vehlo-code-scanner 0.1.2__tar.gz → 0.1.4__tar.gz

{vehlo_code_scanner-0.1.2 → vehlo_code_scanner-0.1.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: vehlo-code-scanner
-Version: 0.1.2
+Version: 0.1.4
 Summary: Multi-tenant security scanning platform wrapping Amazon Security Helper
 Project-URL: Homepage, https://github.com/Vehlo-CyberSec/vehlo-code-scanner
 Project-URL: Repository, https://github.com/Vehlo-CyberSec/vehlo-code-scanner
@@ -65,12 +65,15 @@ get the CLI, `--push`, and the client.
 **Public (no AWS):**
 
 ```bash
-# pip from PyPI
+# pipx (recommended — modern macOS/Linux pythons refuse bare pip installs)
+pipx install 'vehlo-code-scanner[scan]'    # quotes matter in zsh
+
+# or pip, inside a venv
 pip install 'vehlo-code-scanner[scan]'
 
-# Docker from ECR Public (ASH bundled, nothing else to install)
+# or Docker from ECR Public (ASH bundled, nothing else to install)
 docker run --rm -v "$PWD:/src" \
-  public.ecr.aws/<alias>/vehlo-code-scanner:latest scan /src
+  public.ecr.aws/w1f0w6h2/vehlo-code-scanner:latest scan /src --mode local
 ```
 
 **AWS-gated (internal):** authenticate once with `aws sso login`, then:

{vehlo_code_scanner-0.1.2 → vehlo_code_scanner-0.1.4}/README.md

@@ -37,12 +37,15 @@ get the CLI, `--push`, and the client.
 **Public (no AWS):**
 
 ```bash
-# pip from PyPI
+# pipx (recommended — modern macOS/Linux pythons refuse bare pip installs)
+pipx install 'vehlo-code-scanner[scan]'    # quotes matter in zsh
+
+# or pip, inside a venv
 pip install 'vehlo-code-scanner[scan]'
 
-# Docker from ECR Public (ASH bundled, nothing else to install)
+# or Docker from ECR Public (ASH bundled, nothing else to install)
 docker run --rm -v "$PWD:/src" \
-  public.ecr.aws/<alias>/vehlo-code-scanner:latest scan /src
+  public.ecr.aws/w1f0w6h2/vehlo-code-scanner:latest scan /src --mode local
 ```
 
 **AWS-gated (internal):** authenticate once with `aws sso login`, then:

{vehlo_code_scanner-0.1.2 → vehlo_code_scanner-0.1.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "vehlo-code-scanner"
-version = "0.1.2"
+version = "0.1.4"
 description = "Multi-tenant security scanning platform wrapping Amazon Security Helper"
 readme = "README.md"
 requires-python = ">=3.12"

{vehlo_code_scanner-0.1.2 → vehlo_code_scanner-0.1.4}/src/vcs/cli/scan_command.py

@@ -3,9 +3,7 @@
 from __future__ import annotations
 
 import subprocess
-import sys
 from pathlib import Path
-from typing import Optional
 
 import typer
 from rich.console import Console
@@ -19,66 +17,69 @@ console = Console()
 SEVERITY_LEVELS = ["critical", "high", "medium", "low", "info"]
 
 
-def _get_git_info(source_dir: str) -> tuple[str, str, str, str]:
-    """Get commit SHA, branch, provider, and org/repo from git remote."""
+def _git(args: list[str], cwd: str) -> str | None:
+    """Run a git command, returning stripped stdout or None on failure."""
     try:
-        sha = subprocess.run(
-            ["git", "rev-parse", "HEAD"],
-            cwd=source_dir,
-            capture_output=True,
-            text=True,
-            check=True,
-        ).stdout.strip()
-        branch = subprocess.run(
-            ["git", "rev-parse", "--abbrev-ref", "HEAD"],
-            cwd=source_dir,
-            capture_output=True,
-            text=True,
-            check=True,
-        ).stdout.strip()
-        remote_url = subprocess.run(
-            ["git", "remote", "get-url", "origin"],
-            cwd=source_dir,
+        out = subprocess.run(
+            ["git", *args],
+            cwd=cwd,
             capture_output=True,
             text=True,
             check=True,
         ).stdout.strip()
     except (subprocess.CalledProcessError, FileNotFoundError):
-        return "unknown", "unknown", "github", "unknown"
+        return None
+    return out or None
+
+
+def _get_git_info(source_dir: str) -> tuple[str, str, str, str, str | None]:
+    """Get commit SHA, branch, provider, org, and repo name from git.
+
+    Each field degrades independently: a repo without an `origin` remote
+    still reports its real SHA and branch, and vice versa. The repo name is
+    only known when a remote exists (callers fall back to the directory
+    name).
+    """
+    sha = _git(["rev-parse", "HEAD"], source_dir) or "unknown"
+    branch = (
+        _git(["rev-parse", "--abbrev-ref", "HEAD"], source_dir) or "unknown"
+    )
+    remote_url = _git(["remote", "get-url", "origin"], source_dir)
+    if not remote_url:
+        return sha, branch, "github", "unknown", None
+
+    provider, org, repo = _parse_remote(remote_url)
+    return sha, branch, provider, org, repo
 
-    provider, org = _parse_remote(remote_url)
-    return sha, branch, provider, org
 
+def _parse_remote(remote_url: str) -> tuple[str, str, str | None]:
+    """Extract provider, org, and repo name from a git remote URL.
 
