s1-shift-left-cli 0.5.6__tar.gz → 1.0.0__tar.gz

{s1_shift_left_cli-0.5.6 → s1_shift_left_cli-1.0.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: s1_shift_left_cli
-Version: 0.5.6
+Version: 1.0.0
 Summary: SentinelOne CNS CLI is an extension of our vision to shift-left security with SentinelOne CNS.
 License: Proprietary
 Author: pingsafe-dev

{s1_shift_left_cli-0.5.6 → s1_shift_left_cli-1.0.0}/pyproject.toml

@@ -8,7 +8,7 @@ name = "s1_shift_left_cli"
 packages = [
     { include = "s1_cns_cli", from = "src" }
 ]
-version = "0.5.6" # update version in src/s1_cns_cli/version.py as well
+version = "1.0.0" # update version in src/s1_cns_cli/version.py as well
 authors = ["pingsafe-dev <dev@pingsafe.com>"]
 description = "SentinelOne CNS CLI is an extension of our vision to shift-left security with SentinelOne CNS."
 readme = "PYPI_README.md"

{s1_shift_left_cli-0.5.6 → s1_shift_left_cli-1.0.0}/src/s1_cns_cli/cli/command_line_arguments.py

@@ -17,6 +17,11 @@ from s1_cns_cli.cli.utils import get_home_path
 from s1_cns_cli.version import version
 
 
+class WideHelpFormatter(argparse.RawDescriptionHelpFormatter):
+    def __init__(self, prog, indent_increment=2, max_help_position=40, width=100):
+        super().__init__(prog, indent_increment, max_help_position, width)
+
+
 def evaluate_command_line_arguments():
     # Initialize global parser
     parser = argparse.ArgumentParser(
@@ -220,6 +225,14 @@ def add_iac_flags(iac_parser):
         default=False,
         help="scan pre-commit changes",
     )
+    iac_parser.add_argument(
+        "--pull-request",
+        dest="pull_request",
+        nargs=2,
+        type=str,
+        metavar="",
+        help="scan only new issues in pull request (head_branch base_branch)",
+    )
     iac_parser.add_argument(
         "--primary-resource-type",
         dest="primary_resource_type",
@@ -278,7 +291,19 @@ def add_iac_flags(iac_parser):
         help="paths to be ignored during scan using a glob expression",
     )
     iac_parser.add_argument(
-        "--tag", dest="tag", default="", metavar="", help="tag associated with scanner policy for scanning"
+        "--policy-id",
+        dest="policy_id",
+        default="",
+        metavar="",
+        help="policy ID to fetch scanner configuration",
+    )
+    iac_parser.add_argument(
+        "--threshold",
+        dest="threshold",
+        default="LOW",
+        metavar="",
+        choices=["CRITICAL", "HIGH", "MEDIUM", "LOW"],
+        help="severity threshold for directory scans (default: LOW)"
     )
     iac_parser.add_argument(
         "--var-file",
@@ -460,7 +485,11 @@ def add_secret_flags(secret_parser):
         help="show all findings irrespective of severity",
     )
     secret_parser.add_argument(
-        "--tag", dest="tag", default="", metavar="", help="tag associated with scanner policy for scanning"
+        "--policy-id",
+        dest="policy_id",
+        default="",
+        metavar="",
+        help="policy ID to fetch scanner configuration",
     )
     secret_parser.add_argument(
         "--verified-only",
@@ -469,6 +498,14 @@ def add_secret_flags(secret_parser):
         default=False,
         help="show results for verified secrets only",
     )
+    secret_parser.add_argument(
+        "--threshold",
+        dest="threshold",
+        default="LOW",
+        metavar="",
+        choices=["CRITICAL", "HIGH", "MEDIUM", "LOW"],
+        help="severity threshold for directory and pre-commit scans (default: LOW)"
+    )
 
