iris-security-cli 0.2.14__tar.gz → 0.2.17__tar.gz

{iris_security_cli-0.2.14 → iris_security_cli-0.2.17}/PKG-INFO

@@ -1,10 +1,10 @@
 Metadata-Version: 2.4
 Name: iris-security-cli
-Version: 0.2.14
+Version: 0.2.17
 Summary: IRIS CLI — declare, compile, preview, enforce, witness, certify, sentinel
 License: Apache-2.0
-Project-URL: Homepage, https://iris-security.github.io/iris-sdk/
-Project-URL: Repository, https://github.com/IRIS-Security/iris-sdk
+Project-URL: Homepage, https://github.com/gimartinb/iris-sdk
+Project-URL: Repository, https://github.com/gimartinb/iris-sdk
 Classifier: Development Status :: 3 - Alpha
 Classifier: Intended Audience :: Developers
 Classifier: Topic :: Security
@@ -15,8 +15,8 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
-Requires-Dist: iris-security-core>=0.1.16
-Requires-Dist: iris-security-sdk>=0.2.14
+Requires-Dist: iris-security-core>=0.1.17
+Requires-Dist: iris-security-sdk>=0.2.17
 Requires-Dist: click>=8.1
 Requires-Dist: rich>=13.0
 Requires-Dist: pyyaml>=6.0
@@ -29,7 +29,7 @@ IRIS CLI — `iris scan`, `iris register`, `iris policy`, `iris compliance`.
 
 Command-line tools for AI agent governance and Colorado AI Act compliance.
 
-Part of the [IRIS SDK](https://github.com/IRIS-Security/iris-sdk).
+Part of the [IRIS SDK](https://github.com/gimartinb/iris-sdk).
 
 ## Install
 
@@ -45,3 +45,16 @@ iris register --name my-agent --owner you@company.com --team my-team --complianc
 iris scan
 iris compliance check --framework colorado-ai-act
 ```
+
+## GitHub Action
+
+Add AI governance to CI with the composite Action in this repo (offline by default):
+
+```yaml
+- uses: IRIS-Security/iris-cli@v1
+  with:
+    command: compliance scan
+    fail-on: blocker
+```
+
+Optional `--push` to IRIS Cloud when `api-key` is set. See [GitHub Action docs](https://iris-security.github.io/iris-sdk/github-action.html).

{iris_security_cli-0.2.14 → iris_security_cli-0.2.17}/README.md

@@ -4,7 +4,7 @@ IRIS CLI — `iris scan`, `iris register`, `iris policy`, `iris compliance`.
 
 Command-line tools for AI agent governance and Colorado AI Act compliance.
 
-Part of the [IRIS SDK](https://github.com/IRIS-Security/iris-sdk).
+Part of the [IRIS SDK](https://github.com/gimartinb/iris-sdk).
 
 ## Install
 
@@ -20,3 +20,16 @@ iris register --name my-agent --owner you@company.com --team my-team --complianc
 iris scan
 iris compliance check --framework colorado-ai-act
 ```
+
+## GitHub Action
+
+Add AI governance to CI with the composite Action in this repo (offline by default):
+
+```yaml
+- uses: IRIS-Security/iris-cli@v1
+  with:
+    command: compliance scan
+    fail-on: blocker
+```
+
+Optional `--push` to IRIS Cloud when `api-key` is set. See [GitHub Action docs](https://iris-security.github.io/iris-sdk/github-action.html).

