sec-report-kit 0.2.3__tar.gz → 0.2.4__tar.gz

{sec_report_kit-0.2.3 → sec_report_kit-0.2.4}/.gitignore

@@ -93,3 +93,4 @@ data/
 logs/
 security_reports/
 .tools/
+codeql-db/

sec_report_kit-0.2.4/CHANGELOG.md

@@ -0,0 +1,46 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+## 0.2.4 - 2026-05-14
+
+### Added
+- `scripts/install_external_clis.py` now supports `--tool` for targeted installs.
+- `scripts/install_external_clis.py` now supports `--force` to re-download tools even when already installed.
+- `README.md` now documents external CLI installer options and usage examples.
+
+### Changed
+- External CLI installer now skips already-installed tools by default.
+- CodeQL install handling on Windows now uses staged extraction and merge to avoid directory lock errors during reinstall.
+- `scripts/run_osv_scanner.bat` now auto-generates `requirements.txt` from installed packages when no supported lockfile is present.
+
+### Fixed
+- `scripts/run_codeql.bat` now repairs incomplete local CodeQL installs and validates SARIF output existence.
+- `scripts/run_codeql.sh` now validates SARIF output existence after analysis.
+- `scripts/run_trufflehog.bat` now writes scanner output via temp files to avoid self-scan file locking.
+- `scripts/run_trufflehog.bat` now writes `[]` when no findings are present.
+
+## 0.2.3 - 2026-05-13
+
+### Added
+- Safety CLI parser support and HTML rendering flow.
+- New CLI command: `srk render safety`.
+- MCP support for `source_type="safety"`.
+- Helper scripts for Safety scan and render:
+  - `scripts/run_safety.sh`
+  - `scripts/run_safety.bat`
+  - `scripts/render_safety_html.sh`
+  - `scripts/render_safety_html.bat`
+- Offline Safety DB download helpers:
+  - `scripts/download_safety_db.py`
+  - `scripts/download_safety_db.sh`
+  - `scripts/download_safety_db.bat`
+
+### Changed
+- Auto-detection now recognizes Safety JSON payloads.
+- Tool installation scripts now install Safety CLI in the app venv.
+- README updated with Safety usage and offline/local DB workflow guidance.
+
+### Fixed
+- Safety run scripts now avoid false success when network failures occur.
+- JSON output validation improved for Safety execution paths.

{sec_report_kit-0.2.3 → sec_report_kit-0.2.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sec-report-kit
-Version: 0.2.3
+Version: 0.2.4
 Summary: Generate HTML security reports from Trivy, pip-audit, Safety, Bandit, and Gitleaks JSON
 Author: Ravi Konduru
 License: MIT
@@ -100,6 +100,31 @@ scripts\install_tools.bat
 
 After cloning on a new machine, run the install script above to recreate the local `.tools/` directory and install required external CLI binaries (`codeql`, `tfsec`, `gitleaks`, `trufflehog`, `osv-scanner`) alongside Python dependencies. The `.tools/` folder is intentionally not committed to git.
 
+Install or update external CLI binaries directly:
+
+```bash
+python scripts/install_external_clis.py --repo-root .
+```
+
+Default behavior skips tools that are already installed locally.
+
+Force re-download/reinstall for all supported external tools:
+
+```bash
+python scripts/install_external_clis.py --repo-root . --force
+```
+
+Install only selected tool(s) with `--tool` (can be repeated or comma-separated):
+
+```bash
+python scripts/install_external_clis.py --repo-root . --tool osv-scanner
+python scripts/install_external_clis.py --repo-root . --tool tfsec --tool gitleaks --force
+python scripts/install_external_clis.py --repo-root . --tool tfsec,gitleaks
+```
+
+Supported `--tool` values: `codeql`, `tfsec`, `gitleaks`, `trufflehog`, `osv-scanner`.
+For convenience, `ocs-scanner` is accepted as an alias for `osv-scanner`.
+
 Run all unit tests locally with coverage:
 
 ```bash

{sec_report_kit-0.2.3 → sec_report_kit-0.2.4}/README.md

@@ -73,6 +73,31 @@ scripts\install_tools.bat
 
 After cloning on a new machine, run the install script above to recreate the local `.tools/` directory and install required external CLI binaries (`codeql`, `tfsec`, `gitleaks`, `trufflehog`, `osv-scanner`) alongside Python dependencies. The `.tools/` folder is intentionally not committed to git.
 
+Install or update external CLI binaries directly:
+
+```bash
+python scripts/install_external_clis.py --repo-root .
+```
+
+Default behavior skips tools that are already installed locally.
+
+Force re-download/reinstall for all supported external tools:
+
+```bash
+python scripts/install_external_clis.py --repo-root . --force
+```
+
+Install only selected tool(s) with `--tool` (can be repeated or comma-separated):
+
+```bash
+python scripts/install_external_clis.py --repo-root . --tool osv-scanner
+python scripts/install_external_clis.py --repo-root . --tool tfsec --tool gitleaks --force
+python scripts/install_external_clis.py --repo-root . --tool tfsec,gitleaks
+```
+
+Supported `--tool` values: `codeql`, `tfsec`, `gitleaks`, `trufflehog`, `osv-scanner`.
+For convenience, `ocs-scanner` is accepted as an alias for `osv-scanner`.
+
 Run all unit tests locally with coverage:
 