 
 def add_vulnerability_flags(vulnerability_parser):
@@ -501,6 +538,13 @@ def add_vulnerability_flags(vulnerability_parser):
         default="",
         help="docker image to scan for vulnerabilities",
     )
+    vulnerability_parser.add_argument(
+        "--image-digest",
+        dest="image_digest",
+        metavar="",
+        default="",
+        help="image digest (sha256:...) for container image scan, used with --publish-result",
+    )
     vulnerability_parser.add_argument(
         "--fixed-only",
         dest="only_fixed",
@@ -536,6 +580,30 @@ def add_vulnerability_flags(vulnerability_parser):
         default="",
         help="specify password/auth-token for registry",
     )
+    vulnerability_parser.add_argument(
+        "--provider",
+        dest="provider",
+        help="specify git provider (GITHUB/GITLAB/BITBUCKET/AZURE_REPOS)",
+        metavar="",
+        default="",
+        required=False,
+    )
+    vulnerability_parser.add_argument(
+        "--publish-result",
+        dest="publish_result",
+        action="store_true",
+        default=False,
+        help="publish scan results to SentinelOne CNS",
+    )
+    vulnerability_parser.add_argument(
+        "--repository-type",
+        dest="repository_type",
+        metavar="",
+        choices=["organization", "developer"],
+        default="organization",
+        help="repository type when publishing results, options=[organization, developer] "
+             "(default=organization). Ignored for container image scans.",
+    )
     vulnerability_parser.add_argument(
         "--platform",
         dest="platform",
@@ -558,13 +626,21 @@ def add_vulnerability_flags(vulnerability_parser):
         default="",
         required=False,
     )
+    vulnerability_parser.add_argument(
+        "--repo-url",
+        dest="repo_url",
+        help=f"specify repository full url. Supported providers: {', '.join(SUPPORTED_GIT_PROVIDERS)}",
+        metavar="",
+        default="",
+        required=False,
+    )
     vulnerability_parser.add_argument(
         "--sbom-format",
         dest="sbom_format",
         metavar="",
-        choices=["s1-cns-json", "cyclonedx-json", "spdx-json"],
-        help="sbom output format for sbom, options=[s1-cns-json, cyclonedx-json, spdx-json] ("
-             "default=s1-cns-json)",
+        choices=["s1-cns-json", "cyclonedx-json", "spdx-json", "syft-json"],
+        help="sbom output format for sbom, options=[s1-cns-json, cyclonedx-json, spdx-json, "
+             "syft-json] (default=s1-cns-json)",
     )
     vulnerability_parser.add_argument(
         "--show-all-findings",
@@ -582,7 +658,11 @@ def add_vulnerability_flags(vulnerability_parser):
         help="paths to be ignored during scan using a glob expression",
     )
     vulnerability_parser.add_argument(
-        "--tag", dest="tag", default="", metavar="", help="tag associated with scanner policy for scanning"
+        "--policy-id",
+        dest="policy_id",
+        default="",
+        metavar="",
+        help="policy ID to fetch scanner configuration",
     )
     vulnerability_parser.add_argument(
         "--username",
@@ -596,18 +676,18 @@ def add_vulnerability_flags(vulnerability_parser):
         dest="vuln_format",
         default="s1-cns-json",
         metavar="",
-        choices=["s1-cns-json", "defect-dojo-generic-format"],
+        choices=["s1-cns-json", "defect-dojo-generic-format", "grype-json"],
         help="vulnerability scan export format, options=[s1-cns-json, "
              "defect-dojo-generic-format] ("
              "default=sentinelone-json)",
     )
+    # Vulnerability scanner doesn't use threshold flag
 
 
 def add_config_global_flags(config_sub_parser):
     config_sub_parser.add_argument(
         "--service-user-api-token",
         dest="service_user_api_token",
-        required=False,
         default="",
         metavar="",
         help="service-user-api-token for SentinelOne CNS CLI",
@@ -636,9 +716,9 @@ def add_config_global_flags(config_sub_parser):
     config_sub_parser.add_argument(
         "--management-console-url",
         dest="management_console_url",
-        metavar="url of the management console",
+        metavar="",
         required=True,
-        help="",
+        help="url of the management console",
     )
     config_sub_parser.add_argument(
         "--on-crash-exit-code",
@@ -651,19 +731,24 @@ def add_config_global_flags(config_sub_parser):
     config_sub_parser.add_argument(
         "--scope-id",
         dest="scope_id",
+        metavar="",
         help="scope id where the service user is created",
         required=True,
     )
-
     config_sub_parser.add_argument(
         "--scope-type",
         dest="scope_type",
         required=True,
-        metavar=f"scope type where the service user is created (default: {SCOPE_TYPE.ACCOUNT.value})",
+        metavar="",
         choices=[SCOPE_TYPE.ACCOUNT.value, SCOPE_TYPE.SITE.value],
+        help=f"scope type where the service user is created (default: {SCOPE_TYPE.ACCOUNT.value})",
     )
     config_sub_parser.add_argument(
-        "--tag", dest="tag", default="", metavar="", help="tag associated with scanner policy for scanning"
+        "--policy-id",
+        dest="policy_id",
+        default="",
+        metavar="",
+        help="policy ID to fetch scanner configuration",
     )
 
