Metadata-Version: 2.4
Name: codeintely-cli
Version: 0.1.0
Summary: CodeIntely local/pre-commit security scanner — the same custom rule pack (identity security, AppSec breadth, IaC/container config) the GitHub App and VS Code extension use, runnable before you ever push.
License-Expression: Apache-2.0
Project-URL: Homepage, https://codeintely.com
Project-URL: Repository, https://github.com/mdfaisalbe84/codeintely
Classifier: Environment :: Console
Classifier: Intended Audience :: Developers
Classifier: Topic :: Security
Classifier: Topic :: Software Development :: Quality Assurance
Classifier: Programming Language :: Python :: 3
Requires-Python: >=3.10
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: semgrep>=1.90
Requires-Dist: pyyaml>=6.0
Dynamic: license-file

# codeintely-cli

Local security scanner for the [CodeIntely](https://codeintely.com) platform — the same rule pack the GitHub App and VS Code extension use, runnable before you ever push. No account, no network calls to CodeIntely's own servers, no Django project required.

```bash
pip install codeintely-cli
codeintely scan .
```

## What it checks

- **Custom rule pack** (bundled, always runs) — identity security, tenant isolation/IDOR, mass assignment, and general AppSec breadth, via [Semgrep](https://semgrep.dev).
- **Secrets** — [Gitleaks](https://github.com/gitleaks/gitleaks).
- **Dependency CVEs** — [OSV-Scanner](https://github.com/google/osv-scanner).
- **IaC misconfiguration** (Terraform/Kubernetes/Dockerfile) — [Trivy](https://github.com/aquasecurity/trivy).

Gitleaks/OSV-Scanner/Trivy are auto-installed on first use if not already on `PATH` (downloaded once into `~/.codeintely/bin/`, reused after) — a plain `pip install` gets full coverage without separately installing three more tools by hand.

## Usage

```bash
codeintely scan [PATH]                       # defaults to the current directory
codeintely scan . --format json               # machine-readable output
codeintely scan . --severity-threshold HIGH    # exit non-zero only at/above this severity (default: HIGH)
codeintely scan . --no-color                   # disable ANSI color
```

Exit code is `0` when nothing at or above `--severity-threshold` was found, `1` otherwise — safe to use directly in CI or a git hook.

## Pre-commit hook

Add to your repo's `.pre-commit-config.yaml`:

```yaml
repos:
  - repo: https://github.com/mdfaisalbe84/codeintely
    rev: main  # pin to a tag once one exists
    hooks:
      - id: codeintely
```

Then:

```bash
pip install pre-commit
pre-commit install
```

Every `git commit` now runs the scan first — a finding at or above `HIGH` blocks the commit before it ever reaches version control.

## Why local, not just the GitHub App

The hosted GitHub App scans pull requests *after* they reach GitHub — it can block a merge, not a `git push`. This CLI runs the same rules entirely offline, before a commit is even made.