iris_security_cli-0.2.17/iris_cli/compliance_scan_cmd.py

@@ -0,0 +1,242 @@
+"""iris compliance scan — offline workload detection + local obligation eval."""
+
+# Copyright 2024-2025 Gilbert Martin / IRIS Security, Inc.
+# All Rights Reserved.
+# Author: Gilbert Martin <gilbert@iris-security.io>
+
+from __future__ import annotations
+
+import os
+import sys
+from pathlib import Path
+
+import click
+from rich.console import Console
+from rich.panel import Panel
+from rich.table import Table
+
+from iris.scan import detect_workload
+from iris_core.compliance.workload_eval import (
+    applicable_frameworks,
+    evaluate_workload_profile,
+    top_recommended_actions,
+)
+
+console = Console()
+
+_SEVERITY_RANK = {"blocker": 0, "required": 1, "recommended": 2}
+
+
+def _exit_on_fail_threshold(obligations: list[dict], fail_on: str) -> None:
+    if fail_on == "none":
+        return
+    threshold = _SEVERITY_RANK[fail_on]
+    blocking = [
+        obligation
+        for obligation in obligations
+        if _SEVERITY_RANK.get(obligation.get("severity", "recommended"), 9) <= threshold
+    ]
+    if blocking:
+        sys.exit(1)
+
+
+def _resolve_profile(
+    *,
+    scan_source: str | None,
+    path: str,
+    litellm_config: str | None,
+    litellm_proxy: str | None,
+    lookback_days: int,
+) -> dict:
+    if scan_source is None:
+        return detect_workload(path)
+
+    if scan_source == "langfuse":
+        try:
+            from iris_langfuse import profile_from_langfuse
+        except ImportError as exc:
+            raise click.ClickException(
+                'iris-langfuse is not installed. Run: pip install "iris-langfuse[live]"'
+            ) from exc
+        try:
+            return profile_from_langfuse(lookback_days=lookback_days)
+        except ImportError as exc:
+            raise click.ClickException(
+                'Langfuse SDK missing. Run: pip install "iris-langfuse[live]"'
+            ) from exc
+        except ValueError as exc:
+            raise click.ClickException(str(exc)) from exc
+
+    if scan_source == "litellm":
+        try:
+            from iris_litellm import profile_from_litellm_config, profile_from_litellm_proxy
+        except ImportError as exc:
+            raise click.ClickException(
+                'iris-litellm is not installed. Run: pip install "iris-litellm[live]"'
+            ) from exc
+        if litellm_config:
+            return profile_from_litellm_config(litellm_config)
+        if litellm_proxy:
+            return profile_from_litellm_proxy(litellm_proxy)
+        raise click.ClickException(
+            "LiteLLM source requires --config <litellm.config.yaml> or --proxy <base_url>"
+        )
+
+    raise click.ClickException(f"Unknown scan source: {scan_source}")
+
+
+def _scan_subtitle(scan_source: str | None) -> str:
+    if scan_source == "langfuse":
+        return "Langfuse trace metadata — no prompt content read."
+    if scan_source == "litellm":
+        return "LiteLLM config/proxy — models and providers inferred."
+    return "Offline detection — no network calls required."
+
+
+def _print_profile(profile: dict) -> None:
+    table = Table(title="What you're building", show_header=True, header_style="bold")
+    table.add_column("Attribute")
+    table.add_column("Detected values")
+    for key in (
+        "providers",
+        "frameworks",
+        "models",
+        "data_categories",
+        "deployment_regions",
+        "agent_count",
+        "autonomy_level",
+        "customer_facing",
+    ):
+        value = profile.get(key, [])
+        if isinstance(value, bool):
+            display = "yes" if value else "no"
+        elif isinstance(value, list):
+            display = ", ".join(value) if value else "—"
+        else:
+            display = str(value)
+        table.add_row(key.replace("_", " ").title(), display)
+    console.print(table)
+
+
+def _print_frameworks(profile: dict) -> None:
+    table = Table(title="Applicable frameworks", show_header=True, header_style="bold")
+    table.add_column("Framework")
+    table.add_column("Triggered by")
+    for fw, reasons in applicable_frameworks(profile):
+        table.add_row(fw, ", ".join(reasons))
