security-scanner/src/security_scanner/cli/_args.py at main · source-security-dev/security-scanner · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
"""Shared argparse helpers for CLI subcommand parsers.

Single source for the argument-adding helpers that several subcommand parsers
share. Kept dependency-light (argparse + os only) so domain command modules and
``cli.app`` can both import from here without creating an import cycle.
"""

from __future__ import annotations

import argparse
import os


def add_storage_args(
    parser: argparse.ArgumentParser,
    *,
    include_jsonl_path: str,
    default_backend: str = "jsonl",
) -> None:
    env_backend = os.environ.get("SECURITY_SCANNER_STORAGE_BACKEND")
    if env_backend:
        env_backend = env_backend.lower().replace("_", "-")
    backend_default = env_backend or default_backend
    parser.add_argument(
        "--storage-backend",
        choices=["jsonl", "dynamodb"],
        default=backend_default,
        help="Finding storage backend "
        f"(default: SECURITY_SCANNER_STORAGE_BACKEND or {default_backend}).",
    )
    parser.add_argument(
        "--dynamodb-endpoint-url",
        metavar="URL",
        default=None,
        help="DynamoDB-compatible endpoint URL "
        "(default: SECURITY_SCANNER_DYNAMO_ENDPOINT or http://localhost:4567).",
    )
    parser.add_argument(
        "--dynamodb-table",
        metavar="NAME",
        default=None,
        help="DynamoDB-compatible table name "
        "(default: SECURITY_SCANNER_DYNAMO_TABLE or SecurityScannerLocal).",
    )
    parser.add_argument(
        "--dynamodb-region",
        metavar="REGION",
        default=None,
        help="DynamoDB-compatible region "
        "(default: SECURITY_SCANNER_AWS_REGION or us-west-2).",
    )
    if include_jsonl_path == "output":
        parser.add_argument(
            "-o",
            "--output",
            metavar="FILE",
            default="findings.jsonl",
            help="Path to write the JSONL findings store (default: findings.jsonl).",
        )
    elif include_jsonl_path == "findings":
        parser.add_argument(
            "--findings",
            metavar="FILE",
            default="findings.jsonl",
            help="Path to the JSONL findings store (default: findings.jsonl).",
        )


def add_incremental_storage_args(parser: argparse.ArgumentParser) -> None:
    parser.add_argument(
        "--storage-backend",
        choices=["jsonl", "dynamodb"],
        default="dynamodb",
        help="Queue storage backend (default: dynamodb; jsonl is unsupported).",
    )
    parser.add_argument(
        "--dynamodb-endpoint-url",
        metavar="URL",
        default=None,
        help="DynamoDB-compatible endpoint URL "
        "(default: SECURITY_SCANNER_DYNAMO_ENDPOINT or http://localhost:4567).",
    )
    parser.add_argument(
        "--dynamodb-table",
        metavar="NAME",
        default=None,
        help="DynamoDB-compatible table name "
        "(default: SECURITY_SCANNER_DYNAMO_TABLE or SecurityScannerLocal).",
    )
    parser.add_argument(
        "--dynamodb-region",
        metavar="REGION",
        default=None,
        help="DynamoDB-compatible region "
        "(default: SECURITY_SCANNER_AWS_REGION or us-west-2).",
    )


def add_query_args(parser: argparse.ArgumentParser) -> None:
    parser.add_argument(
        "--scan-run-id",
        metavar="ID",
        default=None,
        help="Read findings for one persisted scan run instead of the full store.",
    )