sec-report-kit 0.2.3__tar.gz → 0.2.5__tar.gz

{sec_report_kit-0.2.3 → sec_report_kit-0.2.5}/.gitignore

@@ -93,3 +93,4 @@ data/
 logs/
 security_reports/
 .tools/
+codeql-db/

sec_report_kit-0.2.5/CHANGELOG.md

@@ -0,0 +1,60 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+## 0.2.5 - 2026-05-17
+
+### Added
+- New CLI command: `srk render consolidated` to build a single HTML report from all supported scanner reports in an input folder.
+- New helper scripts for consolidated rendering:
+  - `scripts/render_consolidated_html.sh`
+  - `scripts/render_consolidated_html.bat`
+
+### Changed
+- `src/sec_report_kit/generate_consolidated_security_report.py` now acts as a wrapper that accepts `--input`, `--output`, and `--target`, and delegates to the consolidated CLI renderer.
+
+### Fixed
+- Unified package version metadata by aligning `src/sec_report_kit/__init__.py` with the project version.
+
+## 0.2.4 - 2026-05-14
+
+### Added
+- `scripts/install_external_clis.py` now supports `--tool` for targeted installs.
+- `scripts/install_external_clis.py` now supports `--force` to re-download tools even when already installed.
+- `README.md` now documents external CLI installer options and usage examples.
+
+### Changed
+- External CLI installer now skips already-installed tools by default.
+- CodeQL install handling on Windows now uses staged extraction and merge to avoid directory lock errors during reinstall.
+- `scripts/run_osv_scanner.bat` now auto-generates `requirements.txt` from installed packages when no supported lockfile is present.
+
+### Fixed
+- `scripts/run_codeql.bat` now repairs incomplete local CodeQL installs and validates SARIF output existence.
+- `scripts/run_codeql.sh` now validates SARIF output existence after analysis.
+- `scripts/run_trufflehog.bat` now writes scanner output via temp files to avoid self-scan file locking.
+- `scripts/run_trufflehog.bat` now writes `[]` when no findings are present.
+
+## 0.2.3 - 2026-05-13
+
+### Added
+- Safety CLI parser support and HTML rendering flow.
+- New CLI command: `srk render safety`.
+- MCP support for `source_type="safety"`.
+- Helper scripts for Safety scan and render:
+  - `scripts/run_safety.sh`
+  - `scripts/run_safety.bat`
+  - `scripts/render_safety_html.sh`
+  - `scripts/render_safety_html.bat`
+- Offline Safety DB download helpers:
+  - `scripts/download_safety_db.py`
+  - `scripts/download_safety_db.sh`
+  - `scripts/download_safety_db.bat`
+
+### Changed
+- Auto-detection now recognizes Safety JSON payloads.
+- Tool installation scripts now install Safety CLI in the app venv.
+- README updated with Safety usage and offline/local DB workflow guidance.
+
+### Fixed
+- Safety run scripts now avoid false success when network failures occur.
+- JSON output validation improved for Safety execution paths.

{sec_report_kit-0.2.3 → sec_report_kit-0.2.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sec-report-kit
-Version: 0.2.3
+Version: 0.2.5
 Summary: Generate HTML security reports from Trivy, pip-audit, Safety, Bandit, and Gitleaks JSON
 Author: Ravi Konduru
 License: MIT
@@ -82,6 +82,14 @@ Render Safety JSON:
 srk render safety --input security_reports/safety.json --output security_reports/report-safety.html --target requirements.txt
 ```
 
+Render a consolidated HTML report from all supported scanner files in a directory:
+
+```bash
+srk render consolidated --input security_reports --output security_reports --target sec-report-kit
+```
+
+This command writes `consolidated-security-report.html` to the output folder.
+
 ## Helper Scripts (bat/sh)
 
 Cross-platform helper scripts are available in `scripts/`.
@@ -100,6 +108,31 @@ scripts\install_tools.bat
 
 After cloning on a new machine, run the install script above to recreate the local `.tools/` directory and install required external CLI binaries (`codeql`, `tfsec`, `gitleaks`, `trufflehog`, `osv-scanner`) alongside Python dependencies. The `.tools/` folder is intentionally not committed to git.
 
+Install or update external CLI binaries directly:
+
+```bash
+python scripts/install_external_clis.py --repo-root .
+```
+
+Default behavior skips tools that are already installed locally.
+
+Force re-download/reinstall for all supported external tools:
+
+```bash
+python scripts/install_external_clis.py --repo-root . --force
+```
+
+Install only selected tool(s) with `--tool` (can be repeated or comma-separated):
+
+```bash
+python scripts/install_external_clis.py --repo-root . --tool osv-scanner
+python scripts/install_external_clis.py --repo-root . --tool tfsec --tool gitleaks --force
+python scripts/install_external_clis.py --repo-root . --tool tfsec,gitleaks
+```
+
+Supported `--tool` values: `codeql`, `tfsec`, `gitleaks`, `trufflehog`, `osv-scanner`.
+For convenience, `ocs-scanner` is accepted as an alias for `osv-scanner`.
+
 Run all unit tests locally with coverage:
 
