cycode 3.13.1.dev7__tar.gz → 3.14.1.dev1__tar.gz

{cycode-3.13.1.dev7 → cycode-3.14.1.dev1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cycode
-Version: 3.13.1.dev7
+Version: 3.14.1.dev1
 Summary: Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning.
 License-Expression: MIT
 License-File: LICENCE
@@ -843,6 +843,14 @@ cycode scan -t sca --stop-on-error path ~/home/git/codebase
 
 This is useful in CI pipelines where a silent failure would produce an incomplete scan result. When `--stop-on-error` is triggered you can either fix the underlying issue or, for SCA restore failures specifically, add `--no-restore` to skip lockfile generation and scan direct dependencies only.
 
+When `--stop-on-error` is used, the CLI distinguishes between scan errors and policy violations via exit codes:
+
+| Exit code | Meaning |
+|-----------|---------|
+| `0` | Scan completed with no violations |
+| `1` | Scan completed and violations were found |
+| `2` | Scan aborted due to an error (only when `--stop-on-error` is set) |
+
 ### Repository Scan
 
 A repository scan examines an entire local repository for any exposed secrets or insecure misconfigurations. This more holistic scan type looks at everything: the current state of your repository and its commit history. It will look not only for secrets that are currently exposed within the repository but previously deleted secrets as well.

{cycode-3.13.1.dev7 → cycode-3.14.1.dev1}/README.md

@@ -802,6 +802,14 @@ cycode scan -t sca --stop-on-error path ~/home/git/codebase
 
 This is useful in CI pipelines where a silent failure would produce an incomplete scan result. When `--stop-on-error` is triggered you can either fix the underlying issue or, for SCA restore failures specifically, add `--no-restore` to skip lockfile generation and scan direct dependencies only.
 
+When `--stop-on-error` is used, the CLI distinguishes between scan errors and policy violations via exit codes:
+
+| Exit code | Meaning |
+|-----------|---------|
+| `0` | Scan completed with no violations |
+| `1` | Scan completed and violations were found |
+| `2` | Scan aborted due to an error (only when `--stop-on-error` is set) |
+
 ### Repository Scan
 
 A repository scan examines an entire local repository for any exposed secrets or insecure misconfigurations. This more holistic scan type looks at everything: the current state of your repository and its commit history. It will look not only for secrets that are currently exposed within the repository but previously deleted secrets as well.

cycode-3.14.1.dev1/cycode/__init__.py

@@ -0,0 +1 @@
+__version__ = '3.14.1.dev1'  # DON'T TOUCH. Placeholder. Will be filled automatically on poetry build from Git Tag

{cycode-3.13.1.dev7 → cycode-3.14.1.dev1}/cycode/cli/apps/scan/scan_command.py

@@ -17,6 +17,7 @@ from cycode.cli.cli_types import ExportTypeOption, ScanTypeOption, ScaScanTypeOp
 from cycode.cli.consts import (
     ISSUE_DETECTED_STATUS_CODE,
     NO_ISSUES_STATUS_CODE,
+    SCAN_ERROR_STATUS_CODE,
 )
 from cycode.cli.files_collector.file_excluder import excluder
 from cycode.cli.utils import scan_utils
@@ -187,7 +188,9 @@ def scan_command_result_callback(ctx: click.Context, *_, **__) -> None:
         raise typer.Exit(0)
 
     exit_code = NO_ISSUES_STATUS_CODE
-    if scan_utils.is_scan_failed(ctx):
+    if ctx.obj.get('did_fail') and ctx.obj.get('stop_on_error'):
+        exit_code = SCAN_ERROR_STATUS_CODE
+    elif scan_utils.is_scan_failed(ctx):
         exit_code = ISSUE_DETECTED_STATUS_CODE
 
     raise typer.Exit(exit_code)

{cycode-3.13.1.dev7 → cycode-3.14.1.dev1}/cycode/cli/consts.py

@@ -277,6 +277,7 @@ VERBOSE_SCAN_FLAG = 'verbose'
 
 ISSUE_DETECTED_STATUS_CODE = 1
 NO_ISSUES_STATUS_CODE = 0
+SCAN_ERROR_STATUS_CODE = 2
 
 LICENSE_COMPLIANCE_POLICY_ID = '8f681450-49e1-4f7e-85b7-0c8fe84b3a35'
 PACKAGE_VULNERABILITY_POLICY_ID = '9369d10a-9ac0-48d3-9921-5de7fe9a37a7'

{cycode-3.13.1.dev7 → cycode-3.14.1.dev1}/cycode/cli/files_collector/sca/nuget/restore_nuget_dependencies.py

@@ -15,7 +15,17 @@ class RestoreNugetDependencies(BaseRestoreDependencies):
         return any(document.path.endswith(ext) for ext in NUGET_PROJECT_FILE_EXTENSIONS)
 
     def get_commands(self, manifest_file_path: str) -> list[list[str]]:
-        return [['dotnet', 'restore', manifest_file_path, '--use-lock-file', '--verbosity', 'quiet']]
+        return [
+            [
+                'dotnet',
+                'restore',
+                manifest_file_path,
+                '--use-lock-file',
+                '--verbosity',
+                'quiet',
+                '--ignore-failed-sources',
+            ]
+        ]
 
     def get_lock_file_name(self) -> str:
         return NUGET_LOCK_FILE_NAME

{cycode-3.13.1.dev7 → cycode-3.14.1.dev1}/pyproject.toml

@@ -21,7 +21,7 @@ classifiers = [
     "Programming Language :: Python :: 3.14",
 ]
 dynamic = ["dependencies"]
-version = "3.13.1.dev7"
+version = "3.14.1.dev1"
 
 [project.scripts]
 cycode = "cycode.cli.app:app"

cycode-3.13.1.dev7/cycode/__init__.py

@@ -1 +0,0 @@
-__version__ = '3.13.1.dev7'  # DON'T TOUCH. Placeholder. Will be filled automatically on poetry build from Git Tag