Initial commit: project structure and configuration
This commit is contained in:
281
README.md
281
README.md
@@ -1,3 +1,280 @@
|
||||
# depaudit-cli
|
||||
# DepAudit CLI
|
||||
|
||||
A comprehensive CLI tool that audits project dependencies for security vulnerabilities, outdated packages, license compliance, and unused dependencies.
|
||||
A comprehensive CLI tool that audits project dependencies across multiple languages for security vulnerabilities, outdated packages, license compliance issues, and unused dependencies.
|
||||
|
||||
## Features
|
||||
|
||||
- **Multi-language support**: JavaScript/Node.js, Python, Go, Rust, Java/Maven
|
||||
- **Security vulnerability scanning**: Query OSV and NVD databases for CVEs
|
||||
- **Outdated package detection**: Check for newer versions on package registries
|
||||
- **License compliance checking**: Validate against allowlist/blocklist
|
||||
- **Unused dependency detection**: Find dependencies that aren't imported
|
||||
- **Multiple output formats**: Table (with colors), JSON, or quiet mode
|
||||
- **CI/CD integration**: Generate GitHub Actions and GitLab CI configurations
|
||||
|
||||
## Installation
|
||||
|
||||
### From PyPI
|
||||
|
||||
```bash
|
||||
pip install depaudit-cli
|
||||
```
|
||||
|
||||
### From Source
|
||||
|
||||
```bash
|
||||
git clone https://github.com/depaudit/depaudit-cli
|
||||
cd depaudit-cli
|
||||
pip install -e .
|
||||
```
|
||||
|
||||
### Using pipx
|
||||
|
||||
```bash
|
||||
pipx install depaudit-cli
|
||||
```
|
||||
|
||||
## Quick Start
|
||||
|
||||
Audit the current directory:
|
||||
|
||||
```bash
|
||||
depaudit audit .
|
||||
```
|
||||
|
||||
Audit a specific project:
|
||||
|
||||
```bash
|
||||
depaudit audit /path/to/project
|
||||
```
|
||||
|
||||
Output as JSON:
|
||||
|
||||
```bash
|
||||
depaudit audit . --format json --output results.json
|
||||
```
|
||||
|
||||
Skip specific checks:
|
||||
|
||||
```bash
|
||||
depaudit audit . --skip-vulnerabilities --skip-licenses
|
||||
```
|
||||
|
||||
Filter by severity:
|
||||
|
||||
```bash
|
||||
depaudit audit . --severity high
|
||||
```
|
||||
|
||||
## Supported Languages
|
||||
|
||||
| Language | Dependency Files |
|
||||
|----------|-----------------|
|
||||
| JavaScript/Node.js | `package.json`, `package-lock.json`, `yarn.lock` |
|
||||
| Python | `requirements.txt`, `setup.py`, `pyproject.toml`, `Pipfile` |
|
||||
| Go | `go.mod` |
|
||||
| Rust | `Cargo.toml`, `Cargo.lock` |
|
||||
| Java/Maven | `pom.xml`, `build.gradle` |
|
||||
|
||||
## Usage
|
||||
|
||||
### Command Options
|
||||
|
||||
| Option | Description |
|
||||
|--------|-------------|
|
||||
| `--format` | Output format: `table`, `json`, or `quiet` |
|
||||
| `--output` | Write output to file |
|
||||
| `--no-color` | Disable colored output |
|
||||
| `--no-cache` | Disable API response caching |
|
||||
| `--severity` | Minimum severity: `critical`, `high`, `medium`, `low`, `all` |
|
||||
| `--skip-vulnerabilities` | Skip CVE vulnerability scanning |
|
||||
| `--skip-outdated` | Skip outdated package checking |
|
||||
| `--skip-licenses` | Skip license compliance checking |
|
||||
| `--skip-unused` | Skip unused dependency detection |
|
||||
| `--verbose` | Enable verbose output |
|
||||
|
||||
### CI/CD Generation
|
||||
|
||||
Generate GitHub Actions workflow:
|
||||
|
||||
```bash
|
||||
depaudit generate-cicd github --schedule "0 0 * * 0"
|
||||
```
|
||||
|
||||
Generate GitLab CI configuration:
|
||||
|
||||
```bash
|
||||
depaudit generate-cicd gitlab
|
||||
```
|
||||
|
||||
## Configuration
|
||||
|
||||
Create a `.depauditrc` file in your project root:
|
||||
|
||||
```yaml
|
||||
output:
|
||||
format: table
|
||||
color: true
|
||||
verbosity: info
|
||||
|
||||
vulnerabilities:
|
||||
enabled: true
|
||||
severity_filter: all
|
||||
api: osv
|
||||
cache_ttl: 86400
|
||||
|
||||
licenses:
|
||||
enabled: true
|
||||
allowlist:
|
||||
- MIT
|
||||
- Apache-2.0