+    console.print(table)
+
+
+def _print_actions(obligations: list[dict]) -> None:
+    actions = top_recommended_actions(obligations, limit=5)
+    if not actions:
+        console.print("[dim]No obligations triggered for detected profile.[/dim]")
+        return
+    table = Table(title="Top recommended actions", show_header=True, header_style="bold")
+    table.add_column("#", style="dim")
+    table.add_column("Severity")
+    table.add_column("Framework")
+    table.add_column("Action")
+    for idx, action in enumerate(actions, 1):
+        sev = action.get("severity", "recommended")
+        color = {"blocker": "red", "required": "yellow"}.get(sev, "cyan")
+        table.add_row(
+            str(idx),
+            f"[{color}]{sev}[/{color}]",
+            action.get("framework_key", ""),
+            (action.get("recommended_action") or "")[:80],
+        )
+    console.print(table)
+
+
+def _push_profile(profile: dict) -> None:
+    api_key = os.environ.get("IRIS_API_KEY") or os.environ.get("IRIS_CLOUD_API_KEY")
+    base_url = os.environ.get("IRIS_API_URL", "http://localhost:8000")
+    if not api_key:
+        console.print("[yellow]Set IRIS_API_KEY to push profile to cloud.[/yellow]")
+        return
+    import httpx
+
+    response = httpx.post(
+        f"{base_url.rstrip('/')}/intelligence/profile/scan",
+        headers={"Authorization": f"Bearer {api_key}", "Content-Type": "application/json"},
+        json=profile,
+        timeout=30,
+    )
+    if response.status_code >= 400:
+        console.print(f"[red]Push failed ({response.status_code}): {response.text}[/red]")
+        return
+    console.print("[green]Profile pushed to IRIS Cloud.[/green]")
+
+
+@click.command("scan")
+@click.option("--path", default=".", help="Project path to scan (default local code scan)")
+@click.option(
+    "--from",
+    "scan_source",
+    type=click.Choice(["langfuse", "litellm"], case_sensitive=False),
+    default=None,
+    help="Observability source instead of local code scan",
+)
+@click.option("--config", "litellm_config", type=click.Path(exists=True), help="LiteLLM config.yaml")
+@click.option("--proxy", "litellm_proxy", help="LiteLLM proxy base URL")
+@click.option("--lookback-days", default=30, show_default=True, help="Langfuse lookback window")
+@click.option("--push", is_flag=True, help="POST profile to cloud when IRIS_API_KEY is set")
+@click.option(
+    "--fail-on",
+    default="none",
+    type=click.Choice(["blocker", "required", "none"]),
+    show_default=True,
+    help="Exit 1 when obligations meet or exceed this severity (CI integration)",
+)
+@click.option("--json", "as_json", is_flag=True, help="Output raw JSON")
+def compliance_scan_cmd(
+    path: str,
+    scan_source: str | None,
+    litellm_config: str | None,
+    litellm_proxy: str | None,
+    lookback_days: int,
+    push: bool,
+    fail_on: str,
+    as_json: bool,
+) -> None:
+    """Detect workload attributes and evaluate local regulatory obligations (offline)."""
+    root = Path(path).resolve()
+    if scan_source is None and not root.exists():
+        raise click.ClickException(f"Path not found: {root}")
+
+    profile = _resolve_profile(
+        scan_source=scan_source,
+        path=str(root),
+        litellm_config=litellm_config,
+        litellm_proxy=litellm_proxy,
+        lookback_days=lookback_days,
+    )
+    obligations = evaluate_workload_profile(profile)
+
+    if as_json:
+        import json
+
+        click.echo(json.dumps({"profile": profile, "obligations": obligations}, indent=2))
+        if push:
+            _push_profile(profile)
+        _exit_on_fail_threshold(obligations, fail_on)
+        return
+
+    console.print(
+        Panel(
+            "[bold]IRIS Compliance Intelligence Scan[/bold]\n"
+            + _scan_subtitle(scan_source),
+            border_style="cyan",
+        )
+    )
+    _print_profile(profile)
+    _print_frameworks(profile)
+    _print_actions(obligations)
+    console.print(
+        "\n[dim]Continuous monitoring, evidence mapping, and team workflows: "
+        "iris cloud connect  ->  https://iris-security.io[/dim]"
+    )
+    if push:
+        _push_profile(profile)
+    _exit_on_fail_threshold(obligations, fail_on)