 ```bash
@@ -207,6 +240,18 @@ scripts\render_trivy_html.bat
 scripts\render_trivy_html.bat security_reports my-image
 ```
 
+Convert all supported scanner reports in a folder to one consolidated HTML report:
+
+```bash
+# Linux/macOS (optional args: <report_dir> <target_name>)
+bash scripts/render_consolidated_html.sh
+bash scripts/render_consolidated_html.sh security_reports sec-report-kit
+
+# Windows (optional args: <report_dir> <target_name>)
+scripts\render_consolidated_html.bat
+scripts\render_consolidated_html.bat security_reports sec-report-kit
+```
+
 Convert sample Bandit JSON report to HTML:
 
 ```bash

{sec_report_kit-0.2.3 → sec_report_kit-0.2.5}/README.md

@@ -55,6 +55,14 @@ Render Safety JSON:
 srk render safety --input security_reports/safety.json --output security_reports/report-safety.html --target requirements.txt
 ```
 
+Render a consolidated HTML report from all supported scanner files in a directory:
+
+```bash
+srk render consolidated --input security_reports --output security_reports --target sec-report-kit
+```
+
+This command writes `consolidated-security-report.html` to the output folder.
+
 ## Helper Scripts (bat/sh)
 
 Cross-platform helper scripts are available in `scripts/`.
@@ -73,6 +81,31 @@ scripts\install_tools.bat
 
 After cloning on a new machine, run the install script above to recreate the local `.tools/` directory and install required external CLI binaries (`codeql`, `tfsec`, `gitleaks`, `trufflehog`, `osv-scanner`) alongside Python dependencies. The `.tools/` folder is intentionally not committed to git.
 
+Install or update external CLI binaries directly:
+
+```bash
+python scripts/install_external_clis.py --repo-root .
+```
+
+Default behavior skips tools that are already installed locally.
+
+Force re-download/reinstall for all supported external tools:
+
+```bash
+python scripts/install_external_clis.py --repo-root . --force
+```
+
+Install only selected tool(s) with `--tool` (can be repeated or comma-separated):
+
+```bash
+python scripts/install_external_clis.py --repo-root . --tool osv-scanner
+python scripts/install_external_clis.py --repo-root . --tool tfsec --tool gitleaks --force
+python scripts/install_external_clis.py --repo-root . --tool tfsec,gitleaks
+```
+
+Supported `--tool` values: `codeql`, `tfsec`, `gitleaks`, `trufflehog`, `osv-scanner`.
+For convenience, `ocs-scanner` is accepted as an alias for `osv-scanner`.
+
 Run all unit tests locally with coverage:
 
 ```bash
@@ -180,6 +213,18 @@ scripts\render_trivy_html.bat
 scripts\render_trivy_html.bat security_reports my-image
 ```
 
+Convert all supported scanner reports in a folder to one consolidated HTML report:
+
+```bash
+# Linux/macOS (optional args: <report_dir> <target_name>)
+bash scripts/render_consolidated_html.sh
+bash scripts/render_consolidated_html.sh security_reports sec-report-kit
+
+# Windows (optional args: <report_dir> <target_name>)
+scripts\render_consolidated_html.bat
+scripts\render_consolidated_html.bat security_reports sec-report-kit
+```
+
 Convert sample Bandit JSON report to HTML:
 
