thothctl 0.18.6__tar.gz → 0.18.7__tar.gz

thothctl-0.18.7/.devcontainer/Dockerfile

@@ -0,0 +1,8 @@
+FROM mcr.microsoft.com/devcontainers/python:3.12
+
+RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \
+    && apt-get -y install --no-install-recommends \
+    graphviz \
+    libgraph-easy-perl \
+    wkhtmltopdf \
+    && apt-get clean -y && rm -rf /var/lib/apt/lists/*

thothctl-0.18.7/.devcontainer/README.md

@@ -0,0 +1,73 @@
+# ThothForge Development Container
+
+A modern devcontainer setup for ThothCTL development using the [Dev Container Features](https://containers.dev/features) specification.
+
+## What's Included
+
+### Tools (via Features — auto-updated)
+
+| Tool | Purpose |
+|------|---------|
+| OpenTofu | IaC provisioning |
+| Terragrunt | IaC orchestration |
+| terraform-docs | Module documentation generation |
+| Trivy | Vulnerability & misconfiguration scanning |
+| TFSec | Terraform security scanner |
+| TFLint | Terraform linter |
+| ShellCheck | Shell script linter |
+| AWS CLI | Cloud operations |
+| GitHub CLI | PR workflows, code review |
+| Docker-in-Docker | Required for KICS scanner |
+
+### System Packages (via Dockerfile)
+
+- **graphviz** — Diagram generation (`thothctl document`)
+- **libgraph-easy-perl** — ASCII topology views (`--format boxart`)
+- **wkhtmltopdf** — PDF report generation
+
+### Python (via lifecycle hooks)
+
+- ThothCTL installed in **editable mode** (`pip install -e '.[telemetry]'`)
+- pre-commit hooks configured automatically
+- Checkov for IaC security scanning
+
+## Getting Started
+
+1. Install [VS Code](https://code.visualstudio.com/) + [Dev Containers extension](https://marketplace.visualstudio.com/items?itemName=ms-vscode-remote.remote-containers)
+2. Install [Docker](https://www.docker.com/products/docker-desktop/)
+3. Clone the repository
+4. Open in VS Code → "Reopen in Container"
+
+Once built, the container is ready with all tools. ThothCTL runs from source:
+
+```bash
+thothctl --version
+thothctl check iac -type security --recursive
+thothctl dashboard start --port 8080
+thothctl mcp start
+```
+
+## Ports
+
+| Port | Service |
+|------|---------|
+| 8080 | ThothCTL Dashboard |
+| 5001 | MCP Server |
+
+## Environment Variables
+
+Pass these from your host to configure behavior:
+
+| Variable | Purpose |
+|----------|---------|
+| `THOTHCTL_DEBUG` | Enable debug logging |
+| `THOTH_LOG_LEVEL` | Set log level |
+
+AWS credentials are mounted from `~/.aws` automatically.
+
+## Customizing
+
+- **Add tools**: Add features to `devcontainer.json` from [containers.dev/features](https://containers.dev/features)
+- **Add system packages**: Edit the `Dockerfile`
+- **Add Python deps**: Modify `postCreateCommand` in `devcontainer.json`
+- **Rebuild**: Command Palette → "Dev Containers: Rebuild Container"

thothctl-0.18.7/.devcontainer/devcontainer.json

@@ -0,0 +1,64 @@
+{
+  "name": "ThothForge Infrastructure Development",
+  "build": {
+    "dockerfile": "Dockerfile"
+  },
+  "features": {
+    "ghcr.io/devcontainers/features/aws-cli:1": {},
+    "ghcr.io/devcontainers/features/github-cli:1": {},
+    "ghcr.io/devcontainers/features/docker-in-docker:4": {},
+    "ghcr.io/devcontainers-extra/features/opentofu:1": {},
+    "ghcr.io/devcontainers-extra/features/terragrunt:1": {},
+    "ghcr.io/devcontainers-extra/features/terraform-docs:1": {},
+    "ghcr.io/dhoeric/features/trivy:1": {},
+    "ghcr.io/dhoeric/features/tfsec:1": {},
+    "ghcr.io/devcontainers-extra/features/shellcheck:1": {},
+    "ghcr.io/devcontainers-extra/features/tflint:1": {}
+  },
+  "forwardPorts": [8080, 5001],
