diff --git a/.env.example b/.env.example index 5c71d09..3e96d4a 100644 --- a/.env.example +++ b/.env.example @@ -1,4 +1,4 @@ -# SDLC Code Scanner - Environment Variables Template +# Portfolio Code Scanner - Environment Variables Template # Copy this file to .env and fill in your values # ======================================== diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 04bbca0..298b3a9 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,4 +1,4 @@ -# CI workflow for testing the SDLC Code Scanner action itself +# CI workflow for testing the Portfolio Code Scanner action itself name: CI on: @@ -73,7 +73,7 @@ jobs: with: context: . push: false - tags: sdlc-code-scanner:test + tags: portfolio-code-scanner:test cache-from: type=gha cache-to: type=gha,mode=max @@ -85,7 +85,7 @@ jobs: - uses: actions/checkout@v4 - name: Build Docker image - run: docker build -t sdlc-code-scanner:test . + run: docker build -t portfolio-code-scanner:test . - name: Create output directory run: mkdir -p test-reports && chmod 777 test-reports @@ -95,7 +95,7 @@ jobs: docker run --rm \ -v ${{ github.workspace }}/tests/fixtures:/repo:ro \ -v ${{ github.workspace }}/test-reports:/app/reports \ - sdlc-code-scanner:test \ + portfolio-code-scanner:test \ scan-local --repo-path /repo --output-dir /app/reports --format json || true - name: Verify report generated diff --git a/.github/workflows/example-usage.yml b/.github/workflows/example-usage.yml index dc55534..5a0006e 100644 --- a/.github/workflows/example-usage.yml +++ b/.github/workflows/example-usage.yml @@ -1,8 +1,8 @@ -# Example workflow showing how to use SDLC Code Scanner in your repository +# Example workflow showing how to use Portfolio Code Scanner in your repository # Copy this file to your repository's .github/workflows/ directory # # NOTE: This workflow is disabled by default in this repository since -# it references the published action (crofton-cloud/sdlc-code-scanner@v1). +# it references the published action (williambrady/portfolio-code-scanner@v1). # The actual CI tests are in ci.yml which uses the local action. name: Security Scan @@ -23,16 +23,16 @@ permissions: jobs: security-scan: - name: SDLC Code Scanner Security Scan + name: Portfolio Code Scanner Security Scan runs-on: ubuntu-latest steps: - name: Checkout repository uses: actions/checkout@v4 - - name: Run SDLC Code Scanner + - name: Run Portfolio Code Scanner id: security-scan - uses: crofton-cloud/sdlc-code-scanner@v1 + uses: williambrady/portfolio-code-scanner@v1 with: # Scan the entire repository (default) scan-path: '.' @@ -54,14 +54,14 @@ jobs: if: always() && steps.security-scan.outputs.sarif-path != '' with: sarif_file: ${{ steps.security-scan.outputs.sarif-path }} - category: 'sdlc-code-scanner' + category: 'portfolio-code-scanner' - name: Upload scan reports as artifact uses: actions/upload-artifact@v4 if: always() with: name: security-scan-reports - path: .sdlc-code-scanner-reports/ + path: .portfolio-code-scanner-reports/ retention-days: 30 - name: Post scan summary comment on PR @@ -78,7 +78,7 @@ jobs: const statusEmoji = status === 'passed' ? ':white_check_mark:' : ':x:'; - const body = `## SDLC Code Scanner Security Scan ${statusEmoji} + const body = `## Portfolio Code Scanner Security Scan ${statusEmoji} | Severity | Count | |----------|-------| diff --git a/.gitignore b/.gitignore index 7d8842a..6209158 100644 --- a/.gitignore +++ b/.gitignore @@ -182,9 +182,9 @@ cython_debug/ .abstra/ # Visual Studio Code -# Visual Studio Code specific template is maintained in a separate VisualStudioCode.gitignore +# Visual Studio Code specific template is maintained in a separate VisualStudioCode.gitignore # that can be found at https://github.com/github/gitignore/blob/main/Global/VisualStudioCode.gitignore -# and can be added to the global gitignore or merged into this file. However, if you prefer, +# and can be added to the global gitignore or merged into this file. However, if you prefer, # you could uncomment the following to ignore the entire vscode folder # .vscode/ @@ -207,7 +207,7 @@ marimo/_lsp/ __marimo__/ # ======================================== -# SDLC Code Scanner - Scan Artifacts +# Portfolio Code Scanner - Scan Artifacts # ======================================== # Scan reports