 ```bash

{sec_report_kit-0.2.3 → sec_report_kit-0.2.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sec-report-kit"
-version = "0.2.3"
+version = "0.2.4"
 description = "Generate HTML security reports from Trivy, pip-audit, Safety, Bandit, and Gitleaks JSON"
 readme = "README.md"
 requires-python = ">=3.10"

sec_report_kit-0.2.4/requirements.txt

@@ -0,0 +1,84 @@
+annotated-doc==0.0.4
+annotated-types==0.7.0
+anyio==4.13.0
+attrs==26.1.0
+bandit==1.9.4
+boolean.py==5.0
+build==1.5.0
+CacheControl==0.14.4
+certifi==2026.4.22
+cffi==2.0.0
+charset-normalizer==3.4.7
+click==8.3.3
+colorama==0.4.6
+coverage==7.14.0
+cryptography==47.0.0
+cyclonedx-python-lib==11.7.0
+defusedxml==0.7.1
+docutils==0.22.4
+filelock==3.29.0
+h11==0.16.0
+httpcore==1.0.9
+httpx==0.28.1
+httpx-sse==0.4.3
+id==1.6.1
+idna==3.13
+iniconfig==2.3.0
+jaraco.classes==3.4.0
+jaraco.context==6.1.2
+jaraco.functools==4.4.0
+jsonschema==4.26.0
+jsonschema-specifications==2025.9.1
+keyring==25.7.0
+license-expression==30.4.4
+markdown-it-py==4.0.0
+mcp==1.27.0
+mdurl==0.1.2
+more-itertools==11.0.2
+msgpack==1.1.2
+nh3==0.3.5
+packageurl-python==0.17.6
+packaging==26.2
+pip-api==0.0.34
+pip-requirements-parser==32.0.1
+pip_audit==2.10.0
+platformdirs==4.9.6
+pluggy==1.6.0
+py-serializable==2.1.0
+pycparser==3.0
+pydantic==2.13.3
+pydantic-settings==2.14.0
+pydantic_core==2.46.3
+pyfiglet==1.0.4
+Pygments==2.20.0
+PyJWT==2.12.1
+pyparsing==3.3.2
+pyproject_hooks==1.2.0
+pytest==9.0.3
+pytest-cov==7.1.0
+python-dotenv==1.2.2
+python-multipart==0.0.27
+pywin32==311
+pywin32-ctypes==0.2.3
+PyYAML==6.0.3
+readme_renderer==44.0
+referencing==0.37.0
+requests==2.33.1
+requests-toolbelt==1.0.0
+rfc3986==2.0.0
+rich==15.0.0
+rpds-py==0.30.0
+-e git+https://github.com/ShanKonduru/sec-report-kit.git@b6d196bac687e07189e884e2fe25af5c8842da1d#egg=sec_report_kit
+shellingham==1.5.4
+sortedcontainers==2.4.0
+sse-starlette==3.4.1
+starlette==1.0.0
+stevedore==5.7.0
+tomli==2.4.1
+tomli_w==1.2.0
+twine==6.2.0
+typer==0.25.1
+typing-inspection==0.4.2
+typing_extensions==4.15.0
+urllib3==2.6.3
+uvicorn==0.46.0

{sec_report_kit-0.2.3 → sec_report_kit-0.2.4}/scripts/install_external_clis.py

@@ -12,6 +12,7 @@ import re
 import shutil
 import stat
 import tarfile
+import tempfile
 import urllib.error
 import urllib.request
 import zipfile
@@ -127,20 +128,26 @@ def extract_binary_from_archive(data: bytes, archive_name: str, binary_names: li
 
 def install_codeql(asset_data: bytes, asset_name: str, tools_bin: Path) -> None:
     target_dir = tools_bin / "codeql"
-    if target_dir.exists():
-        shutil.rmtree(target_dir)
-
-    if asset_name.lower().endswith(".zip"):
-        with zipfile.ZipFile(io.BytesIO(asset_data)) as zf:
-            zf.extractall(tools_bin)
-    elif asset_name.lower().endswith(".tar.gz") or asset_name.lower().endswith(".tgz"):
-        with tarfile.open(fileobj=io.BytesIO(asset_data), mode="r:gz") as tf:
-            tf.extractall(tools_bin)
-    else:
-        raise RuntimeError(f"Unsupported codeql archive format: {asset_name}")
-
-    if not target_dir.exists():
-        raise RuntimeError("CodeQL extraction failed: missing .tools/bin/codeql directory")
+    with tempfile.TemporaryDirectory(prefix="codeql-stage-") as staging_dir:
+        staging_path = Path(staging_dir)
+
+        if asset_name.lower().endswith(".zip"):
+            with zipfile.ZipFile(io.BytesIO(asset_data)) as zf:
+                zf.extractall(staging_path)
+        elif asset_name.lower().endswith(".tar.gz") or asset_name.lower().endswith(".tgz"):
+            with tarfile.open(fileobj=io.BytesIO(asset_data), mode="r:gz") as tf:
+                tf.extractall(staging_path)
+        else:
+            raise RuntimeError(f"Unsupported codeql archive format: {asset_name}")
+
+        extracted_dir = staging_path / "codeql"
+        if not extracted_dir.exists():
+            raise RuntimeError("CodeQL extraction failed: missing codeql directory in archive")
+
+        if target_dir.exists():
+            shutil.copytree(extracted_dir, target_dir, dirs_exist_ok=True)
+        else:
+            shutil.move(str(extracted_dir), str(target_dir))
 
