id       = "cycode"
name     = "Cycode CLI"
homepage = "https://github.com/cycodehq/cycode-cli"
description = "A command-line client for Cycode security scanning and authentication."
executables   = ["cycode"]

[dotfiles]

# https://github.com/cycodehq/cycode-cli — the official setup instructions say
# the CLI creates a .cycode directory in the user's home folder, writing URLs
# to config.yaml and credentials to credentials.yaml.
paths = ["~/.cycode/config.yaml"]
secret = ["~/.cycode/credentials.yaml"]
side_effect = false

[commands]
format = 1
label = "Cycode CLI"
description = "Global output options only. Authentication, client secrets and the platform command groups are left out; use the scan subcommand form for scanning."
quality = "ai-draft"
parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = true, short_bundles = false }

[[commands.source]]
id = "readme"
kind = "help"
url = "https://raw.githubusercontent.com/cycodehq/cycode-cli/HEAD/README.md"
revision = "README global options"
evidence = '''
| `-v`, `--verbose`                                                 | Show detailed logs.                                                                |
| `-o`, `--output [rich\|text\|json\|table]`                        | Specify the output type. The default is `rich`.                                    |
'''

[[commands.field]]
id = "verbose"
label = "Verbose"
type = "boolean"
option = ["--verbose", "-v"]
sources = ["readme"]

[[commands.field]]
id = "output"
label = "Output type"
type = "enum"
option = ["--output", "-o"]
choices = [{ value = "rich", label = "Rich" }, { value = "text", label = "Text" }, { value = "json", label = "JSON" }, { value = "table", label = "Table" }]
sources = ["readme"]

[[commands.task]]
id = "json"
label = "JSON output"
fields = ["verbose", "output"]
required = []
set = { output = ["json"] }

[[commands.group]]
id = "basic"
label = "Basic"
fields = ["verbose", "output"]

[[commands.subcommand]]
path = ["scan"]
label = "Scan a repository"
description = "Scan a local repository path. Scan types other than secret, SCA sub-scans, Maven/Gradle options and other scan targets are left out."

[[commands.subcommand.source]]
id = "readme"
kind = "help"
url = "https://raw.githubusercontent.com/cycodehq/cycode-cli/HEAD/README.md"
revision = "README scan command"
evidence = '''
| `-t, --scan-type [secret\|iac\|sca\|sast]`                 | Specify the scan you wish to execute (`secret`/`iac`/`sca`/`sast`), the default is `secret`.                                     |
| `--severity-threshold [INFO\|LOW\|MEDIUM\|HIGH\|CRITICAL]` | Show only violations at the specified level or higher.                                                                           |
| `--monitor`                                                | When specified, the scan results will be recorded in Cycode.                                                                     |
| `--cycode-report`                                          | Display a link to the scan report in the Cycode platform in the console output.                                                  |
| `--no-restore`                                             | When specified, Cycode will not run the restore command. This will scan direct dependencies ONLY!                                |
`cycode scan --severity-threshold MEDIUM repository ~/home/git/codebase`
'''

[[commands.subcommand.field]]
id = "scan_type"
label = "Scan type"
type = "enum"
option = ["--scan-type", "-t"]
choices = [{ value = "secret", label = "Secrets" }, { value = "iac", label = "Infrastructure as code" }, { value = "sca", label = "Dependencies (SCA)" }, { value = "sast", label = "SAST" }]
sources = ["readme"]

[[commands.subcommand.field]]
id = "severity"
label = "Minimum severity"
type = "enum"
option = ["--severity-threshold"]
choices = [{ value = "INFO", label = "Info" }, { value = "LOW", label = "Low" }, { value = "MEDIUM", label = "Medium" }, { value = "HIGH", label = "High" }, { value = "CRITICAL", label = "Critical" }]
sources = ["readme"]

[[commands.subcommand.field]]
id = "monitor"
label = "Record results in Cycode"
type = "boolean"
option = ["--monitor"]
sources = ["readme"]

[[commands.subcommand.field]]
id = "report"
label = "Print report link"
type = "boolean"
option = ["--cycode-report"]
sources = ["readme"]

[[commands.subcommand.field]]
id = "no_restore"
label = "Skip dependency restore"
type = "boolean"
option = ["--no-restore"]
sources = ["readme"]

[[commands.subcommand.field]]
id = "target"
label = "Scan target"
type = "enum"
position = 0
choices = [{ value = "repository", label = "Repository path" }]
sources = ["readme"]

[[commands.subcommand.field]]
id = "path"
label = "Repository path"
type = "path"
position = 1
path = { kind = "directory", role = "input" }
sources = ["readme"]

[[commands.subcommand.task]]
id = "scan_repo"
label = "Scan a repository"
fields = ["scan_type", "severity", "target", "path"]
required = ["target", "path"]
set = { target = ["repository"] }
lock = ["target"]

[[commands.subcommand.group]]
id = "basic"
label = "Basic"
fields = ["target", "path", "scan_type", "severity"]

[[commands.subcommand.group]]
id = "advanced"
label = "Advanced"
fields = ["monitor", "report", "no_restore"]