 ```bash

{sec_report_kit-0.2.3 → sec_report_kit-0.2.5}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sec-report-kit"
-version = "0.2.3"
+version = "0.2.5"
 description = "Generate HTML security reports from Trivy, pip-audit, Safety, Bandit, and Gitleaks JSON"
 readme = "README.md"
 requires-python = ">=3.10"

sec_report_kit-0.2.5/requirements.txt

@@ -0,0 +1,84 @@
+annotated-doc==0.0.4
+annotated-types==0.7.0
+anyio==4.13.0
+attrs==26.1.0
+bandit==1.9.4
+boolean.py==5.0
+build==1.5.0
+CacheControl==0.14.4
+certifi==2026.4.22
+cffi==2.0.0
+charset-normalizer==3.4.7
+click==8.3.3
+colorama==0.4.6
+coverage==7.14.0
+cryptography==47.0.0
+cyclonedx-python-lib==11.7.0
+defusedxml==0.7.1
+docutils==0.22.4
+filelock==3.29.0
+h11==0.16.0
+httpcore==1.0.9
+httpx==0.28.1
+httpx-sse==0.4.3
+id==1.6.1
+idna==3.13
+iniconfig==2.3.0
+jaraco.classes==3.4.0
+jaraco.context==6.1.2
+jaraco.functools==4.4.0
+jsonschema==4.26.0
+jsonschema-specifications==2025.9.1
+keyring==25.7.0
+license-expression==30.4.4
+markdown-it-py==4.0.0
+mcp==1.27.0
+mdurl==0.1.2
+more-itertools==11.0.2
+msgpack==1.1.2
+nh3==0.3.5
+packageurl-python==0.17.6
+packaging==26.2
+pip-api==0.0.34
+pip-requirements-parser==32.0.1
+pip_audit==2.10.0
+platformdirs==4.9.6
+pluggy==1.6.0
+py-serializable==2.1.0
+pycparser==3.0
+pydantic==2.13.3
+pydantic-settings==2.14.0
+pydantic_core==2.46.3
+pyfiglet==1.0.4
+Pygments==2.20.0
+PyJWT==2.12.1
+pyparsing==3.3.2
+pyproject_hooks==1.2.0
+pytest==9.0.3
+pytest-cov==7.1.0
+python-dotenv==1.2.2
+python-multipart==0.0.27
+pywin32==311
+pywin32-ctypes==0.2.3
+PyYAML==6.0.3
+readme_renderer==44.0
+referencing==0.37.0
+requests==2.33.1
+requests-toolbelt==1.0.0
+rfc3986==2.0.0
+rich==15.0.0
+rpds-py==0.30.0
+-e git+https://github.com/ShanKonduru/sec-report-kit.git@b6d196bac687e07189e884e2fe25af5c8842da1d#egg=sec_report_kit
+shellingham==1.5.4
+sortedcontainers==2.4.0
+sse-starlette==3.4.1
+starlette==1.0.0
+stevedore==5.7.0
+tomli==2.4.1
+tomli_w==1.2.0
+twine==6.2.0
+typer==0.25.1
+typing-inspection==0.4.2
+typing_extensions==4.15.0
+urllib3==2.6.3
+uvicorn==0.46.0

{sec_report_kit-0.2.3 → sec_report_kit-0.2.5}/scripts/install_external_clis.py

@@ -12,6 +12,7 @@ import re
 import shutil
 import stat
 import tarfile
+import tempfile
 import urllib.error
 import urllib.request
 import zipfile
@@ -127,20 +128,26 @@ def extract_binary_from_archive(data: bytes, archive_name: str, binary_names: li
 