     codeql_bin = target_dir / ("codeql.exe" if os.name == "nt" else "codeql")
     if codeql_bin.exists():
@@ -171,14 +178,34 @@ def install_tool(tool_name: str, repo: str, patterns: list[str], tools_bin: Path
 
 def has_installed_tool(tool_name: str, tools_bin: Path, dest_name: str) -> bool:
     if tool_name == "codeql":
-        candidate = tools_bin / "codeql" / ("codeql.exe" if os.name == "nt" else "codeql")
-        return candidate.exists()
+        codeql_root = tools_bin / "codeql"
+        codeql_bin = codeql_root / ("codeql.exe" if os.name == "nt" else "codeql")
+        if not codeql_bin.exists():
+            return False
+        # A healthy CodeQL bundle includes an embedded Java runtime under tools/<platform>/java/bin.
+        java_glob = "java.exe" if os.name == "nt" else "java"
+        has_embedded_java = any(codeql_root.glob(f"tools/*/java/bin/{java_glob}"))
+        return has_embedded_java
     return (tools_bin / dest_name).exists()
 
 
 def main() -> int:
     parser = argparse.ArgumentParser(description="Install external scanner CLIs into .tools/bin")
     parser.add_argument("--repo-root", required=True, help="Repository root path")
+    parser.add_argument(
+        "--tool",
+        action="append",
+        default=[],
+        help=(
+            "Install only selected tool(s). Can be passed multiple times or as a comma-separated list "
+            "(e.g. --tool tfsec --tool gitleaks or --tool tfsec,gitleaks)"
+        ),
+    )
+    parser.add_argument(
+        "--force",
+        action="store_true",
+        help="Force re-download/reinstall even when a local install already exists",
+    )
     args = parser.parse_args()
 