+  "portsAttributes": {
+    "8080": { "label": "ThothCTL Dashboard", "onAutoForward": "notify" },
+    "5001": { "label": "MCP Server", "onAutoForward": "silent" }
+  },
+  "containerEnv": {
+    "THOTHCTL_DEBUG": "${localEnv:THOTHCTL_DEBUG}",
+    "THOTH_LOG_LEVEL": "${localEnv:THOTH_LOG_LEVEL}",
+    "THOTH_MEMORY_MODE": "local"
+  },
+  "remoteEnv": {
+    "PATH": "${containerEnv:PATH}:/home/vscode/.local/bin"
+  },
+  "mounts": [
+    "source=${localEnv:HOME}/.aws,target=/home/vscode/.aws,type=bind,consistency=cached"
+  ],
+  "remoteUser": "vscode",
+  "postCreateCommand": {
+    "install-dev": "pip install -e '.[telemetry]'",
+    "pre-commit": "pip install pre-commit && pre-commit install",
+    "checkov": "pip install checkov"
+  },
+  "postStartCommand": "thothctl --version",
+  "customizations": {
+    "vscode": {
+      "extensions": [
+        "hashicorp.terraform",
+        "ms-python.python",
+        "ms-python.vscode-pylance",
+        "ms-azuretools.vscode-docker",
+        "redhat.vscode-yaml",
+        "timonwong.shellcheck",
+        "charliermarsh.ruff",
+        "eamodio.gitlens",
+        "github.copilot"
+      ],
+      "settings": {
+        "terminal.integrated.defaultProfile.linux": "bash",
+        "python.defaultInterpreterPath": "/usr/local/bin/python",
+        "[python]": {
+          "editor.defaultFormatter": "charliermarsh.ruff",
+          "editor.formatOnSave": true
+        }
+      }
+    }
+  }
+}

{thothctl-0.18.6 → thothctl-0.18.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: thothctl
-Version: 0.18.6
+Version: 0.18.7
 Summary: A CLI for Developer Control Plane. Accelerate your cloud IaC deployments.
 Project-URL: SourceCode, https://github.com/thothforge/thothctl
 Project-URL: HomePage, https://github.com/thothforge/thothctl

{thothctl-0.18.6 → thothctl-0.18.7}/docs/framework/use_cases/devsecops_sdlc.md

@@ -7,7 +7,7 @@ This guide demonstrates how ThothCTL enables a complete DevSecOps Software Devel
 ## The DevSecOps SDLC Phases
 
 ```mermaid
-%%{init: {'theme':'base', 'themeVariables': { 'primaryColor':'#3f51b5','primaryTextColor':'#fff','primaryBorderColor':'#303f9f','lineColor':'#536dfe','secondaryColor':'#536dfe','tertiaryColor':'#fff','background':'#ffffff','mainBkg':'#e3f2fd','secondBkg':'#bbdefb','tertiaryBkg':'#90caf9','textColor':'#000000','fontSize':'14px'}}}%%
+%%{init: {'theme':'base', 'themeVariables': { 'primaryColor':'#3f51b5','primaryTextColor':'#ffffff','primaryBorderColor':'#303f9f','lineColor':'#536dfe','secondaryColor':'#536dfe','tertiaryColor':'#fff','background':'transparent','mainBkg':'#3f51b5','secondBkg':'#536dfe','tertiaryBkg':'#90caf9','textColor':'#ffffff','nodeTextColor':'#ffffff','fontSize':'14px'}}}%%
 graph TB
     A["Plan<br/>📋 Cost Estimation<br/>Risk Assessment<br/>Template Selection"] --> B["Develop<br/>💻 Environment Check<br/>Structure Validation<br/>Best Practices"]
     B --> C["Build<br/>🔨 Inventory Creation<br/>Dependency Tracking<br/>Version Management"]
@@ -18,14 +18,14 @@ graph TB
     G --> H["Monitor<br/>📊 Dashboard<br/>Continuous Scan<br/>Drift Detection"]
     H --> A
     
-    classDef planStyle fill:#01579b,stroke:#0288d1,stroke-width:2px,color:#fff
-    classDef devStyle fill:#1b5e20,stroke:#2e7d32,stroke-width:2px,color:#fff
-    classDef buildStyle fill:#e65100,stroke:#ef6c00,stroke-width:2px,color:#fff
-    classDef testStyle fill:#4a148c,stroke:#6a1b9a,stroke-width:2px,color:#fff
-    classDef secureStyle fill:#b71c1c,stroke:#c62828,stroke-width:2px,color:#fff
-    classDef deployStyle fill:#004d40,stroke:#00695c,stroke-width:2px,color:#fff