 def install_codeql(asset_data: bytes, asset_name: str, tools_bin: Path) -> None:
     target_dir = tools_bin / "codeql"
-    if target_dir.exists():
-        shutil.rmtree(target_dir)
-
-    if asset_name.lower().endswith(".zip"):
-        with zipfile.ZipFile(io.BytesIO(asset_data)) as zf:
-            zf.extractall(tools_bin)
-    elif asset_name.lower().endswith(".tar.gz") or asset_name.lower().endswith(".tgz"):
-        with tarfile.open(fileobj=io.BytesIO(asset_data), mode="r:gz") as tf:
-            tf.extractall(tools_bin)
-    else:
-        raise RuntimeError(f"Unsupported codeql archive format: {asset_name}")
-
-    if not target_dir.exists():
-        raise RuntimeError("CodeQL extraction failed: missing .tools/bin/codeql directory")
+    with tempfile.TemporaryDirectory(prefix="codeql-stage-") as staging_dir:
+        staging_path = Path(staging_dir)
+
+        if asset_name.lower().endswith(".zip"):
+            with zipfile.ZipFile(io.BytesIO(asset_data)) as zf:
+                zf.extractall(staging_path)
+        elif asset_name.lower().endswith(".tar.gz") or asset_name.lower().endswith(".tgz"):
+            with tarfile.open(fileobj=io.BytesIO(asset_data), mode="r:gz") as tf:
+                tf.extractall(staging_path)
+        else:
+            raise RuntimeError(f"Unsupported codeql archive format: {asset_name}")
+
+        extracted_dir = staging_path / "codeql"
+        if not extracted_dir.exists():
+            raise RuntimeError("CodeQL extraction failed: missing codeql directory in archive")
+
+        if target_dir.exists():
+            shutil.copytree(extracted_dir, target_dir, dirs_exist_ok=True)
+        else:
+            shutil.move(str(extracted_dir), str(target_dir))
 
     codeql_bin = target_dir / ("codeql.exe" if os.name == "nt" else "codeql")
     if codeql_bin.exists():
@@ -171,14 +178,34 @@ def install_tool(tool_name: str, repo: str, patterns: list[str], tools_bin: Path
 
 def has_installed_tool(tool_name: str, tools_bin: Path, dest_name: str) -> bool:
     if tool_name == "codeql":
-        candidate = tools_bin / "codeql" / ("codeql.exe" if os.name == "nt" else "codeql")
-        return candidate.exists()
+        codeql_root = tools_bin / "codeql"
+        codeql_bin = codeql_root / ("codeql.exe" if os.name == "nt" else "codeql")
+        if not codeql_bin.exists():
+            return False
+        # A healthy CodeQL bundle includes an embedded Java runtime under tools/<platform>/java/bin.
+        java_glob = "java.exe" if os.name == "nt" else "java"
+        has_embedded_java = any(codeql_root.glob(f"tools/*/java/bin/{java_glob}"))
+        return has_embedded_java
     return (tools_bin / dest_name).exists()
 
 
 def main() -> int:
     parser = argparse.ArgumentParser(description="Install external scanner CLIs into .tools/bin")
     parser.add_argument("--repo-root", required=True, help="Repository root path")
+    parser.add_argument(
+        "--tool",
+        action="append",
+        default=[],
+        help=(
+            "Install only selected tool(s). Can be passed multiple times or as a comma-separated list "
+            "(e.g. --tool tfsec --tool gitleaks or --tool tfsec,gitleaks)"
+        ),
+    )
+    parser.add_argument(
+        "--force",
+        action="store_true",
+        help="Force re-download/reinstall even when a local install already exists",
+    )
     args = parser.parse_args()
 