     repo_root = Path(args.repo_root).resolve()
@@ -193,8 +220,8 @@ def main() -> int:
             "repo": "github/codeql-action",
             "patterns": {
                 "windows": [r"codeql-bundle-win64\.tar\.gz$", r"codeql-bundle-win64\.zip$"],
-                "linux": [r"codeql-bundle-linux64\\.tar\\.gz$"],
-                "darwin": [r"codeql-bundle-osx64\\.tar\\.gz$", r"codeql-bundle-osx64\\.zip$"],
+                "linux": [r"codeql-bundle-linux64\.tar\.gz$"],
+                "darwin": [r"codeql-bundle-osx64\.tar\.gz$", r"codeql-bundle-osx64\.zip$"],
             },
             "binary_names": [f"codeql{ext}"],
             "dest_name": f"codeql{ext}",
@@ -202,7 +229,7 @@ def main() -> int:
         "tfsec": {
             "repo": "aquasecurity/tfsec",
             "patterns": {
-                "windows": [r"tfsec-windows-amd64(?:\\.exe)?$"],
+                "windows": [r"tfsec-windows-amd64(?:\.exe)?$", r"tfsec_.*_windows_amd64\.tar\.gz$"],
                 "linux": [r"tfsec-linux-amd64$"],
                 "darwin": [r"tfsec-darwin-amd64$", r"tfsec-darwin-arm64$"],
             },
@@ -212,9 +239,9 @@ def main() -> int:
         "gitleaks": {
             "repo": "gitleaks/gitleaks",
             "patterns": {
-                "windows": [r"gitleaks_.*_windows_x64\\.zip$"],
-                "linux": [r"gitleaks_.*_linux_x64\\.tar\\.gz$"],
-                "darwin": [r"gitleaks_.*_darwin_arm64\\.tar\\.gz$", r"gitleaks_.*_darwin_x64\\.tar\\.gz$"],
+                "windows": [r"gitleaks_.*_windows_x64\.zip$"],
+                "linux": [r"gitleaks_.*_linux_x64\.tar\.gz$"],
+                "darwin": [r"gitleaks_.*_darwin_arm64\.tar\.gz$", r"gitleaks_.*_darwin_x64\.tar\.gz$"],
             },
             "binary_names": [f"gitleaks{ext}"],
             "dest_name": f"gitleaks{ext}",
@@ -222,9 +249,9 @@ def main() -> int:
         "trufflehog": {
             "repo": "trufflesecurity/trufflehog",
             "patterns": {
-                "windows": [r"trufflehog_.*_windows_amd64\\.tar\\.gz$", r"trufflehog_.*_windows_amd64\\.zip$"],
-                "linux": [r"trufflehog_.*_linux_amd64\\.tar\\.gz$"],
-                "darwin": [r"trufflehog_.*_darwin_arm64\\.tar\\.gz$", r"trufflehog_.*_darwin_amd64\\.tar\\.gz$"],
+                "windows": [r"trufflehog_.*_windows_amd64\.tar\.gz$", r"trufflehog_.*_windows_amd64\.zip$"],
+                "linux": [r"trufflehog_.*_linux_amd64\.tar\.gz$"],
+                "darwin": [r"trufflehog_.*_darwin_arm64\.tar\.gz$", r"trufflehog_.*_darwin_amd64\.tar\.gz$"],
             },
             "binary_names": [f"trufflehog{ext}"],
             "dest_name": f"trufflehog{ext}",
@@ -232,19 +259,48 @@ def main() -> int:
         "osv-scanner": {
             "repo": "google/osv-scanner",
             "patterns": {
-                "windows": [r"osv-scanner_windows_amd64(?:\\.exe)?(?:\\.zip)?$", r"osv-scanner_.*_windows_amd64(?:\\.exe)?(?:\\.zip)?$", r"osv-scanner-windows-amd64(?:\\.exe)?$"],
-                "linux": [r"osv-scanner_.*_linux_amd64(?:\\.tar\\.gz)?$", r"osv-scanner-linux-amd64$"],
-                "darwin": [r"osv-scanner_.*_darwin_amd64(?:\\.tar\\.gz)?$", r"osv-scanner_.*_darwin_arm64(?:\\.tar\\.gz)?$"],
+                "windows": [r"osv-scanner_windows_amd64(?:\.exe)?(?:\.zip)?$", r"osv-scanner_.*_windows_amd64(?:\.exe)?(?:\.zip)?$", r"osv-scanner-windows-amd64(?:\.exe)?$"],
+                "linux": [r"osv-scanner_.*_linux_amd64(?:\.tar\.gz)?$", r"osv-scanner-linux-amd64$"],
+                "darwin": [r"osv-scanner_.*_darwin_amd64(?:\.tar\.gz)?$", r"osv-scanner_.*_darwin_arm64(?:\.tar\.gz)?$"],
             },
             "binary_names": [f"osv-scanner{ext}"],
             "dest_name": f"osv-scanner{ext}",
         },
     }
 
+    tool_aliases = {
+        "ocs-scanner": "osv-scanner",
+    }
+
+    selected_tools: set[str] = set()
+    if args.tool:
+        for raw_value in args.tool:
+            for item in raw_value.split(","):
+                normalized = item.strip().lower()
+                if not normalized:
+                    continue
+                normalized = tool_aliases.get(normalized, normalized)
+                if normalized not in tool_matrix:
+                    available = ", ".join(sorted(tool_matrix.keys()))
+                    print(f"Unknown tool: {item}")
+                    print(f"Available tools: {available}")
+                    return 1
+                selected_tools.add(normalized)
+
+    tools_to_process = [
+        (tool_name, cfg)
+        for tool_name, cfg in tool_matrix.items()
+        if not selected_tools or tool_name in selected_tools
+    ]
+
     failures: list[str] = []
     rate_limited = False
 
-    for tool_name, cfg in tool_matrix.items():
+    for tool_name, cfg in tools_to_process:
+        if not args.force and has_installed_tool(tool_name, tools_bin, cfg["dest_name"]):
+            print(f"Skipping {tool_name}: already installed (use --force to reinstall)")
+            continue
+
         patterns = cfg["patterns"][platform_name]
         try:
             install_tool(