-    classDef operateStyle fill:#880e4f,stroke:#ad1457,stroke-width:2px,color:#fff
-    classDef monitorStyle fill:#33691e,stroke:#558b2f,stroke-width:2px,color:#fff
+    classDef planStyle fill:#01579b,stroke:#0288d1,stroke-width:2px,color:#ffffff
+    classDef devStyle fill:#1b5e20,stroke:#2e7d32,stroke-width:2px,color:#ffffff
+    classDef buildStyle fill:#e65100,stroke:#ef6c00,stroke-width:2px,color:#ffffff
+    classDef testStyle fill:#4a148c,stroke:#6a1b9a,stroke-width:2px,color:#ffffff
+    classDef secureStyle fill:#b71c1c,stroke:#c62828,stroke-width:2px,color:#ffffff
+    classDef deployStyle fill:#004d40,stroke:#00695c,stroke-width:2px,color:#ffffff
+    classDef operateStyle fill:#880e4f,stroke:#ad1457,stroke-width:2px,color:#ffffff
+    classDef monitorStyle fill:#33691e,stroke:#558b2f,stroke-width:2px,color:#ffffff
     
     class A planStyle
     class B devStyle

thothctl-0.18.7/docs/installation/devcontainer_setup.md

@@ -0,0 +1,93 @@
+# Development Container Setup
+
+ThothCTL provides a ready-to-use [Dev Container](https://containers.dev/) for a fully configured local development environment. It works on **any OS** (Linux, macOS, Windows) and ensures all contributors have identical tooling.
+
+## Prerequisites
+
+- [Docker](https://docs.docker.com/get-docker/)
+- [VS Code](https://code.visualstudio.com/) + [Dev Containers extension](https://marketplace.visualstudio.com/items?itemName=ms-vscode-remote.remote-containers)
+
+> Also works with GitHub Codespaces, JetBrains Gateway, and the [devcontainer CLI](https://github.com/devcontainers/cli).
+
+## Quick Start
+
+```bash
+git clone https://github.com/thothforge/thothctl.git
+cd thothctl
+code .
+# VS Code will prompt: "Reopen in Container" → click it
+```
+
+After the container builds (~2 min first time), ThothCTL is installed in editable mode and all tools are ready:
+
+```bash
+thothctl --version
+tofu --version
+terragrunt --version
+trivy --version
+checkov --version
+```
+
+## Included Tools
+
+| Category | Tools |
+|----------|-------|
+| **IaC** | OpenTofu, Terragrunt, terraform-docs, TFLint |
+| **Security** | Trivy, TFSec, Checkov, ShellCheck |
+| **Cloud** | AWS CLI, Docker-in-Docker (for KICS) |
+| **Dev Workflow** | GitHub CLI, pre-commit, Ruff |
+| **Diagrams** | Graphviz, graph-easy |
+
+## Exposed Ports
+
+| Port | Service | Command |
+|------|---------|---------|
+| 8080 | Dashboard | `thothctl dashboard start --port 8080` |
+| 5001 | MCP Server | `thothctl mcp start` |
+
+## Environment Variables
+
+Set these on your host to pass them into the container:
+
+| Variable | Purpose | Default |
+|----------|---------|---------|
+| `THOTHCTL_DEBUG` | Enable debug logging | — |
+| `THOTH_LOG_LEVEL` | Log level (DEBUG, INFO, etc.) | — |
+| `AWS_PROFILE` | AWS profile to use | default |
+
+AWS credentials are mounted from `~/.aws` automatically.
+
+## Development Workflow
+
+The container installs ThothCTL in editable mode, so code changes are reflected immediately:
+
+```bash
+# Run tests
+python -m pytest tests/ -v --cov=src/
+
+# Lint & format
+ruff check src/ --fix
+ruff format src/
+
+# Run pre-commit hooks
+pre-commit run --all-files
+```
+
+## Customizing
+
+- **Add a tool**: Add a [Feature](https://containers.dev/features) to `.devcontainer/devcontainer.json`
+- **Add a system package**: Edit `.devcontainer/Dockerfile`
+- **Rebuild**: Command Palette → "Dev Containers: Rebuild Container"
+
+## Using Without VS Code
+
+```bash
+# Install the devcontainer CLI
+npm install -g @devcontainers/cli
+
+# Build and start
+devcontainer up --workspace-folder .