-def _parse_remote(remote_url: str) -> tuple[str, str]:
-    """Extract provider and org from a git remote URL."""
+    Handles git@host:org/repo.git, https://host/org/repo(.git), and
+    ssh://git@host/org/repo.git forms.
+    """
     url = remote_url.lower()
-    if "github.com" in url:
-        provider = "github"
-    elif "bitbucket.org" in url:
+    if "bitbucket.org" in url:
         provider = "bitbucket"
     elif "gitlab.com" in url:
         provider = "gitlab"
     else:
         provider = "github"
 
-    # Extract org from URLs like:
-    #   git@github.com:org/repo.git
-    #   https://github.com/org/repo.git
-    org = "unknown"
-    if ":" in remote_url and "@" in remote_url:
-        # SSH format: git@host:org/repo.git
-        path = remote_url.split(":")[-1]
-        parts = path.replace(".git", "").split("/")
-        if parts:
-            org = parts[0]
-    elif "/" in remote_url:
-        # HTTPS format: https://host/org/repo.git
-        parts = remote_url.replace(".git", "").split("/")
-        if len(parts) >= 2:
-            org = parts[-2]
-
-    return provider, org
+    # Normalize every form to host/org/.../repo, then read the tail.
+    path = remote_url
+    if "://" in path:
+        path = path.split("://", 1)[1]  # strip scheme
+    if "@" in path:
+        path = path.split("@", 1)[1]  # strip user
+    path = path.replace(":", "/", 1)  # scp-like host:org/repo
+    parts = [p for p in path.removesuffix(".git").split("/") if p]
+
+    if len(parts) >= 3:  # [host, org..., repo]
+        return provider, parts[-2], parts[-1]
+    if len(parts) == 2:  # [host, org]
+        return provider, parts[1], None
+    return provider, "unknown", None
 
 
 def _create_client(api_url: str, api_token: str) -> VCSClient:
@@ -91,7 +92,7 @@ def scan(
         ".",
         help="Directory to scan. Defaults to current directory.",
     ),
-    scanners: Optional[str] = typer.Option(
+    scanners: str | None = typer.Option(
         None,
         help="Comma-separated list of scanners to run (e.g., semgrep,bandit).",
     ),
@@ -99,7 +100,7 @@ def scan(
         "container",
         help="ASH execution mode: container (default, all scanners included), local, or precommit.",
     ),
-    fail_on: Optional[str] = typer.Option(
+    fail_on: str | None = typer.Option(
         None,
         help=(
             "Exit non-zero if findings at this severity or above exist "
@@ -110,16 +111,34 @@ def scan(
         False,
         help="Push results to the central API.",
     ),
-    api_url: Optional[str] = typer.Option(
+    api_url: str | None = typer.Option(
         None,
         envvar="VCS_API_URL",
         help="Central API URL (required with --push).",
     ),
-    api_token: Optional[str] = typer.Option(
+    api_token: str | None = typer.Option(
         None,
         envvar="VCS_API_TOKEN",
         help="API token for authentication (required with --push).",
     ),
+    repo_name: str | None = typer.Option(
+        None,
+        "--repo-name",
+        envvar="VCS_REPO_NAME",
+        help=(
+            "Repository name for attribution (defaults to the git remote's "
+            "repo name, then the directory name)."
+        ),
+    ),
+    org: str | None = typer.Option(
+        None,
+        "--org",
+        envvar="VCS_PROVIDER_ORG",
+        help=(
+            "Provider org/owner for attribution (defaults to the git "
+            "remote's org)."
+        ),
+    ),
 ) -> None:
     """Run a security scan against a directory using ASH."""
     source_path = Path(source_dir).resolve()
@@ -154,14 +173,16 @@ def scan(
     format_findings_table(result, console)
 
     if push:
-        sha, branch, provider, org = _get_git_info(str(source_path))
+        sha, branch, provider, git_org, git_repo = _get_git_info(
+            str(source_path)
+        )
         client = _create_client(api_url, api_token)
         try:
             scan_id = client.push(
                 result=result,
                 repo_provider=provider,
-                repo_org=org,
-                repo_name=source_path.name,
+                repo_org=org or git_org,
+                repo_name=repo_name or git_repo or source_path.name,
                 commit_sha=sha,
                 branch=branch,
                 trigger_type="manual_cli",