{iris_security_cli-0.2.14 → iris_security_cli-0.2.17}/iris_cli/explain.py

@@ -30,7 +30,7 @@ Your existing tests will pass without modification.
 
 To verify: run your test suite after adding IRIS.
 If any test fails, report it as a bug at:
-github.com/IRIS-Security/iris-sdk/issues"""
+github.com/gimartinb/iris-sdk/issues"""
 
 TECHNICAL_EXPLANATION = """\
 Proxy pattern (identical attribute forwarding):

{iris_security_cli-0.2.14 → iris_security_cli-0.2.17}/iris_cli/main.py

@@ -17,6 +17,7 @@ Every iris scan or iris certify is a weekly active developer event.
 import click
 import sys
 from pathlib import Path
+from typing import Any
 from rich.console import Console
 from rich.panel import Panel
 
@@ -25,9 +26,31 @@ from iris_core.cli_timing.instrument import timed_cli_command
 console = Console()
 
 
-@click.group()
+class IrisCLI(click.Group):
+    """Click group that records daily aggregated CLI usage after each command."""
+
+    def invoke(self, ctx: click.Context) -> Any:
+        result = super().invoke(ctx)
+        if not ctx.resilient_parsing:
+            command = self._resolved_command(ctx)
+            if command:
+                from iris._telemetry import maybe_record_cli_usage
+
+                maybe_record_cli_usage(command)
+        return result
+
+    @staticmethod
+    def _resolved_command(ctx: click.Context) -> str | None:
+        if ctx.invoked_subcommand is None:
+            return None
+        if ctx.command_path:
+            return " ".join(ctx.command_path)
+        return ctx.invoked_subcommand
+
+
+@click.group(cls=IrisCLI)
 @click.version_option(
-    version="0.2.14",
+    version="0.2.17",
     prog_name="iris",
     message="%(prog)s %(version)s · AARM Core conformant (R1–R6) · "
             "AIUC-1 Q1 2026 aligned · https://iris-security.io",
@@ -462,12 +485,20 @@ framework.add_command(framework_suggest, name="suggest")
 from iris_cli.assess import compliance_assess
 compliance.add_command(compliance_assess)
 
-# Wire in evidence commands
-from iris_cli.evidence import evidence
-cli.add_command(evidence)
+# Wire in evidence commands (optional — requires iris-security-core>=0.1.17 exporters)
+try:
+    from iris_cli.evidence import evidence
 
-from iris_cli.vault import vault
-cli.add_command(vault)
+    cli.add_command(evidence)
+except ModuleNotFoundError:
+    pass
+
+try:
+    from iris_cli.vault import vault
+
+    cli.add_command(vault)
+except ModuleNotFoundError:
+    pass
 
 from iris_cli.framework_test import test as framework_test_cmd_legacy
 # framework_test kept for internal imports; certify is the primary command
@@ -560,6 +591,9 @@ def ping():
 from iris_cli.compliance_check_cmd import compliance_check_cmd
 compliance.add_command(compliance_check_cmd, name="check")
 
+from iris_cli.compliance_scan_cmd import compliance_scan_cmd
+compliance.add_command(compliance_scan_cmd, name="scan")
+
 cli.add_command(compliance)
 cli.add_command(framework)
 

{iris_security_cli-0.2.14 → iris_security_cli-0.2.17}/iris_cli/quickstart.py

@@ -167,7 +167,7 @@ def _print_welcome() -> None:
             "  · How to register and govern a new agent\n"
             "  · Your compliance score in real time\n\n"
             "No API key required for most steps.\n"
-            "github.com/IRIS-Security/iris-sdk",
+            "github.com/gimartinb/iris-sdk",
             title="Welcome to IRIS",
             style="blue",
         )
@@ -363,7 +363,7 @@ def _print_summary(findings_count: int) -> None:
             "     [cyan]from iris_anthropic import IrisAnthropic[/cyan]\n"
             "     [cyan]client = IrisAnthropic(passport=passport)[/cyan]\n\n"
             "  4. Read the full guide:\n"
-            "     github.com/IRIS-Security/iris-sdk/blob/main/QUICKSTART.md\n\n"
+            "     github.com/gimartinb/iris-sdk/blob/main/QUICKSTART.md\n\n"
             "Questions? gilbert.martin@gmail.com",
             title="Quickstart complete",
             style="green",