+
+# Execute commands inside
+devcontainer exec --workspace-folder . thothctl --version
+```

{thothctl-0.18.6 → thothctl-0.18.7}/docs/navigation.md

@@ -3,6 +3,7 @@
 ## Getting Started
 
 - [Quick Start](quick_start.md) - Universal installation and setup
+- [Dev Container Setup](installation/devcontainer_setup.md) - One-click development environment (any OS)
 - [Windows Installation](installation/windows_installation.md) - Windows-specific setup guide
 - [Windows Troubleshooting](troubleshooting/windows_troubleshooting.md) - Windows-specific issues
 

{thothctl-0.18.6 → thothctl-0.18.7}/mkdocs.yaml

@@ -23,6 +23,7 @@ nav:
     - Installation:
       - Linux & macOS: installation/linux_installation.md
       - Windows: installation/windows_installation.md
+      - Dev Container: installation/devcontainer_setup.md
   - Commands:
     - Init: framework/commands/init/init.md
     - Check:

{thothctl-0.18.6 → thothctl-0.18.7}/src/thothctl/commands/inventory/commands/iac.py

@@ -504,7 +504,7 @@ cli = IaCInvCommand.as_click_command(
         "--inventory-path",
         help="Path for saving inventory reports",
         type=click.Path(),
-        default="./Reports/inventory-sbom",
+        default="./Reports",
     ),
     click.option(
         "-cv",

{thothctl-0.18.6 → thothctl-0.18.7}/src/thothctl/services/inventory/inventory_service.py

@@ -606,16 +606,18 @@ class InventoryService:
             inventory_dict["technical_debt"] = tech_debt_metrics
             logger.info(f"Technical debt score: {tech_debt_metrics.get('debt_score', 0):.1f}%")
         # Generate reports
-        reports_path = Path(reports_directory)
+        reports_path = Path(reports_directory) / "inventory"
         if not reports_path.is_absolute():
             reports_path = source_path / reports_path
             
         reports_path.mkdir(exist_ok=True, parents=True)
         
         if report_type in ("html", "all"):
+            html_reports_path = reports_path / "html_reports"
+            html_reports_path.mkdir(exist_ok=True, parents=True)
             html_path = self.report_service.create_html_report(
                 inventory_dict, 
-                reports_directory=str(reports_path)
+                reports_directory=str(html_reports_path)
             )
 
         if report_type in ("json", "all"):
@@ -1066,11 +1068,13 @@ class InventoryService:
                 }
 
         # Generate reports
-        reports_path = Path(reports_directory) / "inventory-sbom"
+        reports_path = Path(reports_directory) / "inventory"
         reports_path.mkdir(parents=True, exist_ok=True)
 
         if report_type in ("html", "all"):
-            self.report_service.create_html_report(inventory_dict, reports_directory=str(reports_path))
+            html_reports_path = reports_path / "html_reports"
+            html_reports_path.mkdir(parents=True, exist_ok=True)
+            self.report_service.create_html_report(inventory_dict, reports_directory=str(html_reports_path))
         if report_type in ("json", "all"):
             self.report_service.create_json_report(inventory_dict, reports_directory=str(reports_path))
         if print_console:
@@ -1404,13 +1408,15 @@ class InventoryService:
         # Generate reports
         if reports_directory:
             try:
-                reports_path = Path(reports_directory)
+                reports_path = Path(reports_directory) / "inventory"
                 reports_path.mkdir(exist_ok=True, parents=True)
                 
                 if report_type in ("html", "all"):
+                    html_reports_path = reports_path / "html_reports"
+                    html_reports_path.mkdir(exist_ok=True, parents=True)
                     html_path = self.report_service.create_html_report(
                         inventory_dict, 
-                        reports_directory=str(reports_path)
+                        reports_directory=str(html_reports_path)
                     )
 
                 if report_type in ("json", "all"):

{thothctl-0.18.6 → thothctl-0.18.7}/src/thothctl/services/inventory/report_service.py

@@ -25,7 +25,8 @@ class ReportService:
     def __init__(self, reports_directory: str = "Reports"):
         """Initialize report service."""