     repo_root = Path(args.repo_root).resolve()
@@ -193,8 +220,8 @@ def main() -> int:
             "repo": "github/codeql-action",
             "patterns": {
                 "windows": [r"codeql-bundle-win64\.tar\.gz$", r"codeql-bundle-win64\.zip$"],
-                "linux": [r"codeql-bundle-linux64\\.tar\\.gz$"],
-                "darwin": [r"codeql-bundle-osx64\\.tar\\.gz$", r"codeql-bundle-osx64\\.zip$"],
+                "linux": [r"codeql-bundle-linux64\.tar\.gz$"],
+                "darwin": [r"codeql-bundle-osx64\.tar\.gz$", r"codeql-bundle-osx64\.zip$"],
             },
             "binary_names": [f"codeql{ext}"],
             "dest_name": f"codeql{ext}",
@@ -202,7 +229,7 @@ def main() -> int:
         "tfsec": {
             "repo": "aquasecurity/tfsec",
             "patterns": {
-                "windows": [r"tfsec-windows-amd64(?:\\.exe)?$"],
+                "windows": [r"tfsec-windows-amd64(?:\.exe)?$", r"tfsec_.*_windows_amd64\.tar\.gz$"],
                 "linux": [r"tfsec-linux-amd64$"],
                 "darwin": [r"tfsec-darwin-amd64$", r"tfsec-darwin-arm64$"],
             },
@@ -212,9 +239,9 @@ def main() -> int:
         "gitleaks": {
             "repo": "gitleaks/gitleaks",
             "patterns": {
-                "windows": [r"gitleaks_.*_windows_x64\\.zip$"],
-                "linux": [r"gitleaks_.*_linux_x64\\.tar\\.gz$"],
-                "darwin": [r"gitleaks_.*_darwin_arm64\\.tar\\.gz$", r"gitleaks_.*_darwin_x64\\.tar\\.gz$"],
+                "windows": [r"gitleaks_.*_windows_x64\.zip$"],
+                "linux": [r"gitleaks_.*_linux_x64\.tar\.gz$"],
+                "darwin": [r"gitleaks_.*_darwin_arm64\.tar\.gz$", r"gitleaks_.*_darwin_x64\.tar\.gz$"],
             },
             "binary_names": [f"gitleaks{ext}"],
             "dest_name": f"gitleaks{ext}",
@@ -222,9 +249,9 @@ def main() -> int:
         "trufflehog": {
             "repo": "trufflesecurity/trufflehog",
             "patterns": {
-                "windows": [r"trufflehog_.*_windows_amd64\\.tar\\.gz$", r"trufflehog_.*_windows_amd64\\.zip$"],
-                "linux": [r"trufflehog_.*_linux_amd64\\.tar\\.gz$"],
-                "darwin": [r"trufflehog_.*_darwin_arm64\\.tar\\.gz$", r"trufflehog_.*_darwin_amd64\\.tar\\.gz$"],
+                "windows": [r"trufflehog_.*_windows_amd64\.tar\.gz$", r"trufflehog_.*_windows_amd64\.zip$"],
+                "linux": [r"trufflehog_.*_linux_amd64\.tar\.gz$"],
+                "darwin": [r"trufflehog_.*_darwin_arm64\.tar\.gz$", r"trufflehog_.*_darwin_amd64\.tar\.gz$"],
             },
             "binary_names": [f"trufflehog{ext}"],
             "dest_name": f"trufflehog{ext}",
@@ -232,19 +259,48 @@ def main() -> int:
         "osv-scanner": {
             "repo": "google/osv-scanner",
             "patterns": {
-                "windows": [r"osv-scanner_windows_amd64(?:\\.exe)?(?:\\.zip)?$", r"osv-scanner_.*_windows_amd64(?:\\.exe)?(?:\\.zip)?$", r"osv-scanner-windows-amd64(?:\\.exe)?$"],
-                "linux": [r"osv-scanner_.*_linux_amd64(?:\\.tar\\.gz)?$", r"osv-scanner-linux-amd64$"],
-                "darwin": [r"osv-scanner_.*_darwin_amd64(?:\\.tar\\.gz)?$", r"osv-scanner_.*_darwin_arm64(?:\\.tar\\.gz)?$"],
+                "windows": [r"osv-scanner_windows_amd64(?:\.exe)?(?:\.zip)?$", r"osv-scanner_.*_windows_amd64(?:\.exe)?(?:\.zip)?$", r"osv-scanner-windows-amd64(?:\.exe)?$"],
+                "linux": [r"osv-scanner_.*_linux_amd64(?:\.tar\.gz)?$", r"osv-scanner-linux-amd64$"],
+                "darwin": [r"osv-scanner_.*_darwin_amd64(?:\.tar\.gz)?$", r"osv-scanner_.*_darwin_arm64(?:\.tar\.gz)?$"],
             },
             "binary_names": [f"osv-scanner{ext}"],
             "dest_name": f"osv-scanner{ext}",
         },
     }
 
+    tool_aliases = {
+        "ocs-scanner": "osv-scanner",
+    }
+
+    selected_tools: set[str] = set()
+    if args.tool:
+        for raw_value in args.tool:
+            for item in raw_value.split(","):
+                normalized = item.strip().lower()
+                if not normalized:
+                    continue
+                normalized = tool_aliases.get(normalized, normalized)
+                if normalized not in tool_matrix:
+                    available = ", ".join(sorted(tool_matrix.keys()))
+                    print(f"Unknown tool: {item}")
+                    print(f"Available tools: {available}")
+                    return 1
+                selected_tools.add(normalized)
+
+    tools_to_process = [
+        (tool_name, cfg)
+        for tool_name, cfg in tool_matrix.items()
+        if not selected_tools or tool_name in selected_tools
+    ]
+
     failures: list[str] = []
     rate_limited = False
 