{iris_security_cli-0.2.14 → iris_security_cli-0.2.17}/iris_cli/scm.py

@@ -330,7 +330,7 @@ Step 1: Go to github.com/organizations/{org_name}/settings/apps
 Step 2: Click "New GitHub App"
 Step 3: Fill in:
   Name: IRIS Governance
-  Homepage URL: https://github.com/IRIS-Security/iris-sdk
+  Homepage URL: https://github.com/gimartinb/iris-sdk
   Webhook: leave unchecked for now
 Step 4: Set permissions (read-only):
   Repository permissions:

{iris_security_cli-0.2.14 → iris_security_cli-0.2.17}/iris_security_cli.egg-info/PKG-INFO

@@ -1,10 +1,10 @@
 Metadata-Version: 2.4
 Name: iris-security-cli
-Version: 0.2.14
+Version: 0.2.17
 Summary: IRIS CLI — declare, compile, preview, enforce, witness, certify, sentinel
 License: Apache-2.0
-Project-URL: Homepage, https://iris-security.github.io/iris-sdk/
-Project-URL: Repository, https://github.com/IRIS-Security/iris-sdk
+Project-URL: Homepage, https://github.com/gimartinb/iris-sdk
+Project-URL: Repository, https://github.com/gimartinb/iris-sdk
 Classifier: Development Status :: 3 - Alpha
 Classifier: Intended Audience :: Developers
 Classifier: Topic :: Security
@@ -15,8 +15,8 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
-Requires-Dist: iris-security-core>=0.1.16
-Requires-Dist: iris-security-sdk>=0.2.14
+Requires-Dist: iris-security-core>=0.1.17
+Requires-Dist: iris-security-sdk>=0.2.17
 Requires-Dist: click>=8.1
 Requires-Dist: rich>=13.0
 Requires-Dist: pyyaml>=6.0
@@ -29,7 +29,7 @@ IRIS CLI — `iris scan`, `iris register`, `iris policy`, `iris compliance`.
 
 Command-line tools for AI agent governance and Colorado AI Act compliance.
 
-Part of the [IRIS SDK](https://github.com/IRIS-Security/iris-sdk).
+Part of the [IRIS SDK](https://github.com/gimartinb/iris-sdk).
 
