> {
+    let mut props = std::collections::HashMap::new();
+    if let Some(start) = content.find("<properties>") {
+        let rest = &content[start + "<properties>".len()..];
+        if let Some(end) = rest.find("</properties>") {
+            let mut block = &rest[..end];
+            while let Some(open_start) = block.find('<') {
+                let after = &block[open_start + 1..];
+                let Some(open_end) = after.find('>') else {
+                    break;
+                };
+                let tag = after[..open_end].trim();
+                let body = &after[open_end + 1..];
+                if tag.starts_with('/') || tag.starts_with('!') || tag.ends_with('/') {
+                    block = body;
+                    continue;
+                }
+                let close = format!("</{tag}>");
+                match body.find(&close) {
+                    Some(close_pos) => {
+                        props.insert(tag.to_string(), body[..close_pos].trim().to_string());
+                        block = &body[close_pos + close.len()..];
+                    }
+                    None => block = body,
+                }
+            }
+        }
+    }
+    // Property values may reference other properties; resolve the map to a
+    // fixed point, bounded to guard against definition cycles.
+    resolve_props_fixed_point(&mut props);
+    let project_version = resolve_placeholders(&pom_project_version(content), &props);
+    if !project_version.is_empty() && !project_version.contains("${") {
+        props.insert("project.version".to_string(), project_version);
+    }
+    // Properties aliasing ${project.version} (e.g. `<shared.version>`) only
+    // resolve now that project.version itself is in the map.
+    resolve_props_fixed_point(&mut props);
+    props
+}
+
+/// Resolve `${...}` references among property values to a fixed point. A
+/// resolution chain can't be longer than the number of properties without
+/// a cycle, so bound the iteration count by the map size.
+fn resolve_props_fixed_point(props: &mut std::collections::HashMap<String, String>) {
+    for _ in 0..=props.len() {
+        let resolved: std::collections::HashMap<String, String> = props
+            .iter()
+            .map(|(k, v)| (k.clone(), resolve_placeholders(v, props)))
+            .collect();
+        if resolved == *props {
+            break;
+        }
+        *props = resolved;
+    }
+}
+
+/// The pom's own `<version>`: first `<version>` before `<dependencies>`,
+/// excluding the `<parent>` block. A child that inherits its version has
+/// none of its own, so fall back to the parent's (Maven's inheritance rule).
+fn pom_project_version(content: &str) -> String {
+    let head = content.split("<dependencies>").next().unwrap_or(content);
+    // The project's own <version> lives among its coordinates, before any
+    // nested section that may carry unrelated <version> tags of its own
+    // (plugin versions in <build>, managed versions in
+    // <dependencyManagement>, etc).
+    let nested_start = NON_DEPENDENCY_SECTIONS
+        .iter()
+        .copied()
+        .chain(["dependencyManagement"])
+        .filter_map(|tag| head.find(&format!("<{tag}>")))
+        .min();
+    let head = match nested_start {
+        Some(pos) => &head[..pos],
+        None => head,
+    };
+    if let Some((cleaned, parent)) = split_section(head, "parent") {
+        let own = extract_xml_tag(&cleaned, "version");
+        if !own.is_empty() {
+            return own;
+        }
+        return extract_xml_tag(parent, "version");
+    }
+    extract_xml_tag(head, "version")
+}
+
+/// Substitute `${name}` placeholders; unresolved ones pass through unchanged.
+fn resolve_placeholders(raw: &str, props: &std::collections::HashMap<String, String>) -> String {
+    if !raw.contains("${") {
+        return raw.to_string();
+    }
+    let mut out = String::new();
+    let mut rest = raw;
+    while let Some(start) = rest.find("${") {
+        out.push_str(&rest[..start]);
+        let after = &rest[start + 2..];
+        let Some(end) = after.find('}') else {
+            out.push_str(&rest[start..]);
+            return out;
+        };
+        let key = &after[..end];
+        match props.get(key) {
+            Some(v) => out.push_str(v),
+            None => out.push_str(&rest[start..start + 2 + end + 1]),
+        }
+        rest = &after[end + 1..];
+    }
+    out.push_str(rest);
+    out
 }
 
 fn parse_pom_regex(content: &str) -> Vec<MavenDep> {

{corgea_cli-1.9.3 → corgea_cli-1.11.0}/src/deps/ecosystems/mod.rs

@@ -10,6 +10,16 @@ pub fn scan_all(ctx: &mut ScanContext<'_>) -> Result<(), DepsError> {
     evaluate::scan_all(ctx)
 }
 
+/// Whether `scan_all` builds graph nodes for this ecosystem. Keep in sync
+/// with the scanners wired in `evaluate::scan_all` — detect-only ecosystems
+/// (Go, Cargo) are found on disk but contribute nothing to the graph or SBOM.
+pub fn is_graphed(ecosystem: Ecosystem) -> bool {
+    matches!(
+        ecosystem,
+        Ecosystem::Npm | Ecosystem::PyPI | Ecosystem::Maven
+    )
+}
+
 use crate::deps::model::{ConstraintKind, Ecosystem};
 
 /// Classify a raw declared constraint string.

{corgea_cli-1.9.3 → corgea_cli-1.11.0}/src/deps/mod.rs

@@ -62,6 +62,13 @@ impl Inventory {
 
 /// Scan a directory tree: detect files, build the graph, evaluate policy.
 pub fn scan(root: &Path, policy: &Policy) -> Result<Inventory, DepsError> {
+    if !root.exists() {
+        return Err(DepsError(format!(
+            "path does not exist: {}",
+            root.display()
+        )));
+    }
+
     let detected = detect::detect_dependency_files(root);
     let mut graph = DependencyGraph::default();
     let mut findings = Vec::new();