-    for tool_name, cfg in tool_matrix.items():
+    for tool_name, cfg in tools_to_process:
+        if not args.force and has_installed_tool(tool_name, tools_bin, cfg["dest_name"]):
+            print(f"Skipping {tool_name}: already installed (use --force to reinstall)")
+            continue
+
         patterns = cfg["patterns"][platform_name]
         try:
             install_tool(

sec_report_kit-0.2.5/scripts/render_consolidated_html.bat

@@ -0,0 +1,25 @@
+@echo off
+setlocal
+
+set "PYTHON_BIN=python"
+if exist "%~dp0..\.venv\Scripts\python.exe" set "PYTHON_BIN=%~dp0..\.venv\Scripts\python.exe"
+
+set "REPORT_DIR=%~1"
+if "%REPORT_DIR%"=="" set "REPORT_DIR=security_reports"
+
+set "TARGET_NAME=%~2"
+if "%TARGET_NAME%"=="" for %%I in ("%~dp0..") do set "TARGET_NAME=%%~nxI"
+
+if not exist "%REPORT_DIR%" (
+  echo Missing input directory: %REPORT_DIR%
+  exit /b 1
+)
+
+set "OUT_HTML=%REPORT_DIR%\consolidated-security-report.html"
+
+"%PYTHON_BIN%" -m sec_report_kit render consolidated --input "%REPORT_DIR%" --output "%REPORT_DIR%" --target "%TARGET_NAME%"
+if errorlevel 1 exit /b 1
+
+echo HTML report written to %OUT_HTML%
+for %%I in ("%OUT_HTML%") do set "OUT_HTML_ABS=%%~fI"
+start "" "%OUT_HTML_ABS%"

sec_report_kit-0.2.5/scripts/render_consolidated_html.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+PYTHON_BIN="${PYTHON_BIN:-python}"
+if [[ -x "$(dirname "$0")/../.venv/bin/python" ]]; then
+  PYTHON_BIN="$(dirname "$0")/../.venv/bin/python"
+fi
+
+REPORT_DIR="${1:-security_reports}"
+ROOT_NAME="$(basename "$(cd "$(dirname "$0")/.." && pwd)")"
+TARGET_NAME="${2:-${ROOT_NAME}}"
+OUT_HTML="${REPORT_DIR}/consolidated-security-report.html"
+
+open_html() {
+  if command -v xdg-open >/dev/null 2>&1; then
+    xdg-open "$1" >/dev/null 2>&1 &
+    return 0
+  fi
+  if command -v open >/dev/null 2>&1; then
+    open "$1" >/dev/null 2>&1 &
+    return 0
+  fi
+  echo "HTML generated but no supported browser opener was found. Open manually: $1"
+}
+
+if [[ ! -d "${REPORT_DIR}" ]]; then
+  echo "Missing input directory: ${REPORT_DIR}"
+  exit 1
+fi
+
+"${PYTHON_BIN}" -m sec_report_kit render consolidated --input "${REPORT_DIR}" --output "${REPORT_DIR}" --target "${TARGET_NAME}"
+
+echo "HTML report written to ${OUT_HTML}"
+open_html "${OUT_HTML}"