|
||||
- BSD-3-Clause
|
||||
blocklist:
|
||||
- GPL-3.0
|
||||
- AGPL-3.0
|
||||
|
||||
cicd:
|
||||
fail_on:
|
||||
- critical
|
||||
- high
|
||||
```
|
||||
|
||||
## Output Formats
|
||||
|
||||
### Table Output
|
||||
|
||||
```
|
||||
============================================================
|
||||
DepAudit Report
|
||||
============================================================
|
||||
Scanned Files: 5
|
||||
Scan Duration: 2.45s
|
||||
|
||||
[VULNERABILITIES]
|
||||
+-----------+-------------------------+---------+--------+--------+
|
||||
| Severity | Package | Current | Fixed | ID |
|
||||
+-----------+-------------------------+---------+--------+--------+
|
||||
| CRITICAL | lodash | 4.17.15 | 4.17.21| CVE... |
|
||||
+-----------+-------------------------+---------+--------+--------+
|
||||
|
||||
[OUTDATED PACKAGES]
|
||||
+----------------------------+---------+---------+------------+
|
||||
| Package | Current | Latest | Update Type|
|
||||
+----------------------------+---------+---------+------------+
|
||||
| express | 4.17.1 | 4.18.2 | minor |
|
||||
+----------------------------+---------+---------+------------+
|
||||
|
||||
SEVERITY SUMMARY:
|
||||
CRITICAL: 1
|
||||
HIGH: 0
|
||||
MEDIUM: 2
|
||||
LOW: 1
|
||||
============================================================
|
||||
```
|
||||
|
||||
### JSON Output
|
||||
|
||||
```json
|
||||
{
|
||||
"vulnerabilities": [...],
|
||||
"outdated": [...],
|
||||
"license_issues": [...],
|
||||
"unused": [...],
|
||||
"scanned_files": [...],
|
||||
"scanned_count": 5,
|
||||
"error_count": 0,
|
||||
"scan_duration": 2.45,
|
||||
"summary": {
|
||||
"total_vulnerabilities": 4,
|
||||
"severity_breakdown": {
|
||||
"critical": 1,
|
||||
"high": 0,
|
||||
"medium": 2,
|
||||
"low": 1
|
||||
},
|
||||
"total_outdated": 3,
|
||||
"total_license_issues": 1,
|
||||
"total_unused": 2
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
## CI/CD Integration
|
||||
|
||||
### GitHub Actions
|
||||
|
||||
Generate a workflow file:
|
||||
|
||||
```bash
|
||||
depaudit generate-cicd github
|
||||
```
|
||||
|
||||
This creates `.github/workflows/depaudit.yml` with:
|
||||
- Scheduled scans (weekly by default)
|
||||
- Scan on push to main
|
||||
- Scan on PR creation
|
||||
- Results uploaded as artifacts
|
||||
- Comment on PR with summary
|
||||
|
||||
### GitLab CI
|
||||
|
||||
Generate a `.gitlab-ci.yml` section:
|
||||
|
||||
```bash
|
||||
depaudit generate-cicd gitlab
|
||||
```
|
||||
|
||||
## Environment Variables
|
||||
|
||||
| Variable | Description |
|
||||
|----------|-------------|
|
||||
| `DEPAUDIT_API_KEY` | API key for premium vulnerability databases |
|
||||
| `DEPAUDIT_CACHE_DIR` | Custom cache directory |
|
||||
| `DEPAUDIT_CONFIG_FILE` | Path to configuration file |
|
||||
| `HTTP_PROXY` | HTTP proxy for API requests |
|
||||
| `HTTPS_PROXY` | HTTPS proxy for API requests |
|
||||
|
||||
## Exit Codes
|
||||
|
||||
| Code | Description |
|
||||
|------|-------------|
|
||||
| 0 | No issues found or scan completed successfully |
|
||||
| 1 | Issues found (configurable via `cicd.fail_on`) |
|
||||
| 2 | Error during scan |
|
||||
|
||||
## Development
|
||||
|
||||
### Setup
|
||||
|
||||
```bash
|
||||
git clone https://github.com/depaudit/depaudit-cli
|
||||
cd depaudit-cli
|
||||
pip install -e ".[dev]"
|
||||
```
|
||||
|
||||
### Running Tests
|
||||
|
||||
```bash
|
||||
pytest tests/ -v --cov=depaudit
|
||||
```
|
||||
|
||||
### Linting
|
||||
|
||||
```bash
|
||||
black depaudit tests
|
||||
ruff check depaudit tests
|
||||
mypy depaudit
|
||||
```
|
||||
|
||||
## Contributing
|
||||
|
||||
1. Fork the repository
|
||||
2. Create a feature branch
|
||||
3. Make your changes
|
||||
4. Add tests for new functionality
|
||||
5. Run the test suite
|
||||
6. Submit a pull request
|
||||
|
||||
## License
|
||||
|
||||
MIT License - see [LICENSE](LICENSE) for details.
|
||||
|
||||
Reference in New Issue
Block a user