         self.reports_dir = Path(reports_directory)
-        self.reports_dir.mkdir(exist_ok=True, parents=True)
+        self.inventory_dir = self.reports_dir / "inventory"
+        self.inventory_dir.mkdir(exist_ok=True, parents=True)
         self.console = Console()
         self.template_loader = get_template_loader()
 
@@ -37,7 +38,12 @@ class ReportService:
             reports_dir = Path(reports_directory)
             reports_dir.mkdir(exist_ok=True, parents=True)
         else:
-            reports_dir = self.reports_dir
+            # Use inventory subdirectory; html goes into html_reports/
+            if extension == "html":
+                reports_dir = self.inventory_dir / "html_reports"
+            else:
+                reports_dir = self.inventory_dir
+            reports_dir.mkdir(exist_ok=True, parents=True)
             
         return reports_dir / f"{report_name}_{timestamp}.{extension}"
 

{thothctl-0.18.6 → thothctl-0.18.7}/src/thothctl/services/scan/scanners/opa.py

@@ -138,7 +138,10 @@ class OPAScanner(ScannerPort):
                 f.write(result_junit.stdout or "")
 
             # Parse JSON results
-            report_data = self._parse_conftest_json(result_json.stdout)
+            report_data, findings = self._parse_conftest_json(result_json.stdout)
+
+            # Generate HTML report (unified style)
+            self._generate_html_report(report_dir, report_data, findings, "Conftest")
 
             # conftest exit codes: 0=pass, 1=failure/violation, 2=error
             if result_json.returncode == 2:
@@ -150,6 +153,7 @@ class OPAScanner(ScannerPort):
                     "error": result_json.stderr,
                     "report_path": report_dir,
                     "report_data": report_data,
+                    "findings": findings,
                 }
 
             self.ui.show_success()
@@ -157,6 +161,7 @@ class OPAScanner(ScannerPort):
                 "status": "COMPLETE",
                 "report_path": report_dir,
                 "report_data": report_data,
+                "findings": findings,
                 "issues_count": report_data.get("failed_count", 0),
             }
 
@@ -228,7 +233,7 @@ class OPAScanner(ScannerPort):
             with open(json_report, "w") as f:
                 f.write(result.stdout or "{}")
 
-            report_data = self._parse_opa_json(result.stdout)
+            report_data, findings = self._parse_opa_json(result.stdout)
 
             if result.returncode != 0 and not result.stdout:
                 self.ui.show_error(f"OPA error: {result.stderr}")
@@ -237,13 +242,18 @@ class OPAScanner(ScannerPort):
                     "error": result.stderr,
                     "report_path": report_dir,
                     "report_data": report_data,
+                    "findings": findings,
                 }
 
+            # Generate HTML report (unified style)
+            self._generate_html_report(report_dir, report_data, findings, "OPA")
+
             self.ui.show_success()
             return {
                 "status": "COMPLETE",
                 "report_path": report_dir,
                 "report_data": report_data,
+                "findings": findings,
                 "issues_count": report_data.get("failed_count", 0),
             }
 
@@ -257,24 +267,52 @@ class OPAScanner(ScannerPort):
 
     # ── Parsing ────────────────────────────────────────────────────────
 
-    def _parse_conftest_json(self, stdout: str) -> Dict:
-        """Parse conftest JSON output into report_data format.
+    def _parse_conftest_json(self, stdout: str) -> tuple:
+        """Parse conftest JSON output into report_data and findings list.