 
@@ -691,7 +776,7 @@ def add_global_sub_parser(parser):
         description="configure your SentinelOne CNS CLI",
         help="configure SentinelOne CNS cli",
         epilog=CONFIG_EPILOG,
-        formatter_class=argparse.RawDescriptionHelpFormatter,
+        formatter_class=WideHelpFormatter,
     )
 
     return scan_sub_parser, config_sub_parser

{s1_shift_left_cli-0.5.6 → s1_shift_left_cli-1.0.0}/src/s1_cns_cli/cli/registry.py

@@ -8,8 +8,9 @@ TIME_FORMAT = "%Y-%m-%d %H:%M:%S.%f"
 DEBUG_ENABLED = 0
 BASELINE_FILE = ".baseline"
 PACKAGE_NAME = "s1_shift_left_cli"
-DEFAULT_TIMEOUT = 10
+DEFAULT_TIMEOUT = 60
 BINARY_LIST = ["bin_secret_detector", "bin_eval_rego", "bin_vulnerability_scanner"]
+MINIMUM_MULTIPART_SIZE = 5 * 1024 * 1024  # 5 MB
 SENTRY_TAGS = ["management_console_url", "scope_id", "scope_type"]
 DEFAULT_IAC_CACHE_UPDATE_FREQUENCY = 12
 REPO_URL_MAX_LENGTH = 1024
@@ -43,6 +44,8 @@ DOWNLOAD_IAC_CACHE_API = "/web/api/v2.1/cnapp/cli/iac/cache"
 DOWNLOAD_VULN_DB_INFO_API = "/web/api/v2.1/cnapp/cli/vuln/db"
 PUBLISH_ISSUES_API = "/web/api/v2.1/cnapp/cli/publish/issues"
 GET_LATEST_VERSION_API = "/web/api/v2.1/cnapp/cli/latest-version"
+VULN_UPLOAD_INIT_API = "/web/api/v2.1/cnapp/cli/vuln/upload/init"
+VULN_UPLOAD_COMPLETE_API = "/web/api/v2.1/cnapp/cli/vuln/upload/complete"
 
 DEFAULT_SENTINELONE_CNS_DIR = ".s1cns"
 BINARY_DIR = "bin"
@@ -130,12 +133,13 @@ class GlobalConfig(str, Enum):
     IAC_LAST_REFRESHED_AT = "iac_last_refreshed_at"
     SCOPE_ID = "scope_id"
     SCOPE_TYPE = "scope_type"
-    TAG = "tag"
+    POLICY_ID = "policy_id"
 
 
 class HttpMethod(str, Enum):
     GET = "GET"
     POST = "POST"
+    PUT = "PUT"
 
 class SCOPE_TYPE(str, Enum):
     ACCOUNT = "ACCOUNT"
@@ -284,72 +288,135 @@ Examples:
 
 CONFIG_EPILOG = """
 Examples:
-    Configure SentinelOne CNS CLI:
-        s1-cns-cli config --service-user-api-token <s1-service-user-api-token> --management-console-url <console-url> --scope-type <scope-type> --scope-id <scope-id>
-
-    Other flags while configuring:
-             s1-cns-cli config  --service-user-api-token <s1-service-user-api-token> (required)
-                                --management-console-url <url> (required)
-                                --scope-id <s1-scope-id> (optional: required)
-                                --scope-type <s1-scope> (default: ACCOUNT)
-                                --workers-count <int> (optional, default: 5)
-                                --on-crash-exit-code <int> (optional, default: 1)
+  1. Basic setup (uses default policy - secret scan only):
+     s1-cns-cli config \\
+       --service-user-api-token <TOKEN> \\
+       --management-console-url https://your-console.sentinelone.net \\
+       --scope-type ACCOUNT \\
+       --scope-id <SCOPE_ID>
+
+  2. Setup with specific policy (enables IaC, secret, and vulnerability scans):
+     s1-cns-cli config \\
+       --service-user-api-token <TOKEN> \\
+       --management-console-url https://your-console.sentinelone.net \\
+       --scope-type ACCOUNT \\
+       --scope-id <SCOPE_ID> \\
+       --policy-id <POLICY_ID>
+
+Required:
+  --service-user-api-token   API token from SentinelOne console
+  --management-console-url   Your SentinelOne console URL
+  --scope-type               ACCOUNT or SITE
+  --scope-id                 Scope ID from SentinelOne console
+
+Optional:
+  --policy-id                Policy ID for scan configuration (recommended)
+  --workers-count            Parallel workers (default: 5)
+  --on-crash-exit-code       Exit code on error (default: 1)
+
+Note: Without --policy-id, only secret scanning is enabled by default.
 """
 