directory reports/ diff --git a/CLAUDE.md b/CLAUDE.md index e5640c5..6f44a03 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -10,7 +10,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co ## Project Overview -SDLC Code Scanner is a Python-based security assessment utility for AWS infrastructure-as-code (IaC). It orchestrates multiple security scanning tools in a Docker container to provide comprehensive security analysis of Terraform, CloudFormation, Python, and npm-based projects. +Portfolio Code Scanner is a Python-based security assessment utility for AWS infrastructure-as-code (IaC). It orchestrates multiple security scanning tools in a Docker container to provide comprehensive security analysis of Terraform, CloudFormation, Python, and npm-based projects. ## Architecture @@ -60,7 +60,7 @@ SDLC Code Scanner is a Python-based security assessment utility for AWS infrastr Build the Docker image: ```bash -docker build -t sdlc-code-scanner . +docker build -t portfolio-code-scanner . ``` Run local repository scan: diff --git a/COMMIT_MESSAGE.md b/COMMIT_MESSAGE.md deleted file mode 100644 index c48a856..0000000 --- a/COMMIT_MESSAGE.md +++ /dev/null @@ -1,161 +0,0 @@ -# Commit Summary - -## feat: Add Python security scanning and comprehensive security improvements - -### Major Features Added - -#### 1. Python Security Scanner (`src/scanners/python_scanner.py`) -- **Bandit Integration**: Scans Python code for security vulnerabilities - - SQL injection detection - - Weak cryptography usage - - Unsafe function calls - - Subprocess security - - 60+ security rules with detailed remediation guidance - -- **Safety Integration**: Scans Python dependencies for known CVEs - - Supports Safety 3.x with graceful API key handling - - Fallback warnings for authentication requirements - - CVE detection and reporting - -#### 2. Rule Exclusion System -- Added `exclude_rules` configuration for all scanners -- Per-tool granular control (e.g., `bandit: ["B404", "B603"]`) -- Supports false positive suppression and known exceptions -- Configured in `config/config.yaml` under `tools..exclude_rules` - -#### 3. Path Exclusion System -- Added `excluded_paths` configuration for repository scanning -- Excludes test directories, fixtures, and other non-production code -- Reduces false positives from intentionally vulnerable test files -- Configured in `config/config.yaml` under `repository.excluded_paths` -- Implements both command-line flags (tfsec, checkov, trivy, bandit) and post-processing filters (terraform-fmt, tflint) - -### Security Improvements - -#### Fixed Vulnerabilities -1. **B324 (HIGH)**: Added `usedforsecurity=False` to MD5 hash in `report_aggregator.py` - - MD5 used for deduplication only, not cryptographic security - -2. **B108 (MEDIUM x2)**: Replaced hardcoded `/tmp` path with `tempfile` module in `secrets_scanner.py` - - Secure temporary file creation - - Proper cleanup with try/finally - -#### Excluded False Positives (Documented Justifications) -- **B404/B603**: subprocess module usage - Required for tool orchestration, used safely with `shell=False` -- **B110/B112**: Try/Except patterns - Safe error handling in config/file detection -- **DS014**: wget and curl - Both needed (wget for binaries, curl for AWS CLI) -- **DS026**: No HEALTHCHECK - Not applicable for CLI tool container -- **terraform_required_version**: No production Terraform code in repository - -#### Result -- **Before**: 56 findings (CRITICAL: 3, HIGH: 19, MEDIUM: 20, LOW: 14) -- **After**: 0 findings ✅ - -### Docker Improvements -- Container now runs as non-root user (scanner:1000) for security -- All tools verified to work under non-privileged user -- Resolves DS002 (Docker root user) security finding - -### Configuration Updates -- Added Python scanner configuration with rule exclusions -- Added Terraform scanner rule exclusions -- Added repository path exclusions for tests/fixtures -- Updated config.yaml with comprehensive examples and documentation - -### Documentation Updates - -#### README.md -- Added Python scanning section with Bandit and Safety -- Added Rule Exclusions section with examples -- Added Path Exclusions section with configuration -- Updated architecture diagram to include Python scanner -- Updated feature list to reflect 17+ tools -- Updated file structure to show `python_scanner.py` -- Updated roadmap checkboxes for completed features -- Added Bandit and Safety to acknowledgments - -#### CLAUDE.md -- Updated scanner categories to include Python scanner -- Added security best practices notes -- Updated exit codes documentation -- Added rule and path exclusion documentation - -### Code Quality -- All scanners now support path exclusions via base class method -- Centralized exclusion filtering in `scanner_base.py` -- Consistent error handling across all scanners -- Proper resource cleanup (temp files) - -### Testing -- Self-scan of sdlc-code-scanner codebase: **0 findings** (100% clean) -- All 10 initial findings remediated or properly excluded -- Test directories excluded from production scans - -## Files Changed - -### New Files -- `src/scanners/python_scanner.py` - Python security scanner implementation - -### Modified Files -- `config/config.yaml` - Added Python scanner config, rule exclusions, path exclusions -- `src/main.py` - Registered Python scanner -- `src/repo_detector.py` - Added Python detection, path exclusion filtering -- `src/scanner_base.py` - Added exclusion helper methods -- `src/scanners/terraform_scanner.py` - Added path exclusions support -- `src/scanners/cloudformation_scanner.py` - Added path exclusions support -- `src/scanners/secrets_scanner.py` - Fixed temp file security (B108) -- `src/report_aggregator.py` - Fixed MD5 security (B324) -- `.gitignore` - Added scan artifacts exclusions -- `README.md` - Comprehensive documentation updates -- `CLAUDE.md` - Development guide updates - -## Technical Details - -### Python Scanner Implementation -```python -# Bandit with path exclusions -cmd = ["bandit", "-r", path, "-f", "json", "--quiet"] -excluded_paths = self.get_excluded_paths() -if excluded_paths: - cmd.extend(["--exclude", ",".join(excluded_paths)]) - -# Safety with version compatibility -# Handles both Safety 2.x and 3.x with graceful fallback -returncode, stdout, stderr = self.execute_command( - ["safety", "scan", "--target", str(req_file), "--output", "json"], - cwd=path -) -``` - -### Security Fixes Applied -```python -# MD5 for deduplication (not security) -hashlib.md5(hash_input.encode(), usedforsecurity=False).hexdigest() - -# Secure temp file handling -with tempfile.NamedTemporaryFile(mode='w+', suffix='.json', delete=False) as temp_report: - report_path = temp_report.name -try: - # use report_path -finally: - os.unlink(report_path) -``` - -## Migration Notes -- No breaking changes -- Existing scans will now include Python security analysis -- Configure `exclude_rules` to suppress unwanted findings -- Configure `excluded_paths` to skip test directories - -## Future Enhancements -- npm/Node.js dependency scanning -- CDK scanning implementation -- SARIF output format -- Custom policy definitions - ---- - -**Self-Scan Result**: ✅ 0 security findings -**Docker Build**: ✅ Success -**All Scanners**: ✅ Operational -**Documentation**: ✅ Updated diff --git a/Dockerfile b/Dockerfile index d746afb..9783061 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,11 +1,11 @@ -# SDLC Code Scanner - Multi-stage Dockerfile +# Portfolio Code Scanner - Multi-stage Dockerfile # Installs all IaC security scanning tools in a single container # Compatible with GitHub Actions FROM python:3.11-slim as base # GitHub Actions labels -LABEL org.opencontainers.image.source="https://github.com/crofton-cloud/sdlc-code-scanner" +LABEL org.opencontainers.image.source="https://github.com/williambrady/portfolio-code-scanner" LABEL org.opencontainers.image.description="Security scanner for AWS Infrastructure-as-Code" LABEL org.opencontainers.image.licenses="PolyForm-Noncommercial-1.0.0" @@ -68,7 +68,7 @@ RUN wget -q https://github.com/aquasecurity/tfsec/releases/download/v${TFSEC_VER # ======================================== # Install Trivy # ======================================== -ARG TRIVY_VERSION=0.48.3 +ARG TRIVY_VERSION=0.69.3 RUN wget -q https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz && \ tar zxvf trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz && \ mv trivy /usr/local/bin/ && \ diff --git a/LICENSE b/LICENSE index 1500044..b2406e5 100644 --- a/LICENSE +++ b/LICENSE @@ -34,7 +34,7 @@ URL for them above, as