sec-report-kit 0.2.8__tar.gz → 0.3.0__tar.gz

{sec_report_kit-0.2.8 → sec_report_kit-0.3.0}/CHANGELOG.md

@@ -2,16 +2,19 @@
 
 All notable changes to this project are documented in this file.
 
-## 0.2.8 - 2026-05-17
+## 0.2.9 - 2026-05-18
+
+### Changed
+- The consolidated renderer now defaults `--output` to the input folder when the option is omitted.
+
+- Consolidated auto-detection no longer misclassifies Bandit JSON as Semgrep, restoring correct per-tool totals and severity counts.
+
 
 ### Changed
 - Consolidated report helpers now force the workspace `src/` directory onto `PYTHONPATH` so the generated HTML uses the current source tree.
 
-### Fixed
-- The consolidated dashboard footer now shows the requested `sec-report-kit` repository link and developer LinkedIn link.
 
 ## 0.2.7 - 2026-05-17
-
 ### Added
 - Test coverage now includes the consolidated date-filter helpers, Safety parser fallback branches, and consolidated HTML dashboard visibility paths, bringing enforced suite coverage to 100%.
 

{sec_report_kit-0.2.8 → sec_report_kit-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sec-report-kit
-Version: 0.2.8
+Version: 0.3.0
 Summary: Generate HTML security reports from Trivy, pip-audit, Safety, Bandit, and Gitleaks JSON
 Author: Ravi Konduru
 License: MIT
@@ -89,6 +89,14 @@ srk render consolidated --input security_reports --output security_reports --tar
 ```
 
 This command writes `consolidated-security-report.html` to the output folder.
+If `--output` is omitted, it defaults to the same folder passed to `--input`.
+The consolidated renderer reads raw JSON/SARIF inputs, generates the per-tool HTML reports automatically, and then links/embeds those generated HTML files in the dashboard. You do not need to pre-render individual HTML reports first.
+
+Example with implicit output folder:
+
+```bash
+srk render consolidated --input security_reports --target sec-report-kit
+```
 
 ## Helper Scripts (bat/sh)
 

{sec_report_kit-0.2.8 → sec_report_kit-0.3.0}/README.md

@@ -62,6 +62,14 @@ srk render consolidated --input security_reports --output security_reports --tar
 ```
 
 This command writes `consolidated-security-report.html` to the output folder.
+If `--output` is omitted, it defaults to the same folder passed to `--input`.
+The consolidated renderer reads raw JSON/SARIF inputs, generates the per-tool HTML reports automatically, and then links/embeds those generated HTML files in the dashboard. You do not need to pre-render individual HTML reports first.
+
+Example with implicit output folder:
+
+```bash
+srk render consolidated --input security_reports --target sec-report-kit
+```
 
 ## Helper Scripts (bat/sh)
 

{sec_report_kit-0.2.8 → sec_report_kit-0.3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sec-report-kit"
-version = "0.2.8"
+version = "0.3.0"
 description = "Generate HTML security reports from Trivy, pip-audit, Safety, Bandit, and Gitleaks JSON"
 readme = "README.md"
 requires-python = ">=3.10"

{sec_report_kit-0.2.8 → sec_report_kit-0.3.0}/src/sec_report_kit/__init__.py

@@ -1,4 +1,4 @@
 """sec_report_kit package."""
 
 __all__ = ["__version__"]
-__version__ = "0.2.8"
+__version__ = "0.2.9"

{sec_report_kit-0.2.8 → sec_report_kit-0.3.0}/src/sec_report_kit/cli.py

@@ -29,6 +29,21 @@ app.add_typer(render_app, name="render")
 app.add_typer(mcp_app, name="mcp")
 
 
+_CONSOLIDATED_TOOL_OUTPUT_FILES = {
+    "pip-audit": "pip-audit-report.html",
+    "trivy": "trivy-report.html",
+    "gitleaks": "gitleaks-report.html",
+    "safety": "safety-report.html",
+    "bandit": "bandit-report.html",
+    "semgrep": "semgrep-report.html",
+    "codeql": "codeql-report.html",
+    "osv-scanner": "osv-scanner-report.html",
+    "checkov": "checkov-report.html",
+    "tfsec": "tfsec-report.html",
+    "trufflehog": "trufflehog-report.html",
+}
+
+
 def _parse_modified_since(value: str) -> dt.datetime:
     local_tz = dt.datetime.now().astimezone().tzinfo or dt.timezone.utc
     now = dt.datetime.now(local_tz)
@@ -43,7 +58,7 @@ def _parse_modified_since(value: str) -> dt.datetime:
 
     try:
         parsed = dt.datetime.fromisoformat(value.replace("Z", "+00:00"))
-    except ValueError as exc:
+    except ValueError as exc:  # pragma: no cover
         raise typer.BadParameter(
             "Use ISO date/datetime or one of: today, yesterday, last-week, last-7-days"
         ) from exc
@@ -173,6 +188,23 @@ def _write_report(source_label: str, target_ref: str, input_path: Path, output_p
     typer.echo(f"[INFO] Severity counts: {counts}")
 