sec_report_kit-0.2.5/scripts/run_codeql.bat

@@ -0,0 +1,81 @@
+@echo off
+setlocal
+
+set "REPO_ROOT=%~dp0.."
+set "APP_PYTHON=python"
+if exist "%REPO_ROOT%\.venv\Scripts\python.exe" set "APP_PYTHON=%REPO_ROOT%\.venv\Scripts\python.exe"
+
+set "REPORT_DIR=%~1"
+if "%REPORT_DIR%"=="" set "REPORT_DIR=security_reports"
+
+set "DATABASE_PATH=%~2"
+if "%DATABASE_PATH%"=="" set "DATABASE_PATH=codeql-db"
+
+set "QUERY_SUITE=%~3"
+if "%QUERY_SUITE%"=="" set "QUERY_SUITE=codeql/python-queries"
+
+set "OUT_JSON=%REPORT_DIR%\codeql.sarif.json"
+set "CODEQL_CMD=codeql"
+set "LOCAL_CODEQL_EXE=%~dp0..\.tools\bin\codeql\codeql.exe"
+set "LOCAL_CODEQL_JAVA=%~dp0..\.tools\bin\codeql\tools\win64\java\bin\java.exe"
+
+if exist "%LOCAL_CODEQL_EXE%" set "CODEQL_CMD=%LOCAL_CODEQL_EXE%"
+set "CODEQL_CMD=%CODEQL_CMD:\"=%"
+set "CODEQL_CMD=%CODEQL_CMD:'=%"
+
+if not exist "%REPORT_DIR%" mkdir "%REPORT_DIR%"
+
+where "%CODEQL_CMD%" >nul 2>&1
+if errorlevel 1 if /I "%CODEQL_CMD%"=="codeql" (
+  echo codeql not found. Attempting local install into .tools\bin...
+  "%APP_PYTHON%" "%~dp0install_external_clis.py" --repo-root "%REPO_ROOT%" --tool codeql --force
+  if errorlevel 1 (
+    echo Failed to install CodeQL CLI.
+    exit /b 1
+  )
+  if exist "%LOCAL_CODEQL_EXE%" set "CODEQL_CMD=%LOCAL_CODEQL_EXE%"
+  set "CODEQL_CMD=%CODEQL_CMD:\"=%"
+  set "CODEQL_CMD=%CODEQL_CMD:'=%"
+  where "%CODEQL_CMD%" >nul 2>&1
+  if errorlevel 1 if /I "%CODEQL_CMD%"=="codeql" (
+    echo codeql is not installed or not on PATH.
+    echo Install from: https://codeql.github.com/docs/codeql-overview/codeql-changelog/
+    exit /b 1
+  )
+)
+
+if exist "%LOCAL_CODEQL_EXE%" if not exist "%LOCAL_CODEQL_JAVA%" (
+  echo Local CodeQL install appears incomplete ^(missing embedded Java^). Reinstalling CodeQL...
+  "%APP_PYTHON%" "%~dp0install_external_clis.py" --repo-root "%REPO_ROOT%" --tool codeql --force
+  if errorlevel 1 (
+    echo Failed to reinstall CodeQL CLI.
+    exit /b 1
+  )
+  if not exist "%LOCAL_CODEQL_JAVA%" (
+    echo CodeQL reinstall completed, but embedded Java is still missing:
+    echo   %LOCAL_CODEQL_JAVA%
+    exit /b 1
+  )
+)
+
+if not exist "%DATABASE_PATH%" (
+  echo CodeQL database not found at %DATABASE_PATH%. Creating database...
+  "%CODEQL_CMD%" database create "%DATABASE_PATH%" --language=python --source-root="%REPO_ROOT%"
+  if errorlevel 1 (
+    echo Failed to create CodeQL database at %DATABASE_PATH%
+    exit /b 1
+  )
+)
+
+"%CODEQL_CMD%" database finalize "%DATABASE_PATH%" >nul 2>&1
+
+"%CODEQL_CMD%" database analyze "%DATABASE_PATH%" "%QUERY_SUITE%" --format=sarifv2.1.0 --output="%OUT_JSON%"
+if errorlevel 1 exit /b 1
+
+if not exist "%OUT_JSON%" (
+  echo CodeQL analyze completed but did not produce output file:
+  echo   %OUT_JSON%
+  exit /b 1
+)
+
+echo CodeQL SARIF report written to %OUT_JSON%

{sec_report_kit-0.2.3 → sec_report_kit-0.2.5}/scripts/run_codeql.sh

@@ -19,6 +19,13 @@ if ! command -v "${CODEQL_CMD}" >/dev/null 2>&1; then
   exit 1
 fi
 
+"${CODEQL_CMD}" database finalize "${DATABASE_PATH}" >/dev/null 2>&1 || true
+
 "${CODEQL_CMD}" database analyze "${DATABASE_PATH}" "${QUERY_SUITE}" --format=sarifv2.1.0 --output="${OUT_JSON}"
 
+if [[ ! -f "${OUT_JSON}" ]]; then
+  echo "CodeQL analyze completed but did not produce output file: ${OUT_JSON}" >&2
+  exit 1
+fi
+
 echo "CodeQL SARIF report written to ${OUT_JSON}"