sec_report_kit-0.2.4/scripts/run_codeql.bat

@@ -0,0 +1,81 @@
+@echo off
+setlocal
+
+set "REPO_ROOT=%~dp0.."
+set "APP_PYTHON=python"
+if exist "%REPO_ROOT%\.venv\Scripts\python.exe" set "APP_PYTHON=%REPO_ROOT%\.venv\Scripts\python.exe"
+
+set "REPORT_DIR=%~1"
+if "%REPORT_DIR%"=="" set "REPORT_DIR=security_reports"
+
+set "DATABASE_PATH=%~2"
+if "%DATABASE_PATH%"=="" set "DATABASE_PATH=codeql-db"
+
+set "QUERY_SUITE=%~3"
+if "%QUERY_SUITE%"=="" set "QUERY_SUITE=codeql/python-queries"
+
+set "OUT_JSON=%REPORT_DIR%\codeql.sarif.json"
+set "CODEQL_CMD=codeql"
+set "LOCAL_CODEQL_EXE=%~dp0..\.tools\bin\codeql\codeql.exe"
+set "LOCAL_CODEQL_JAVA=%~dp0..\.tools\bin\codeql\tools\win64\java\bin\java.exe"
+
+if exist "%LOCAL_CODEQL_EXE%" set "CODEQL_CMD=%LOCAL_CODEQL_EXE%"
+set "CODEQL_CMD=%CODEQL_CMD:\"=%"
+set "CODEQL_CMD=%CODEQL_CMD:'=%"
+
+if not exist "%REPORT_DIR%" mkdir "%REPORT_DIR%"
+
+where "%CODEQL_CMD%" >nul 2>&1
+if errorlevel 1 if /I "%CODEQL_CMD%"=="codeql" (
+  echo codeql not found. Attempting local install into .tools\bin...
+  "%APP_PYTHON%" "%~dp0install_external_clis.py" --repo-root "%REPO_ROOT%" --tool codeql --force
+  if errorlevel 1 (
+    echo Failed to install CodeQL CLI.
+    exit /b 1
+  )
+  if exist "%LOCAL_CODEQL_EXE%" set "CODEQL_CMD=%LOCAL_CODEQL_EXE%"
+  set "CODEQL_CMD=%CODEQL_CMD:\"=%"
+  set "CODEQL_CMD=%CODEQL_CMD:'=%"
+  where "%CODEQL_CMD%" >nul 2>&1
+  if errorlevel 1 if /I "%CODEQL_CMD%"=="codeql" (
+    echo codeql is not installed or not on PATH.
+    echo Install from: https://codeql.github.com/docs/codeql-overview/codeql-changelog/
+    exit /b 1
+  )
+)
+
+if exist "%LOCAL_CODEQL_EXE%" if not exist "%LOCAL_CODEQL_JAVA%" (
+  echo Local CodeQL install appears incomplete ^(missing embedded Java^). Reinstalling CodeQL...
+  "%APP_PYTHON%" "%~dp0install_external_clis.py" --repo-root "%REPO_ROOT%" --tool codeql --force
+  if errorlevel 1 (
+    echo Failed to reinstall CodeQL CLI.
+    exit /b 1
+  )
+  if not exist "%LOCAL_CODEQL_JAVA%" (
+    echo CodeQL reinstall completed, but embedded Java is still missing:
+    echo   %LOCAL_CODEQL_JAVA%
+    exit /b 1
+  )
+)
+
+if not exist "%DATABASE_PATH%" (
+  echo CodeQL database not found at %DATABASE_PATH%. Creating database...
+  "%CODEQL_CMD%" database create "%DATABASE_PATH%" --language=python --source-root="%REPO_ROOT%"
+  if errorlevel 1 (
+    echo Failed to create CodeQL database at %DATABASE_PATH%
+    exit /b 1
+  )
+)
+
+"%CODEQL_CMD%" database finalize "%DATABASE_PATH%" >nul 2>&1
+
+"%CODEQL_CMD%" database analyze "%DATABASE_PATH%" "%QUERY_SUITE%" --format=sarifv2.1.0 --output="%OUT_JSON%"
+if errorlevel 1 exit /b 1
+
+if not exist "%OUT_JSON%" (
+  echo CodeQL analyze completed but did not produce output file:
+  echo   %OUT_JSON%
+  exit /b 1
+)
+
+echo CodeQL SARIF report written to %OUT_JSON%

{sec_report_kit-0.2.3 → sec_report_kit-0.2.4}/scripts/run_codeql.sh

@@ -19,6 +19,13 @@ if ! command -v "${CODEQL_CMD}" >/dev/null 2>&1; then
   exit 1
 fi
 
+"${CODEQL_CMD}" database finalize "${DATABASE_PATH}" >/dev/null 2>&1 || true
+
 "${CODEQL_CMD}" database analyze "${DATABASE_PATH}" "${QUERY_SUITE}" --format=sarifv2.1.0 --output="${OUT_JSON}"
 
+if [[ ! -f "${OUT_JSON}" ]]; then
+  echo "CodeQL analyze completed but did not produce output file: ${OUT_JSON}" >&2
+  exit 1
+fi
+
 echo "CodeQL SARIF report written to ${OUT_JSON}"