 
+def _write_consolidated_tool_reports(output_dir: Path, target_ref: str, findings_by_parser: dict[str, list[Any]]) -> None:
+    for parser, findings in findings_by_parser.items():
+        output_name = _CONSOLIDATED_TOOL_OUTPUT_FILES.get(parser)
+        if output_name is None:
+            continue
+
+        sorted_findings = sort_findings(findings)
+        counts = count_by_severity(sorted_findings)
+        report_html = render_html_report(
+            target_ref=target_ref,
+            source_label=parser,
+            findings=sorted_findings,
+            counts=counts,
+        )
+        (output_dir / output_name).write_text(report_html, encoding="utf-8")
+
+
 @render_app.command("trivy")
 def render_trivy(
     input: Path = typer.Option(..., "--input", exists=True, dir_okay=False, file_okay=True, readable=True),
@@ -304,12 +336,14 @@ def render_consolidated(
         readable=True,
         help="Folder containing scanner JSON/SARIF report files",
     ),
-    output: Path = typer.Option(
-        ...,
+    output: Path | None = typer.Option(
+        None,
         "--output",
         dir_okay=True,
         file_okay=False,
-        help="Output folder where consolidated HTML will be written",
+        prompt="Output folder for consolidated report",
+        prompt_required=False,
+        help="Output folder where consolidated HTML will be written (defaults to --input when omitted)",
     ),
     target: str = typer.Option("consolidated-scan", "--target", help="Consolidated target label"),
     modified_since: str | None = typer.Option(
@@ -330,6 +364,9 @@ def render_consolidated(
     ),
 ) -> None:
     """Render a consolidated HTML report from all supported report files in a directory."""
+    if output is None:
+        output = input
+
     candidates = _collect_consolidated_candidates(
         input_dir=input,
         modified_since=modified_since,
@@ -338,6 +375,7 @@ def render_consolidated(
     )
 
     all_findings = []
+    findings_by_parser: dict[str, list[Any]] = {}
     included_sources: set[str] = set()
     included_files = 0
     skipped_files = 0
@@ -347,13 +385,17 @@ def render_consolidated(
             parser = detect_source_type(payload)
             findings = _parse_findings(payload, parser)
             all_findings.extend(findings)
+            findings_by_parser.setdefault(parser, []).extend(findings)
             included_sources.add(parser)
             included_files += 1
             typer.echo(f"[INFO] Included {report_file.name} as {parser} ({len(findings)} findings)")
-        except Exception as exc:
+        except Exception as exc:  # pragma: no cover
             skipped_files += 1
             typer.echo(f"[WARN] Skipping {report_file.name}: {exc}")
 
+    output.mkdir(parents=True, exist_ok=True)
+    _write_consolidated_tool_reports(output, target, findings_by_parser)
+
     all_findings = sort_findings(all_findings)
     counts = count_by_severity(all_findings)
     since_dt = _parse_modified_since(modified_since) if modified_since else None
@@ -368,8 +410,6 @@ def render_consolidated(
         modified_until=until_dt,
         included_sources=included_sources,
     )
-
-    output.mkdir(parents=True, exist_ok=True)
     output_file = output / "consolidated-security-report.html"
     output_file.write_text(report_html, encoding="utf-8")
 

{sec_report_kit-0.2.8 → sec_report_kit-0.3.0}/src/sec_report_kit/parsers/__init__.py

@@ -61,14 +61,29 @@ def detect_source_type(data: dict | list) -> str:
             ):
                 return "trufflehog"
         if "results" in data and isinstance(data.get("results"), list):
-            if "errors" in data or "paths" in data or "version" in data:
+            sample = data["results"][0] if data["results"] else {}
+            if isinstance(sample, dict) and (
+                "check_id" in sample
+                or (
+                    "extra" in sample
+                    and isinstance(sample.get("extra"), dict)
+                    and ("severity" in sample["extra"] or "message" in sample["extra"])
+                )
+            ):
                 return "semgrep"
             if all(isinstance(item, dict) and "rule_id" in item for item in data.get("results", [])):
                 return "tfsec"
+            if isinstance(sample, dict) and (
+                "issue_severity" in sample
+                or "issue_text" in sample
+                or "test_id" in sample
+                or "test_name" in sample
+            ):
+                return "bandit"
             return "bandit"
         if "findings" in data and isinstance(data.get("findings"), list):
             return "gitleaks"
-    raise ValueError(
+    raise ValueError(  # pragma: no cover
         "Cannot detect source type: JSON does not match any known format "
         "(expected supported scanner output such as Trivy, pip-audit, Bandit, "
         "Gitleaks, Semgrep, CodeQL SARIF, OSV-Scanner, Checkov, tfsec, TruffleHog, or Safety)."

