Skip to content

Add option --reach-min-severity to only run reachability analysis on … #827

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
barslev wants to merge 1 commit into from
Closed

Add option --reach-min-severity to only run reachability analysis on … #827

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions packages/cli/src/commands/scan/cmd-scan-create.mts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -241,6 +241,7 @@ async function run(
reachAnalysisMemoryLimit,
reachAnalysisTimeout,
reachDisableAnalytics,
reachMinSeverity,
reachSkipCache,
readOnly,
reportLevel,
Expand All @@ -266,6 +267,7 @@ async function run(
reachAnalysisTimeout: number
reachAnalysisMemoryLimit: number
reachDisableAnalytics: boolean
reachMinSeverity: string
reachSkipCache: boolean
}

Expand All @@ -282,6 +284,14 @@ async function run(
reachEcosystems.push(ecosystem as PURL_Type)
}

// Validate severity value if provided.
const validSeverities = ['info', 'low', 'moderate', 'high', 'critical']
if (reachMinSeverity && !validSeverities.includes(reachMinSeverity.toLowerCase())) {
throw new Error(
`Invalid severity: "${reachMinSeverity}". Valid values are: ${joinAnd(validSeverities)}`,
)
}

const dryRun = !!cli.flags['dryRun']

let {
Expand Down Expand Up @@ -517,6 +527,7 @@ async function run(
reachAnalysisMemoryLimit: Number(reachAnalysisMemoryLimit),
reachEcosystems,
reachExcludePaths,
reachMinSeverity,
reachSkipCache: Boolean(reachSkipCache),
},
readOnly: Boolean(readOnly),
Expand Down
11 changes: 11 additions & 0 deletions packages/cli/src/commands/scan/cmd-scan-reach.mts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -123,6 +123,7 @@ async function run(
reachAnalysisMemoryLimit,
reachAnalysisTimeout,
reachDisableAnalytics,
reachMinSeverity,
reachSkipCache,
} = cli.flags as unknown as {
cwd: string
Expand All @@ -134,6 +135,7 @@ async function run(
reachAnalysisTimeout: number
reachAnalysisMemoryLimit: number
reachDisableAnalytics: boolean
reachMinSeverity: string
reachSkipCache: boolean
}

Expand All @@ -155,6 +157,14 @@ async function run(
reachEcosystems.push(ecosystem as PURL_Type)
}

// Validate severity value if provided.
const validSeverities = ['info', 'low', 'moderate', 'high', 'critical']
if (reachMinSeverity && !validSeverities.includes(reachMinSeverity.toLowerCase())) {
throw new Error(
`Invalid severity: "${reachMinSeverity}". Valid values are: ${joinAnd(validSeverities)}`,
)
}

const processCwd = process.cwd()
const cwd =
cwdOverride && cwdOverride !== '.' && cwdOverride !== processCwd
Expand Down Expand Up @@ -223,6 +233,7 @@ async function run(
reachDisableAnalytics: Boolean(reachDisableAnalytics),
reachEcosystems,
reachExcludePaths,
reachMinSeverity,
reachSkipCache: Boolean(reachSkipCache),
},
targets,
Expand Down
4 changes: 4 additions & 0 deletions packages/cli/src/commands/scan/perform-reachability-analysis.mts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ export type ReachabilityOptions = {
reachDisableAnalytics: boolean
reachEcosystems: PURL_Type[]
reachExcludePaths: string[]
reachMinSeverity: string
reachSkipCache: boolean
}

Expand Down Expand Up @@ -165,6 +166,9 @@ export async function performReachabilityAnalysis(
...(reachabilityOptions.reachExcludePaths.length
? ['--exclude-dirs', ...reachabilityOptions.reachExcludePaths]
: []),
...(reachabilityOptions.reachMinSeverity
? ['--min-severity', reachabilityOptions.reachMinSeverity]
: []),
...(reachabilityOptions.reachSkipCache ? ['--skip-cache-usage'] : []),
]

Expand Down
6 changes: 6 additions & 0 deletions packages/cli/src/commands/scan/reachability-flags.mts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,12 @@ export const reachabilityFlags: MeowFlags = {
description:
'List of paths to exclude from reachability analysis, as either a comma separated value or as multiple flags.',
},
reachMinSeverity: {
type: 'string',
default: '',
description:
'Set the minimum severity of vulnerabilities to analyze. Supported severities are info, low, moderate, high and critical.',
Copy link
Contributor

@mtorp mtorp Oct 29, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
'Set the minimum severity of vulnerabilities to analyze. Supported severities are info, low, moderate, high and critical.',
'Set the minimum severity of vulnerabilities to include in the reachability analysis. Supported severities are info, low, moderate, high and critical.',

},
reachSkipCache: {
type: 'boolean',
default: false,
Expand Down
Loading