 ## Install
 
@@ -45,3 +45,16 @@ iris register --name my-agent --owner you@company.com --team my-team --complianc
 iris scan
 iris compliance check --framework colorado-ai-act
 ```
+
+## GitHub Action
+
+Add AI governance to CI with the composite Action in this repo (offline by default):
+
+```yaml
+- uses: IRIS-Security/iris-cli@v1
+  with:
+    command: compliance scan
+    fail-on: blocker
+```
+
+Optional `--push` to IRIS Cloud when `api-key` is set. See [GitHub Action docs](https://iris-security.github.io/iris-sdk/github-action.html).

{iris_security_cli-0.2.14 → iris_security_cli-0.2.17}/iris_security_cli.egg-info/SOURCES.txt

@@ -9,6 +9,7 @@ iris_cli/certify.py
 iris_cli/compiler_config.py
 iris_cli/compliance_check_cmd.py
 iris_cli/compliance_fix.py
+iris_cli/compliance_scan_cmd.py
 iris_cli/cost.py
 iris_cli/declare.py
 iris_cli/delegation.py
@@ -53,6 +54,7 @@ iris_security_cli.egg-info/entry_points.txt
 iris_security_cli.egg-info/requires.txt
 iris_security_cli.egg-info/top_level.txt
 tests/test_audit_log.py
+tests/test_compliance_scan_fail_on.py
 tests/test_docs_pages_check.py
 tests/test_entitlements_display.py
 tests/test_evidence.py

{iris_security_cli-0.2.14 → iris_security_cli-0.2.17}/iris_security_cli.egg-info/requires.txt

@@ -1,5 +1,5 @@
-iris-security-core>=0.1.16
-iris-security-sdk>=0.2.14
+iris-security-core>=0.1.17
+iris-security-sdk>=0.2.17
 click>=8.1
 rich>=13.0
 pyyaml>=6.0

{iris_security_cli-0.2.14 → iris_security_cli-0.2.17}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "iris-security-cli"
-version = "0.2.14"
+version = "0.2.17"
 description = "IRIS CLI — declare, compile, preview, enforce, witness, certify, sentinel"
 readme = "README.md"
 license = { text = "Apache-2.0" }
@@ -20,8 +20,8 @@ classifiers = [
   "Programming Language :: Python :: 3.12",
 ]
 dependencies = [
-  "iris-security-core>=0.1.16",
-  "iris-security-sdk>=0.2.14",
+  "iris-security-core>=0.1.17",
+  "iris-security-sdk>=0.2.17",
   "click>=8.1",
   "rich>=13.0",
   "pyyaml>=6.0",
@@ -31,8 +31,8 @@ dependencies = [
 scm = ["iris-security-scm[all]>=0.2.0"]
 
 [project.urls]
-Homepage = "https://iris-security.github.io/iris-sdk/"
-Repository = "https://github.com/IRIS-Security/iris-sdk"
+Homepage = "https://github.com/gimartinb/iris-sdk"
+Repository = "https://github.com/gimartinb/iris-sdk"
 
 [project.scripts]
 iris = "iris_cli.main:cli"

iris_security_cli-0.2.17/tests/test_compliance_scan_fail_on.py

@@ -0,0 +1,56 @@
+"""Tests for iris compliance scan --fail-on CI thresholds."""
+
+from __future__ import annotations
+
+from click.testing import CliRunner
+
+from iris_cli.main import cli
+
+
+def test_compliance_scan_fail_on_blocker_exits_nonzero(monkeypatch):
+    runner = CliRunner()
+    profile = {
+        "providers": ["openai"],
+        "frameworks": ["langchain"],
+        "models": ["gpt-4"],
+        "data_categories": ["pii"],
+        "deployment_regions": ["eu"],
+        "agent_count": 5,
+        "autonomy_level": "autonomous",
+        "customer_facing": True,
+    }
+    obligations = [
+        {"severity": "blocker", "framework_key": "eu_ai_act", "recommended_action": "test"},
+    ]
+
+    monkeypatch.setattr(
+        "iris_cli.compliance_scan_cmd.detect_workload",
+        lambda path: profile,
+    )
+    monkeypatch.setattr(
+        "iris_cli.compliance_scan_cmd.evaluate_workload_profile",
+        lambda profile: obligations,
+    )
+
+    result = runner.invoke(cli, ["compliance", "scan", "--json", "--fail-on", "blocker"])
+    assert result.exit_code == 1
+
+
+def test_compliance_scan_fail_on_none_always_zero(monkeypatch):
+    runner = CliRunner()
+    profile = {"providers": [], "frameworks": [], "models": [], "agent_count": 0}
+    obligations = [
+        {"severity": "blocker", "framework_key": "eu_ai_act", "recommended_action": "test"},
+    ]
+
+    monkeypatch.setattr(
+        "iris_cli.compliance_scan_cmd.detect_workload",
+        lambda path: profile,
+    )
+    monkeypatch.setattr(
+        "iris_cli.compliance_scan_cmd.evaluate_workload_profile",
+        lambda profile: obligations,
+    )
+
+    result = runner.invoke(cli, ["compliance", "scan", "--json", "--fail-on", "none"])
+    assert result.exit_code == 0