 
 IAC_EPILOG = """
 Examples:
-    List plugins:
-        s1-cns-cli scan iac --list-plugins
-        
-    Scan a directory:
-        s1-cns-cli scan iac -d <path/to/dir>
-        
-    Generate baseline:
-        s1-cns-cli scan iac -d <path/to/dir> --generate-baseline (optional, default: false)
-        
-    Generate sarif report
-        s1-cns-cli --output-format SARIF --output-file <path/to/file.sarif> scan iac -d <path/to/dir>
-        
-    Delete IaC cache:
-        s1-cns-cli scan iac --invalidate-cache
-    
-    Other flags:
-        s1-cns-cli scan iac -d <path/to/dir> (mandatory)
-                              --frameworks <all/terraform/cloudformation/kubernetes/helm> (optional, default: all)
-                              --include-ignored (optional, default: false)
-                              --download-external-modules (optional, default: false)
-                              --var-file <file/1 file/2 ... file/n> (optional)
-                              
+  1. Scan a directory for IaC misconfigurations:
+     s1-cns-cli scan iac -d /path/to/repo
+
+  2. Scan with severity threshold (only report HIGH and above):
+     s1-cns-cli scan iac -d /path/to/repo --threshold HIGH
+
+  3. Pre-commit hook (scan only NEW issues in staged files):
+     s1-cns-cli scan iac -d /path/to/repo --pre-commit
+
+  4. Pull request scan (find new misconfigurations introduced in PR):
+     s1-cns-cli scan iac -d /path/to/repo \\
+       --pull-request feature-branch main
+
+  5. Scan specific frameworks only:
+     s1-cns-cli scan iac -d /path/to/repo --frameworks terraform
+     s1-cns-cli scan iac -d /path/to/repo --frameworks kubernetes helm
+
+  6. Generate SARIF report for CI/CD:
+     s1-cns-cli --output-format SARIF --output-file results.sarif \\
+       scan iac -d /path/to/repo
+
+  7. List available plugins:
+     s1-cns-cli scan iac --list-plugins
+
+  8. Generate baseline (ignore existing issues):
+     s1-cns-cli scan iac -d /path/to/repo --generate-baseline
+
+  9. Publish results to SentinelOne console:
+     s1-cns-cli scan iac -d /path/to/repo \\
+       --pull-request feature-branch main \\
+       --publish-result \\
+       --repo-url https://github.com \\
+       --repo-full-name org/repo-name \\
+       --provider GITHUB
+
+  10. Use Terraform variable files:
+      s1-cns-cli scan iac -d /path/to/repo --var-file vars.tfvars prod.tfvars
+
+Common Options:
+  -d, --directory              Path to scan (required)
+  --threshold                  Severity filter: CRITICAL, HIGH, MEDIUM, LOW (default: LOW)
+  --pre-commit                 Scan only NEW issues in staged files
+  --pull-request               Compare branches: <head_branch> <base_branch>
+  --frameworks                 Frameworks to scan: all, terraform, cloudformation, kubernetes, helm
+  --download-external-modules  Download external Terraform modules
+  --var-file                   Terraform variable files
+  --include-ignored            Include baseline-ignored issues
+  --generate-baseline          Create baseline file to ignore existing issues
+  --invalidate-cache           Clear IaC scanner cache
 """
 