sec_report_kit-0.2.4/scripts/run_osv_scanner.bat

@@ -0,0 +1,80 @@
+@echo off
+setlocal
+
+set "REPO_ROOT=%~dp0.."
+set "APP_PYTHON=python"
+if exist "%REPO_ROOT%\.venv\Scripts\python.exe" set "APP_PYTHON=%REPO_ROOT%\.venv\Scripts\python.exe"
+
+set "REPORT_DIR=%~1"
+if "%REPORT_DIR%"=="" set "REPORT_DIR=security_reports"
+
+set "TARGET_PATH=%~2"
+if "%TARGET_PATH%"=="" set "TARGET_PATH=."
+
+set "OUT_JSON=%REPORT_DIR%\osv-scanner.json"
+set "OSV_CMD=osv-scanner"
+
+if exist "%~dp0..\.tools\bin\osv-scanner.exe" set "OSV_CMD=%~dp0..\.tools\bin\osv-scanner.exe"
+
+if not exist "%REPORT_DIR%" mkdir "%REPORT_DIR%"
+
+where "%OSV_CMD%" >nul 2>&1
+if errorlevel 1 if /I "%OSV_CMD%"=="osv-scanner" (
+  echo osv-scanner not found. Attempting local install into .tools\bin...
+  "%APP_PYTHON%" "%~dp0install_external_clis.py" --repo-root "%REPO_ROOT%"
+  if exist "%~dp0..\.tools\bin\osv-scanner.exe" set "OSV_CMD=%~dp0..\.tools\bin\osv-scanner.exe"
+  where "%OSV_CMD%" >nul 2>&1
+  if errorlevel 1 if /I "%OSV_CMD%"=="osv-scanner" (
+    echo osv-scanner is not installed or not on PATH.
+    echo Install from: https://github.com/google/osv-scanner
+    exit /b 1
+  )
+)
+
+set "TMP_JSON=%TEMP%\srk-osv-%RANDOM%-%RANDOM%.json"
+
+rem Build scan args: prefer explicit lockfile sources over bare directory walk
+set "OSV_ARGS=--format json --output-file "%TMP_JSON%""
+
+set "FOUND_SOURCE=0"
+if exist "%REPO_ROOT%\requirements.txt"   set "OSV_ARGS=%OSV_ARGS% --lockfile "%REPO_ROOT%\requirements.txt""   & set "FOUND_SOURCE=1"
+if exist "%REPO_ROOT%\requirements-dev.txt" set "OSV_ARGS=%OSV_ARGS% --lockfile "%REPO_ROOT%\requirements-dev.txt"" & set "FOUND_SOURCE=1"
+if exist "%REPO_ROOT%\poetry.lock"        set "OSV_ARGS=%OSV_ARGS% --lockfile "%REPO_ROOT%\poetry.lock""        & set "FOUND_SOURCE=1"
+if exist "%REPO_ROOT%\Pipfile.lock"       set "OSV_ARGS=%OSV_ARGS% --lockfile "%REPO_ROOT%\Pipfile.lock""       & set "FOUND_SOURCE=1"
+if exist "%REPO_ROOT%\uv.lock"            set "OSV_ARGS=%OSV_ARGS% --lockfile "%REPO_ROOT%\uv.lock""            & set "FOUND_SOURCE=1"
+if exist "%REPO_ROOT%\pdm.lock"           set "OSV_ARGS=%OSV_ARGS% --lockfile "%REPO_ROOT%\pdm.lock""           & set "FOUND_SOURCE=1"
+
+if "%FOUND_SOURCE%"=="0" (
+  echo No supported lockfile found. Generating requirements.txt from installed packages...
+  "%APP_PYTHON%" -m pip freeze > "%REPO_ROOT%\requirements.txt"
+  if errorlevel 1 (
+    echo Failed to generate requirements.txt. Skipping OSV scan.
+    echo [] > "%OUT_JSON%"
+    exit /b 0
+  )
+  echo Generated %REPO_ROOT%\requirements.txt
+  set "OSV_ARGS=%OSV_ARGS% --lockfile "%REPO_ROOT%\requirements.txt""
+  set "FOUND_SOURCE=1"
+)
+
+"%OSV_CMD%" scan %OSV_ARGS%
+set "OSV_EXIT=%ERRORLEVEL%"
+
+if not exist "%TMP_JSON%" echo [] > "%TMP_JSON%"
+move /Y "%TMP_JSON%" "%OUT_JSON%" >nul
+
+rem Exit code 1 = vulnerabilities found; 127 = no package sources found — both are non-error outcomes
+if "%OSV_EXIT%"=="1" (
+  echo OSV-Scanner JSON report written to %OUT_JSON% ^(vulnerabilities found^)
+  exit /b 0
+)
+if "%OSV_EXIT%"=="127" (
+  echo OSV-Scanner found no scannable package sources. No supported lockfile detected.
+  exit /b 0
+)
+if "%OSV_EXIT%" NEQ "0" (
+  echo OSV-Scanner failed with exit code %OSV_EXIT%
+  exit /b %OSV_EXIT%
+)
+
+echo OSV-Scanner JSON report written to %OUT_JSON%

{sec_report_kit-0.2.3 → sec_report_kit-0.2.4}/scripts/run_tfsec.bat

@@ -1,6 +1,10 @@
 @echo off
 setlocal
 
+set "REPO_ROOT=%~dp0.."
+set "APP_PYTHON=python"
+if exist "%REPO_ROOT%\.venv\Scripts\python.exe" set "APP_PYTHON=%REPO_ROOT%\.venv\Scripts\python.exe"
+
 set "REPORT_DIR=%~1"
 if "%REPORT_DIR%"=="" set "REPORT_DIR=security_reports"
 