 
         Conftest JSON structure:
         [{"filename": "...", "successes": N,
           "failures": [{"msg": "..."}], "warnings": [{"msg": "..."}]}]
+
+        Returns:
+            Tuple of (report_data dict, findings list)
         """
         try:
             results = json.loads(stdout) if stdout else []
         except json.JSONDecodeError:
-            return self._empty_report_data()
+            return self._empty_report_data(), []
 
         passed = sum(r.get("successes", 0) for r in results)
         failed = sum(len(r.get("failures", [])) for r in results)
         warnings = sum(len(r.get("warnings", [])) for r in results)
         exceptions = sum(len(r.get("exceptions", [])) for r in results)
 
-        return {
+        # Build structured findings
+        findings = []
+        for r in results:
+            filename = r.get("filename", "unknown")
+            for failure in r.get("failures", []):
+                findings.append({
+                    "id": "OPA",
+                    "severity": "HIGH",
+                    "title": failure.get("msg", "Policy violation"),
+                    "resource": failure.get("metadata", {}).get("resource", ""),
+                    "file": filename,
+                    "line": failure.get("metadata", {}).get("line", 0),
+                    "namespace": r.get("namespace", ""),
+                })
+            for warning in r.get("warnings", []):
+                findings.append({
+                    "id": "OPA",
+                    "severity": "MEDIUM",
+                    "title": warning.get("msg", "Policy warning"),
+                    "resource": warning.get("metadata", {}).get("resource", ""),
+                    "file": filename,
+                    "line": warning.get("metadata", {}).get("line", 0),
+                    "namespace": r.get("namespace", ""),
+                })
+
+        report_data = {
             "passed_count": passed,
             "failed_count": failed,
             "skipped_count": exceptions,
@@ -282,16 +320,21 @@ class OPAScanner(ScannerPort):
             "warning_count": warnings,
         }
 
-    def _parse_opa_json(self, stdout: str) -> Dict:
+        return report_data, findings
+
+    def _parse_opa_json(self, stdout: str) -> tuple:
         """Parse opa exec JSON output.
 
         OPA exec structure:
         {"result": [{"path": "file.json", "result": true/false/<value>}]}
+
+        Returns:
+            Tuple of (report_data dict, findings list)
         """
         try:
             data = json.loads(stdout) if stdout else {}
         except json.JSONDecodeError:
-            return self._empty_report_data()
+            return self._empty_report_data(), []
 
         results = data.get("result", [])
         passed = sum(1 for r in results if r.get("result") is True)
@@ -299,13 +342,29 @@ class OPAScanner(ScannerPort):
         # Results that are neither true nor false (e.g. score values)
         other = len(results) - passed - failed
 
-        return {
+        findings = []
+        for r in results:
+            if r.get("result") is False:
+                findings.append({
+                    "id": "OPA",
+                    "severity": "HIGH",
+                    "title": f"Policy denied: {Path(r.get('path', 'unknown')).name}",
+                    "resource": "",
+                    "file": r.get("path", "unknown"),
+                    "line": 0,
+                    "namespace": "",
+                })
+
+        report_data = {
             "passed_count": passed,
             "failed_count": failed,
             "skipped_count": other,
             "error_count": 0,
+            "warning_count": 0,
         }
 
+        return report_data, findings
+
     @staticmethod
     def _empty_report_data() -> Dict:
         return {
@@ -313,8 +372,81 @@ class OPAScanner(ScannerPort):
             "failed_count": 0,
             "skipped_count": 0,
             "error_count": 0,
+            "warning_count": 0,
         }
 
+    def _generate_html_report(
+        self, report_dir: str, report_data: Dict, findings: List[Dict], tool_name: str
+    ) -> None:
+        """Generate HTML report in unified ThothCTL style (matches KICS/TF-compliance)."""
+        from datetime import datetime
+
+        html_dir = os.path.join(report_dir, "html_reports")
+        os.makedirs(html_dir, exist_ok=True)
+
+        passed = report_data.get("passed_count", 0)
+        failed = report_data.get("failed_count", 0)
+        warnings = report_data.get("warning_count", 0)
+        total = passed + failed + warnings