 
 SECRET_EPILOG = """
 Examples:
-    List detectors:
-        s1-cns-cli scan secret --list-detectors
-    
-    Scan a directory:
-        s1-cns-cli scan secret -d <path/to/dir>
-        
-    Generate sarif report
-        s1-cns-cli --output-format SARIF --output-file <path/to/file.sarif> scan secret -d <path/to/dir>
-        
-    Generate baseline:
-        s1-cns-cli scan secret -d <path/to/dir> --generate-baseline --range <start_ref end_ref>
-        
-    Other flags:
-        s1-cns-cli scan secret -d <path/to/dir> (mandatory)
-                                 --disable-verification (optional, default: false)
-                                 --mask-secret (optional, default: false)
-                                 --include-ignored (optional, default: false)
-                                 --verified-only (optional, default: false)
-                                 --pre-commit (optional, default: false)
-                                 --scan-commit (optional, default: HEAD)
-                                 --range <start_ref end_ref> (optional)
-                                 --pull-request <src_branch dest_branch> (optional)
-                                 --skip-paths <path/1 path/2 ... path/n> (optional)
-                                 --excluded-detectors <DETECTOR_API_KEY_1 DETECTOR_API_KEY_2 ... DETECTOR_API_KEY_N> (optional)
+  1. Scan a directory for secrets:
+     s1-cns-cli scan secret -d /path/to/repo
+
+  2. Scan with severity threshold (only report HIGH and above):
+     s1-cns-cli scan secret -d /path/to/repo --threshold HIGH
+
+  3. Pre-commit hook (scan staged files only):
+     s1-cns-cli scan secret -d /path/to/repo --pre-commit
+
+  4. Pull request scan (find new secrets introduced in PR):
+     s1-cns-cli scan secret -d /path/to/repo \\
+       --pull-request feature-branch main
+
+  5. Scan commit range (e.g., last 10 commits):
+     s1-cns-cli scan secret -d /path/to/repo --range HEAD~10 HEAD
+
+  6. Generate SARIF report for CI/CD:
+     s1-cns-cli --output-format SARIF --output-file results.sarif \\
+       scan secret -d /path/to/repo
+
+  7. List available detectors:
+     s1-cns-cli scan secret --list-detectors
+
+  8. Publish results to SentinelOne console:
+     s1-cns-cli scan secret -d /path/to/repo \\
+       --pull-request feature-branch main \\
+       --publish-result \\
+       --repo-url https://github.com \\
+       --repo-full-name org/repo-name \\
+       --provider GITHUB
+
+Common Options:
+  -d, --directory          Path to scan (required)
+  --threshold              Severity filter: CRITICAL, HIGH, MEDIUM, LOW (default: LOW)
+  --pre-commit             Scan only staged files
+  --pull-request           Compare branches: <head_branch> <base_branch>
+  --range                  Scan commit range: <start_ref> <end_ref>
+  --disable-verification   Skip secret verification (faster, less accurate)
+  --verified-only          Show only verified secrets
+  --mask-secret            Hide secret values in output
+  --skip-paths             Paths to ignore (glob patterns)
+  --excluded-detectors     Detectors to skip
+  --generate-baseline      Create baseline file to ignore existing issues
 """
 
 
@@ -357,21 +424,30 @@ VULN_EPILOG = """
 Examples:
     Scan a directory or tarball file:
         s1-cns-cli scan vuln -d <path/to/dir/or/tarball>
-        
+
     Scan a docker image:
         s1-cns-cli scan vuln --docker-image <image>
-        
+
     Scan a private docker image:
         s1-cns-cli scan vuln --docker-image <image> --username <username> --password <password> --registry <registry>
-        
-    Generate sarif report
+
+    Publish repository scan results:
+        s1-cns-cli scan vuln -d <path/to/dir> --publish-result --repo-url <repo-url> --repo-full-name <org/repo> --provider GITHUB
+        s1-cns-cli scan vuln -d <path/to/dir> --publish-result --repository-type developer --repo-url <repo-url> --repo-full-name <org/repo> --provider GITHUB
+
+    Publish container image scan results:
+        s1-cns-cli scan vuln --docker-image <image> --image-digest <sha256:...> --publish-result
+        s1-cns-cli scan vuln --docker-image <image> --image-digest <sha256:...> --publish-result --registry <registry> --username <username> --password <password>
+
+    Generate sarif report:
         s1-cns-cli --output-format SARIF --output-file <path/to/file.sarif> scan vuln -d <path/to/dir>
-    
+
     Other flags:
         s1-cns-cli scan vuln --docker-image <image> (mandatory)
                                --fixed-only (optional, default: false)
                                --registry (default: index.docker.io)
                                --username (registry username)
                                --password (registry password)
+                               --repository-type (default: organization, options: organization|developer)
 """