@@ -16,9 +20,15 @@ if not exist "%REPORT_DIR%" mkdir "%REPORT_DIR%"
 
 where "%TFSEC_CMD%" >nul 2>&1
 if errorlevel 1 if /I "%TFSEC_CMD%"=="tfsec" (
-  echo tfsec is not installed or not on PATH.
-  echo Install from: https://github.com/aquasecurity/tfsec
-  exit /b 1
+  echo tfsec not found. Attempting local install into .tools\bin...
+  "%APP_PYTHON%" "%~dp0install_external_clis.py" --repo-root "%REPO_ROOT%"
+  if exist "%~dp0..\.tools\bin\tfsec.exe" set "TFSEC_CMD=%~dp0..\.tools\bin\tfsec.exe"
+  where "%TFSEC_CMD%" >nul 2>&1
+  if errorlevel 1 if /I "%TFSEC_CMD%"=="tfsec" (
+    echo tfsec is not installed or not on PATH.
+    echo Install from: https://github.com/aquasecurity/tfsec
+    exit /b 1
+  )
 )
 
 "%TFSEC_CMD%" "%TARGET_PATH%" --format json --out "%OUT_JSON%"

sec_report_kit-0.2.4/scripts/run_trufflehog.bat

@@ -0,0 +1,53 @@
+@echo off
+setlocal
+
+set "REPO_ROOT=%~dp0.."
+set "APP_PYTHON=python"
+if exist "%REPO_ROOT%\.venv\Scripts\python.exe" set "APP_PYTHON=%REPO_ROOT%\.venv\Scripts\python.exe"
+
+set "REPORT_DIR=%~1"
+if "%REPORT_DIR%"=="" set "REPORT_DIR=security_reports"
+
+set "TARGET_PATH=%~2"
+if "%TARGET_PATH%"=="" set "TARGET_PATH=."
+
+set "OUT_JSON=%REPORT_DIR%\trufflehog.json"
+set "OUT_LOG=%REPORT_DIR%\trufflehog.log"
+set "TMP_JSON=%TEMP%\srk-trufflehog-%RANDOM%-%RANDOM%.json"
+set "TMP_LOG=%TEMP%\srk-trufflehog-%RANDOM%-%RANDOM%.log"
+set "TRUFFLEHOG_CMD=trufflehog"
+
+if exist "%~dp0..\.tools\bin\trufflehog.exe" set "TRUFFLEHOG_CMD=%~dp0..\.tools\bin\trufflehog.exe"
+
+if not exist "%REPORT_DIR%" mkdir "%REPORT_DIR%"
+
+where "%TRUFFLEHOG_CMD%" >nul 2>&1
+if errorlevel 1 if /I "%TRUFFLEHOG_CMD%"=="trufflehog" (
+  echo trufflehog not found. Attempting local install into .tools\bin...
+  "%APP_PYTHON%" "%~dp0install_external_clis.py" --repo-root "%REPO_ROOT%"
+  if exist "%~dp0..\.tools\bin\trufflehog.exe" set "TRUFFLEHOG_CMD=%~dp0..\.tools\bin\trufflehog.exe"
+  where "%TRUFFLEHOG_CMD%" >nul 2>&1
+  if errorlevel 1 if /I "%TRUFFLEHOG_CMD%"=="trufflehog" (
+    echo trufflehog is not installed or not on PATH.
+    echo Install from: https://github.com/trufflesecurity/trufflehog
+    exit /b 1
+  )
+)
+
+"%TRUFFLEHOG_CMD%" filesystem "%TARGET_PATH%" --json > "%TMP_JSON%" 2> "%TMP_LOG%"
+if errorlevel 1 (
+  if exist "%TMP_JSON%" move /Y "%TMP_JSON%" "%OUT_JSON%" >nul
+  if exist "%TMP_LOG%" move /Y "%TMP_LOG%" "%OUT_LOG%" >nul
+  echo TruffleHog scan failed. See log: %OUT_LOG%
+  if exist "%OUT_LOG%" type "%OUT_LOG%"
+  exit /b 1
+)
+
+if exist "%TMP_JSON%" move /Y "%TMP_JSON%" "%OUT_JSON%" >nul
+if exist "%TMP_LOG%" move /Y "%TMP_LOG%" "%OUT_LOG%" >nul
+
+if exist "%OUT_JSON%" (
+  for %%F in ("%OUT_JSON%") do if %%~zF==0 echo [] > "%OUT_JSON%"
+)
+
+echo TruffleHog JSON report written to %OUT_JSON%

sec_report_kit-0.2.3/CHANGELOG.md

@@ -1,28 +0,0 @@
-# Changelog
-
-All notable changes to this project are documented in this file.
-
-## 0.2.3 - 2026-05-13
-
-### Added
-- Safety CLI parser support and HTML rendering flow.
-- New CLI command: `srk render safety`.
-- MCP support for `source_type="safety"`.
-- Helper scripts for Safety scan and render:
-  - `scripts/run_safety.sh`
-  - `scripts/run_safety.bat`
-  - `scripts/render_safety_html.sh`
-  - `scripts/render_safety_html.bat`
-- Offline Safety DB download helpers:
-  - `scripts/download_safety_db.py`
-  - `scripts/download_safety_db.sh`
-  - `scripts/download_safety_db.bat`
-
-### Changed
-- Auto-detection now recognizes Safety JSON payloads.
-- Tool installation scripts now install Safety CLI in the app venv.
-- README updated with Safety usage and offline/local DB workflow guidance.
-
-### Fixed
-- Safety run scripts now avoid false success when network failures occur.
-- JSON output validation improved for Safety execution paths.