+        rate = round(passed / total * 100, 1) if total > 0 else 100.0
+
+        # Build findings table rows
+        rows = ""
+        for f in findings:
+            sev = f.get("severity", "MEDIUM").lower()
+            ns = f.get("namespace", "")
+            ns_badge = f' <span class="ns">{ns}</span>' if ns else ""
+            rows += f"""<tr>
+                <td><span class="sev {sev}">{f.get('severity', '')}</span></td>
+                <td><code>{f.get('id', '')}</code></td>
+                <td>{f.get('title', '')}{ns_badge}</td>
+                <td>{f.get('file', '')}{(':' + str(f['line'])) if f.get('line') else ''}</td>
+                <td>{f.get('resource', '') or '—'}</td>
+            </tr>"""
+
+        html = f"""<!DOCTYPE html><html><head><meta charset="UTF-8">
+<title>{tool_name} Scan Results</title>
+<link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;600;700&display=swap" rel="stylesheet">
+<style>
+body{{font-family:'Inter',sans-serif;margin:0;padding:20px;background:linear-gradient(135deg,#667eea 0%,#764ba2 100%);min-height:100vh;color:#111827}}
+.container{{max-width:1100px;margin:0 auto;background:white;border-radius:12px;box-shadow:0 20px 60px rgba(0,0,0,0.15);overflow:hidden}}
+.header{{background:linear-gradient(135deg,#667eea,#764ba2);color:white;padding:24px}}
+.header h1{{margin:0;font-size:1.5rem}} .header p{{margin:5px 0 0;opacity:0.9;font-size:0.85rem}}
+.tool-badge{{background:rgba(255,255,255,0.2);padding:4px 10px;border-radius:12px;font-size:0.75rem;margin-left:8px}}
+.content{{padding:24px}}
+.cards{{display:flex;gap:12px;margin-bottom:20px}}
+.card{{background:#f9fafb;padding:16px;border-radius:8px;text-align:center;flex:1}}
+.card .val{{font-size:1.5rem;font-weight:700}} .card .lbl{{font-size:0.7rem;color:#6b7280;text-transform:uppercase}}
+table{{width:100%;border-collapse:collapse;font-size:0.83rem}}
+th{{background:#f3f4f6;padding:10px 12px;text-align:left;font-size:0.75rem;text-transform:uppercase;color:#6b7280}}
+td{{padding:8px 12px;border-top:1px solid #e5e7eb}} tr:hover{{background:#f9fafb}}
+.sev{{padding:2px 8px;border-radius:10px;font-size:0.7rem;font-weight:600}}
+.sev.critical{{background:#fef2f2;color:#dc2626}} .sev.high{{background:#fef2f2;color:#ef4444}}
+.sev.medium{{background:#fffbeb;color:#b45309}} .sev.low{{background:#fefce8;color:#92400e}} .sev.info{{background:#eff6ff;color:#3b82f6}}
+code{{background:#f3f4f6;padding:2px 4px;border-radius:3px;font-size:0.8rem}}
+.ns{{background:#eff6ff;color:#3b82f6;padding:2px 6px;border-radius:8px;font-size:0.7rem;margin-left:4px}}
+.footer{{padding:16px 24px;background:#f9fafb;font-size:0.75rem;color:#9ca3af;text-align:center}}
+@media print{{body{{background:white;padding:0}} .container{{box-shadow:none}}}}
+</style></head><body>
+<div class="container">
+<div class="header"><h1>🛡️ Security Scan Results<span class="tool-badge">{tool_name}</span></h1>
+<p>Scanned {datetime.now().strftime('%Y-%m-%d %H:%M')} — {failed} violation{'s' if failed != 1 else ''} found</p></div>
+<div class="content">
+<div class="cards">
+<div class="card"><div class="val">{total}</div><div class="lbl">Total Checks</div></div>
+<div class="card"><div class="val" style="color:#10b981">{passed}</div><div class="lbl">Passed</div></div>
+<div class="card"><div class="val" style="color:#ef4444">{failed}</div><div class="lbl">Failed</div></div>
+<div class="card"><div class="val" style="color:#f59e0b">{warnings}</div><div class="lbl">Warnings</div></div>
+<div class="card"><div class="val" style="color:#667eea">{rate}%</div><div class="lbl">Success Rate</div></div>
+</div>
+{'<table><thead><tr><th>Severity</th><th>Rule</th><th>Policy Violation</th><th>File</th><th>Resource</th></tr></thead><tbody>' + rows + '</tbody></table>' if findings else '<p style="color:#10b981;font-weight:600">✅ All policies passed — no violations found</p>'}
+</div>
+<div class="footer">Generated by ThothCTL</div>
+</div></body></html>"""
+
+        with open(os.path.join(html_dir, "index.html"), "w", encoding="utf-8") as f:
+            f.write(html)
+
     # ── Helpers ─────────────────────────────────────────────────────────
 
     def _resolve_policy_dir(self, base_dir: str, policy_dir: str) -> Optional[str]:
@@ -372,7 +504,6 @@ class OPAScanner(ScannerPort):
     def _clone_policy_repo(self, repo_url: str) -> Optional[str]:
         """Clone a policy Git repository to local cache. Returns path or None."""
         import hashlib
-        import tempfile
 
         try:
             import git

thothctl-0.18.7/src/thothctl/version.py

@@ -0,0 +1,2 @@
+"""Version module."""
+__version__ = "0.18.7"