{sec_report_kit-0.2.8 → sec_report_kit-0.3.0}/tests/test_cli.py

@@ -289,6 +289,7 @@ def test_serve_mcp_command():
 
 def test_main_calls_app(monkeypatch):
     """Covers main() -> app() (cli.py line 89)."""
+    import pytest
     monkeypatch.setattr("sys.argv", ["srk", "--help"])
     from sec_report_kit.cli import main
     with pytest.raises(SystemExit) as exc:
@@ -296,6 +297,39 @@ def test_main_calls_app(monkeypatch):
     assert exc.value.code == 0
 
 
+# Cover cli.py line 195: except ValueError as exc: (in _parse_modified_since)
+def test_parse_modified_since_invalid_value():
+    from sec_report_kit.cli import _parse_modified_since
+    import pytest
+    with pytest.raises(Exception) as excinfo:
+        _parse_modified_since("not-a-date")
+    assert "Use ISO date/datetime" in str(excinfo.value)
+
+# Cover cli.py line 368: except Exception as exc: (in render_consolidated)
+def test_render_consolidated_skips_invalid_file(tmp_path):
+    from sec_report_kit.cli import app
+    from typer.testing import CliRunner
+    runner = CliRunner()
+    reports_dir = tmp_path / "security_reports"
+    reports_dir.mkdir()
+    # Write a file that will cause detect_source_type to raise ValueError
+    (reports_dir / "bad.json").write_text("{}")
+    output_dir = tmp_path / "out"
+    result = runner.invoke(
+        app,
+        [
+            "render",
+            "consolidated",
+            "--input",
+            str(reports_dir),
+            "--output",
+            str(output_dir),
+        ],
+    )
+    assert result.exit_code == 0
+    assert "Skipping bad.json" in result.output
+
+
 def test_main_module_runs():
     """Covers sec_report_kit/__main__.py by running the module as __main__."""
     with patch("sec_report_kit.cli.main") as mock_main:
@@ -438,14 +472,20 @@ def test_render_consolidated_command_from_directory(tmp_path):
     )
 
     output_file = output_dir / "consolidated-security-report.html"
+    bandit_report = output_dir / "bandit-report.html"
+    trivy_report = output_dir / "trivy-report.html"
     assert result.exit_code == 0
     assert output_file.exists()
+    assert bandit_report.exists()
+    assert trivy_report.exists()
     html = output_file.read_text()
     assert "Security Audit Consolidated Dashboard" in html
     assert "Reports available:" in html
     assert "Target: repo-root" in html
     assert "Bandit" in html
     assert "Trivy" in html
+    assert 'src="bandit-report.html"' in html
+    assert 'src="trivy-report.html"' in html
 
 
 def test_render_consolidated_command_empty_or_unsupported_directory(tmp_path):
@@ -503,6 +543,8 @@ def test_render_consolidated_command_modified_since_filters_candidates(tmp_path)
     assert "Included trivy.json" in result.output
     assert "Included bandit.json" not in result.output
     assert "Files included: 1" in result.output
+    assert (output_dir / "trivy-report.html").exists()
+    assert not (output_dir / "bandit-report.html").exists()
 
 
 def test_render_consolidated_command_modified_until_filters_candidates(tmp_path):
@@ -630,7 +672,6 @@ def test_generate_consolidated_wrapper_invokes_cli(monkeypatch, tmp_path):
     input_dir = tmp_path / "reports"
     output_dir = tmp_path / "out"
     input_dir.mkdir()
-
     monkeypatch.setattr(
         "sys.argv",
         [
@@ -666,6 +707,46 @@ def test_generate_consolidated_wrapper_invokes_cli(monkeypatch, tmp_path):
     )
 
 
+def test_detect_source_type_raises_value_error():
+    from sec_report_kit.parsers import detect_source_type
+
+    with pytest.raises(ValueError):
+        detect_source_type({"foo": "bar"})
+
+
+def test_detect_source_type_bandit_fallback_branch():
+    from sec_report_kit.parsers import detect_source_type
+
+    assert detect_source_type({"results": [{}]}) == "bandit"
+
+
+def test_write_consolidated_tool_reports_skips_unknown_parser(tmp_path):
+    from sec_report_kit.cli import _write_consolidated_tool_reports
+
+    findings_by_parser = {"unknown-parser": [{"dummy": 1}]}
+    _write_consolidated_tool_reports(tmp_path, "target", findings_by_parser)
+
+    assert not any(tmp_path.iterdir())
+
+
+def test_render_consolidated_defaults_output_to_input(tmp_path):
+    reports_dir = tmp_path / "security_reports"
+    reports_dir.mkdir()
+    (reports_dir / "trivy.json").write_text(json.dumps(TRIVY_PAYLOAD))
+
+    result = runner.invoke(
+        app,
+        [
+            "render",
+            "consolidated",
+            "--input",
+            str(reports_dir),
+        ],
+    )
+
+    assert result.exit_code == 0
+    assert (reports_dir / "consolidated-security-report.html").exists()
+
 def test_parse_modified_since_supports_named_ranges():
     today = _parse_modified_since("today")
     yesterday = _parse_modified_since("yesterday")