scan.py

import sys
import argparse
from pathlib import Path

# Add project root to python path
sys.path.insert(0, str(Path(__file__).resolve().parent))

from app.orchestrator.pipeline import PipelineOrchestrator
from app.config.settings import settings
from app.utils.logger import get_logger

logger = get_logger(__name__)

def main():
    parser = argparse.ArgumentParser(
        description="Sentinel AI Lite - Scan a Python GitHub repository for security vulnerabilities."
    )
    parser.add_argument(
        "github_url", 
        type=str, 
        help="HTTPS URL of the public Python repository to scan (e.g. https://github.com/psf/requests)"
    )
    parser.add_argument(
        "--branch", 
        type=str, 
        default=None, 
        help="Specific branch name to check out (optional)"
    )
    
    args = parser.parse_args()
    url = args.github_url.strip()
    branch = args.branch
    
    print("\n" + "="*60)
    print(f"[*] Sentinel AI Lite: Starting Scan for {url}")
    print("="*60 + "\n")
    
    # Check settings paths exist
    settings.REPOS_DIR.mkdir(parents=True, exist_ok=True)
    settings.REPORTS_DIR.mkdir(parents=True, exist_ok=True)
    
    orchestrator = PipelineOrchestrator()
    
    try:
        report = orchestrator.run_pipeline(url, branch=branch)
        
        print("\n" + "="*60)
        print("[OK] Analysis Completed!")
        print("="*60)
        print(f"Job ID:               {report.job_id}")
        print(f"Status:               {report.status}")
        print(f"Scan Duration:        {report.duration_sec}s")
        print(f"Repository Name:      {report.metadata.repo_name}")
        print(f"Commit Hash:          {report.metadata.commit_hash[:8] if report.metadata.commit_hash else 'N/A'}")
        print(f"Detected Languages:   {report.metadata.language}")
        print(f"Dependencies Parsed:  {len(report.dependencies.dependencies)}")
        print(f"Vulnerabilities Found: {len(report.vulnerabilities.vulnerabilities)}")
        print(f"Reachability Verdict: {report.reachability.verdict} (score: {report.reachability.confidence_score})")
        print(f"Final Risk Score:     {report.final_score}/100")
        
        if report.risk_assessment:
            print("\n[!] Vulnerability Details:")
            for idx, ass in enumerate(report.risk_assessment, 1):
                print(f"  {idx}. [{ass.cve_id}] in {ass.package_name}:")
                print(f"     - Verdict:          {ass.reachability_verdict}")
                print(f"     - Exploit Likelihood:{ass.exploit_likelihood_score}")
                print(f"     - Overall Risk Score:{ass.overall_risk_score}/100")
                print(f"     - Remediation:      {ass.recommended_remediation}")
        
        print("\n[Reports] Security Reports Written to Disk:")
        print(f"  - JSON Report:     {settings.REPORTS_DIR / f'{report.job_id}.json'}")
        print(f"  - Markdown Report: {settings.REPORTS_DIR / f'{report.job_id}.md'}")
        print("="*60 + "\n")
        
    except Exception as e:
        print(f"\n[ERROR] Scan Failed: {e}")
        logger.error("Scan failed with exception", exc_info=True)
        sys.exit(1)

if __name__ == "__main__":
    main()