iris-security-cli 0.2.16__tar.gz → 0.2.17__tar.gz

{iris_security_cli-0.2.16 → iris_security_cli-0.2.17}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iris-security-cli
-Version: 0.2.16
+Version: 0.2.17
 Summary: IRIS CLI — declare, compile, preview, enforce, witness, certify, sentinel
 License: Apache-2.0
 Project-URL: Homepage, https://github.com/gimartinb/iris-sdk
@@ -15,8 +15,8 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
-Requires-Dist: iris-security-core>=0.1.16
-Requires-Dist: iris-security-sdk>=0.2.16
+Requires-Dist: iris-security-core>=0.1.17
+Requires-Dist: iris-security-sdk>=0.2.17
 Requires-Dist: click>=8.1
 Requires-Dist: rich>=13.0
 Requires-Dist: pyyaml>=6.0
@@ -45,3 +45,16 @@ iris register --name my-agent --owner you@company.com --team my-team --complianc
 iris scan
 iris compliance check --framework colorado-ai-act
 ```
+
+## GitHub Action
+
+Add AI governance to CI with the composite Action in this repo (offline by default):
+
+```yaml
+- uses: IRIS-Security/iris-cli@v1
+  with:
+    command: compliance scan
+    fail-on: blocker
+```
+
+Optional `--push` to IRIS Cloud when `api-key` is set. See [GitHub Action docs](https://iris-security.github.io/iris-sdk/github-action.html).

{iris_security_cli-0.2.16 → iris_security_cli-0.2.17}/README.md

@@ -20,3 +20,16 @@ iris register --name my-agent --owner you@company.com --team my-team --complianc
 iris scan
 iris compliance check --framework colorado-ai-act
 ```
+
+## GitHub Action
+
+Add AI governance to CI with the composite Action in this repo (offline by default):
+
+```yaml
+- uses: IRIS-Security/iris-cli@v1
+  with:
+    command: compliance scan
+    fail-on: blocker
+```
+
+Optional `--push` to IRIS Cloud when `api-key` is set. See [GitHub Action docs](https://iris-security.github.io/iris-sdk/github-action.html).

{iris_security_cli-0.2.16 → iris_security_cli-0.2.17}/iris_cli/compliance_scan_cmd.py

@@ -7,6 +7,7 @@
 from __future__ import annotations
 
 import os
+import sys
 from pathlib import Path
 
 import click
@@ -23,6 +24,21 @@ from iris_core.compliance.workload_eval import (
 
 console = Console()
 
+_SEVERITY_RANK = {"blocker": 0, "required": 1, "recommended": 2}
+
+
+def _exit_on_fail_threshold(obligations: list[dict], fail_on: str) -> None:
+    if fail_on == "none":
+        return
+    threshold = _SEVERITY_RANK[fail_on]
+    blocking = [
+        obligation
+        for obligation in obligations
+        if _SEVERITY_RANK.get(obligation.get("severity", "recommended"), 9) <= threshold
+    ]
+    if blocking:
+        sys.exit(1)
+
 
 def _resolve_profile(
     *,
@@ -166,6 +182,13 @@ def _push_profile(profile: dict) -> None:
 @click.option("--proxy", "litellm_proxy", help="LiteLLM proxy base URL")
 @click.option("--lookback-days", default=30, show_default=True, help="Langfuse lookback window")
 @click.option("--push", is_flag=True, help="POST profile to cloud when IRIS_API_KEY is set")
+@click.option(
+    "--fail-on",
+    default="none",
+    type=click.Choice(["blocker", "required", "none"]),
+    show_default=True,
+    help="Exit 1 when obligations meet or exceed this severity (CI integration)",
+)
 @click.option("--json", "as_json", is_flag=True, help="Output raw JSON")
 def compliance_scan_cmd(
     path: str,
@@ -174,6 +197,7 @@ def compliance_scan_cmd(
     litellm_proxy: str | None,
     lookback_days: int,
     push: bool,
+    fail_on: str,
     as_json: bool,
 ) -> None:
     """Detect workload attributes and evaluate local regulatory obligations (offline)."""
@@ -196,6 +220,7 @@ def compliance_scan_cmd(
         click.echo(json.dumps({"profile": profile, "obligations": obligations}, indent=2))
         if push:
             _push_profile(profile)
+        _exit_on_fail_threshold(obligations, fail_on)
         return
 
     console.print(
@@ -214,3 +239,4 @@ def compliance_scan_cmd(
     )
     if push:
         _push_profile(profile)
+    _exit_on_fail_threshold(obligations, fail_on)

{iris_security_cli-0.2.16 → iris_security_cli-0.2.17}/iris_cli/main.py

@@ -50,7 +50,7 @@ class IrisCLI(click.Group):
 
 @click.group(cls=IrisCLI)
 @click.version_option(
-    version="0.2.16",
+    version="0.2.17",
     prog_name="iris",
     message="%(prog)s %(version)s · AARM Core conformant (R1–R6) · "
             "AIUC-1 Q1 2026 aligned · https://iris-security.io",
@@ -485,12 +485,20 @@ framework.add_command(framework_suggest, name="suggest")
 from iris_cli.assess import compliance_assess
 compliance.add_command(compliance_assess)
 
-# Wire in evidence commands
-from iris_cli.evidence import evidence
-cli.add_command(evidence)
+# Wire in evidence commands (optional — requires iris-security-core>=0.1.17 exporters)
+try:
+    from iris_cli.evidence import evidence
 