sec_report_kit-0.2.3/scripts/run_codeql.bat

@@ -1,30 +0,0 @@
-@echo off
-setlocal
-
-set "REPORT_DIR=%~1"
-if "%REPORT_DIR%"=="" set "REPORT_DIR=security_reports"
-
-set "DATABASE_PATH=%~2"
-if "%DATABASE_PATH%"=="" set "DATABASE_PATH=codeql-db"
-
-set "QUERY_SUITE=%~3"
-if "%QUERY_SUITE%"=="" set "QUERY_SUITE=codeql/python-queries"
-
-set "OUT_JSON=%REPORT_DIR%\codeql.sarif.json"
-set "CODEQL_CMD=codeql"
-
-if exist "%~dp0..\.tools\bin\codeql\codeql.exe" set "CODEQL_CMD=%~dp0..\.tools\bin\codeql\codeql.exe"
-
-if not exist "%REPORT_DIR%" mkdir "%REPORT_DIR%"
-
-where "%CODEQL_CMD%" >nul 2>&1
-if errorlevel 1 if /I "%CODEQL_CMD%"=="codeql" (
-  echo codeql is not installed or not on PATH.
-  echo Install from: https://codeql.github.com/docs/codeql-overview/codeql-changelog/
-  exit /b 1
-)
-
-"%CODEQL_CMD%" database analyze "%DATABASE_PATH%" "%QUERY_SUITE%" --format=sarifv2.1.0 --output="%OUT_JSON%"
-if errorlevel 1 exit /b 1
-
-echo CodeQL SARIF report written to %OUT_JSON%

sec_report_kit-0.2.3/scripts/run_osv_scanner.bat

@@ -1,27 +0,0 @@
-@echo off
-setlocal
-
-set "REPORT_DIR=%~1"
-if "%REPORT_DIR%"=="" set "REPORT_DIR=security_reports"
-
-set "TARGET_PATH=%~2"
-if "%TARGET_PATH%"=="" set "TARGET_PATH=."
-
-set "OUT_JSON=%REPORT_DIR%\osv-scanner.json"
-set "OSV_CMD=osv-scanner"
-
-if exist "%~dp0..\.tools\bin\osv-scanner.exe" set "OSV_CMD=%~dp0..\.tools\bin\osv-scanner.exe"
-
-if not exist "%REPORT_DIR%" mkdir "%REPORT_DIR%"
-
-where "%OSV_CMD%" >nul 2>&1
-if errorlevel 1 if /I "%OSV_CMD%"=="osv-scanner" (
-  echo osv-scanner is not installed or not on PATH.
-  echo Install from: https://github.com/google/osv-scanner
-  exit /b 1
-)
-
-"%OSV_CMD%" scan --recursive "%TARGET_PATH%" --format json --output "%OUT_JSON%"
-if errorlevel 1 exit /b 1
-
-echo OSV-Scanner JSON report written to %OUT_JSON%

sec_report_kit-0.2.3/scripts/run_trufflehog.bat

@@ -1,27 +0,0 @@
-@echo off
-setlocal
-
-set "REPORT_DIR=%~1"
-if "%REPORT_DIR%"=="" set "REPORT_DIR=security_reports"
-
-set "TARGET_PATH=%~2"
-if "%TARGET_PATH%"=="" set "TARGET_PATH=."
-
-set "OUT_JSON=%REPORT_DIR%\trufflehog.json"
-set "TRUFFLEHOG_CMD=trufflehog"
-
-if exist "%~dp0..\.tools\bin\trufflehog.exe" set "TRUFFLEHOG_CMD=%~dp0..\.tools\bin\trufflehog.exe"
-
-if not exist "%REPORT_DIR%" mkdir "%REPORT_DIR%"
-
-where "%TRUFFLEHOG_CMD%" >nul 2>&1
-if errorlevel 1 if /I "%TRUFFLEHOG_CMD%"=="trufflehog" (
-  echo trufflehog is not installed or not on PATH.
-  echo Install from: https://github.com/trufflesecurity/trufflehog
-  exit /b 1
-)
-
-"%TRUFFLEHOG_CMD%" filesystem "%TARGET_PATH%" --json > "%OUT_JSON%"
-if errorlevel 1 exit /b 1
-
-echo TruffleHog JSON report written to %OUT_JSON%