-from iris_cli.vault import vault
-cli.add_command(vault)
+    cli.add_command(evidence)
+except ModuleNotFoundError:
+    pass
+
+try:
+    from iris_cli.vault import vault
+
+    cli.add_command(vault)
+except ModuleNotFoundError:
+    pass
 
 from iris_cli.framework_test import test as framework_test_cmd_legacy
 # framework_test kept for internal imports; certify is the primary command

{iris_security_cli-0.2.16 → iris_security_cli-0.2.17}/iris_security_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iris-security-cli
-Version: 0.2.16
+Version: 0.2.17
 Summary: IRIS CLI — declare, compile, preview, enforce, witness, certify, sentinel
 License: Apache-2.0
 Project-URL: Homepage, https://github.com/gimartinb/iris-sdk
@@ -15,8 +15,8 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
-Requires-Dist: iris-security-core>=0.1.16
-Requires-Dist: iris-security-sdk>=0.2.16
+Requires-Dist: iris-security-core>=0.1.17
+Requires-Dist: iris-security-sdk>=0.2.17
 Requires-Dist: click>=8.1
 Requires-Dist: rich>=13.0
 Requires-Dist: pyyaml>=6.0
@@ -45,3 +45,16 @@ iris register --name my-agent --owner you@company.com --team my-team --complianc
 iris scan
 iris compliance check --framework colorado-ai-act
 ```
+
+## GitHub Action
+
+Add AI governance to CI with the composite Action in this repo (offline by default):
+
+```yaml
+- uses: IRIS-Security/iris-cli@v1
+  with:
+    command: compliance scan
+    fail-on: blocker
+```
+
+Optional `--push` to IRIS Cloud when `api-key` is set. See [GitHub Action docs](https://iris-security.github.io/iris-sdk/github-action.html).

{iris_security_cli-0.2.16 → iris_security_cli-0.2.17}/iris_security_cli.egg-info/SOURCES.txt

@@ -54,6 +54,7 @@ iris_security_cli.egg-info/entry_points.txt
 iris_security_cli.egg-info/requires.txt
 iris_security_cli.egg-info/top_level.txt
 tests/test_audit_log.py
+tests/test_compliance_scan_fail_on.py
 tests/test_docs_pages_check.py
 tests/test_entitlements_display.py
 tests/test_evidence.py

{iris_security_cli-0.2.16 → iris_security_cli-0.2.17}/iris_security_cli.egg-info/requires.txt

@@ -1,5 +1,5 @@
-iris-security-core>=0.1.16
-iris-security-sdk>=0.2.16
+iris-security-core>=0.1.17
+iris-security-sdk>=0.2.17
 click>=8.1
 rich>=13.0
 pyyaml>=6.0

{iris_security_cli-0.2.16 → iris_security_cli-0.2.17}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "iris-security-cli"
-version = "0.2.16"
+version = "0.2.17"
 description = "IRIS CLI — declare, compile, preview, enforce, witness, certify, sentinel"
 readme = "README.md"
 license = { text = "Apache-2.0" }
@@ -20,8 +20,8 @@ classifiers = [
   "Programming Language :: Python :: 3.12",
 ]
 dependencies = [
-  "iris-security-core>=0.1.16",
-  "iris-security-sdk>=0.2.16",
+  "iris-security-core>=0.1.17",
+  "iris-security-sdk>=0.2.17",
   "click>=8.1",
   "rich>=13.0",
   "pyyaml>=6.0",

iris_security_cli-0.2.17/tests/test_compliance_scan_fail_on.py

@@ -0,0 +1,56 @@
+"""Tests for iris compliance scan --fail-on CI thresholds."""
+
+from __future__ import annotations
+
+from click.testing import CliRunner
+
+from iris_cli.main import cli
+
+
+def test_compliance_scan_fail_on_blocker_exits_nonzero(monkeypatch):
+    runner = CliRunner()
+    profile = {
+        "providers": ["openai"],
+        "frameworks": ["langchain"],
+        "models": ["gpt-4"],
+        "data_categories": ["pii"],
+        "deployment_regions": ["eu"],
+        "agent_count": 5,
+        "autonomy_level": "autonomous",
+        "customer_facing": True,
+    }
+    obligations = [
+        {"severity": "blocker", "framework_key": "eu_ai_act", "recommended_action": "test"},
+    ]
+
+    monkeypatch.setattr(
+        "iris_cli.compliance_scan_cmd.detect_workload",
+        lambda path: profile,
+    )
+    monkeypatch.setattr(
+        "iris_cli.compliance_scan_cmd.evaluate_workload_profile",
+        lambda profile: obligations,
+    )
+
+    result = runner.invoke(cli, ["compliance", "scan", "--json", "--fail-on", "blocker"])
+    assert result.exit_code == 1
+
+
+def test_compliance_scan_fail_on_none_always_zero(monkeypatch):
+    runner = CliRunner()
+    profile = {"providers": [], "frameworks": [], "models": [], "agent_count": 0}
+    obligations = [
+        {"severity": "blocker", "framework_key": "eu_ai_act", "recommended_action": "test"},
+    ]
+
+    monkeypatch.setattr(
+        "iris_cli.compliance_scan_cmd.detect_workload",
+        lambda path: profile,
+    )
+    monkeypatch.setattr(
+        "iris_cli.compliance_scan_cmd.evaluate_workload_profile",
+        lambda profile: obligations,
+    )
+
+    result = runner.invoke(cli, ["compliance", "scan", "--json", "--fail-on", "none"])
+    assert result.exit_code == 0