well as copies of any plain-text lines beginning with `Required Notice:` that the licensor provided with the software. For example: -> Required Notice: Copyright Crofton Cloud (https://crofton.cloud) +> Required Notice: Copyright William Brady (https://github.com/williambrady) ## Changes and New Works License @@ -131,6 +131,6 @@ of your licenses. --- -Required Notice: Copyright (c) 2026 Crofton Cloud (https://crofton.cloud) +Required Notice: Copyright (c) 2026 William Brady (https://github.com/williambrady) -For licensing inquiries, contact: licensing@crofton.cloud +For licensing inquiries, visit: https://github.com/williambrady diff --git a/README.md b/README.md index c7d53c1..4cd8674 100644 --- a/README.md +++ b/README.md @@ -1,11 +1,11 @@ -# SDLC Code Scanner +# Portfolio Code Scanner > Comprehensive security assessment tool for AWS Infrastructure-as-Code -[![GitHub Action](https://img.shields.io/badge/GitHub%20Action-available-2088FF?logo=github-actions&logoColor=white)](https://github.com/marketplace/actions/sdlc-code-scanner) +[![GitHub Action](https://img.shields.io/badge/GitHub%20Action-available-2088FF?logo=github-actions&logoColor=white)](https://github.com/marketplace/actions/portfolio-code-scanner) [![License](https://img.shields.io/badge/License-PolyForm%20Noncommercial-blue.svg)](LICENSE) -SDLC Code Scanner is a Docker-based security scanning platform that orchestrates multiple industry-leading security tools to provide comprehensive analysis of your AWS infrastructure code. It implements a multi-layered security scanning approach covering linting, security policies, dependency vulnerabilities, and secrets detection. +Portfolio Code Scanner is a Docker-based security scanning platform that orchestrates multiple industry-leading security tools to provide comprehensive analysis of your AWS infrastructure code. It implements a multi-layered security scanning approach covering linting, security policies, dependency vulnerabilities, and secrets detection. **Available as a GitHub Action for seamless CI/CD integration!** @@ -58,7 +58,7 @@ SDLC Code Scanner is a Docker-based security scanning platform that orchestrates ### GitHub Action (Recommended) -The easiest way to use SDLC Code Scanner is as a GitHub Action: +The easiest way to use Portfolio Code Scanner is as a GitHub Action: ```yaml name: Security Scan @@ -71,8 +71,8 @@ jobs: steps: - uses: actions/checkout@v4 - - name: Run SDLC Code Scanner - uses: crofton-cloud/sdlc-code-scanner@v1 + - name: Run Portfolio Code Scanner + uses: williambrady/portfolio-code-scanner@v1 with: scan-path: '.' fail-on-severity: 'HIGH' @@ -87,13 +87,13 @@ See [GitHub Action Usage](#github-action) for full documentation. ### Build the Docker Image ```bash -docker build -t sdlc-code-scanner:latest . +docker build -t portfolio-code-scanner:latest . ``` Or use the pre-built image (if available): ```bash -docker pull croftoncloud/sdlc-code-scanner:latest +docker pull williambrady/portfolio-code-scanner:latest ``` ### Basic Usage @@ -104,7 +104,7 @@ Scan a local repository: docker run --rm \ -v /path/to/your/repo:/repo:ro \ -v $(pwd)/reports:/app/reports \ - sdlc-code-scanner:latest \ + portfolio-code-scanner:latest \ scan-local --repo-path /repo ``` @@ -124,7 +124,7 @@ Scan your IaC code for security issues: docker run --rm \ -v /path/to/repo:/repo:ro \ -v $(pwd)/reports:/app/reports \ - sdlc-code-scanner:latest \ + portfolio-code-scanner:latest \ scan-local \ --repo-path /repo \ --output-dir /app/reports \ @@ -141,7 +141,7 @@ docker run --rm \ ### List Available Tools ```bash -docker run --rm sdlc-code-scanner:latest list-tools +docker run --rm portfolio-code-scanner:latest list-tools ``` ### Validate Configuration (Planned) @@ -149,7 +149,7 @@ docker run --rm sdlc-code-scanner:latest list-tools ```bash docker run --rm \ -v $(pwd)/config:/app/config:ro \ - sdlc-code-scanner:latest \ + portfolio-code-scanner:latest \ validate-config ``` @@ -321,7 +321,7 @@ Documentation-ready format with: ## GitHub Action -SDLC Code Scanner is available as a GitHub Action for seamless CI/CD integration with GitHub Code Scanning support. +Portfolio Code Scanner is available as a GitHub Action for seamless CI/CD integration with GitHub Code Scanning support. ### Basic Usage @@ -340,8 +340,8 @@ jobs: steps: - uses: actions/checkout@v4 - - name: Run SDLC Code Scanner - uses: crofton-cloud/sdlc-code-scanner@v1 + - name: Run Portfolio Code Scanner + uses: williambrady/portfolio-code-scanner@v1 with: scan-path: '.' fail-on-severity: 'HIGH' @@ -394,9 +394,9 @@ jobs: steps: - uses: actions/checkout@v4 - - name: Run SDLC Code Scanner + - name: Run Portfolio Code Scanner id: scan - uses: crofton-cloud/sdlc-code-scanner@v1 + uses: williambrady/portfolio-code-scanner@v1 with: scan-path: '.' output-formats: 'json,html,sarif' @@ -414,7 +414,7 @@ jobs: if: always() with: name: security-reports - path: .sdlc-code-scanner-reports/ + path: .portfolio-code-scanner-reports/ retention-days: 30 - name: Check scan results @@ -428,7 +428,7 @@ jobs: ```yaml - name: Scan only infrastructure directory - uses: crofton-cloud/sdlc-code-scanner@v1 + uses: williambrady/portfolio-code-scanner@v1 with: scan-path: 'infrastructure/terraform' fail-on-severity: 'MEDIUM' @@ -438,16 +438,16 @@ jobs: ```yaml - name: Scan with custom config - uses: crofton-cloud/sdlc-code-scanner@v1 + uses: williambrady/portfolio-code-scanner@v1 with: - config-path: '.github/sdlc-code-scanner-config.yaml' + config-path: '.github/portfolio-code-scanner-config.yaml' ``` ### Don't Fail on Findings ```yaml - name: Scan without failing - uses: crofton-cloud/sdlc-code-scanner@v1 + uses: williambrady/portfolio-code-scanner@v1 with: fail-on-severity: 'NONE' ``` @@ -458,7 +458,7 @@ Build and scan Docker images from Dockerfiles found in the repository: ```yaml - name: Scan with container image scanning - uses: crofton-cloud/sdlc-code-scanner@v1 + uses: williambrady/portfolio-code-scanner@v1 with: build-container-images: 'true' fail-on-severity: 'HIGH' @@ -479,7 +479,7 @@ security-scan: - docker run --rm -v $CI_PROJECT_DIR:/repo:ro -v $CI_PROJECT_DIR/reports:/app/reports - sdlc-code-scanner:latest + portfolio-code-scanner:latest scan-local --repo-path /repo --format json artifacts: paths: @@ -494,8 +494,8 @@ security-scan: repos: - repo: local hooks: - - id: sdlc-code-scanner - name: SDLC Code Scanner + - id: portfolio-code-scanner + name: Portfolio Code Scanner entry: ./scripts/run-local-scan.sh language: script pass_filenames: false @@ -543,7 +543,7 @@ repos: ``` ┌─────────────────────────────────────────────────────────────┐ -│ SDLC Code Scanner │ +│ Portfolio Code Scanner │ ├─────────────────────────────────────────────────────────────┤ │ │ │ ┌──────────────┐ ┌─────────────────────────┐ │ @@ -588,7 +588,7 @@ repos: ## File Structure ``` -sdlc-code-scanner/ +portfolio-code-scanner/ ├── .github/ │ └── workflows/ │ ├── ci.yml # CI workflow for this repo @@ -715,7 +715,7 @@ This project is licensed under the terms specified in [LICENSE](LICENSE). ## Support -- **Issues**: Report bugs or request features via [GitHub Issues](https://github.com/croftoncloud/sdlc-code-scanner/issues) +- **Issues**: Report bugs or request features via [GitHub Issues](https://github.com/williambrady/portfolio-code-scanner/issues) - **Documentation**: See [docs/](docs/) for detailed guides - **CLAUDE.md**: For development with Claude Code diff --git a/action.yml b/action.yml index d9cb342..b8898e9 100644 --- a/action.yml +++ b/action.yml @@ -1,6 +1,6 @@ -name: 'SDLC Code Scanner' +name: 'Portfolio Code Scanner' description: 'Security scanner for AWS Infrastructure-as-Code (Terraform, CloudFormation, CDK) with multi-tool analysis' -author: 'Crofton Cloud' +author: 'William Brady' branding: icon: 'shield' diff --git a/build.md b/build.md index fc7c6fc..fb40a41 100644 --- a/build.md +++ b/build.md @@ -1,6 +1,6 @@ -# SDLC Code Scanner - Build Steps +# Portfolio Code Scanner - Build Steps -This document enumerates all steps required to build the SDLC Code Scanner system as defined in `plan.md`. +This document enumerates all steps required to build the Portfolio Code Scanner system as defined in `plan.md`. --- @@ -517,4 +517,3 @@ tar xzf gitleaks_X.X.X_linux_x64.tar.gz && mv gitleaks /usr/local/bin/ - [x] Environment variables properly passed and used - [x] Error handling works for all failure scenarios - [x] Performance acceptable for typical repositories - diff --git a/config/config.yaml b/config/config.yaml index b41c01f..56e1973 100644 --- a/config/config.yaml +++ b/config/config.yaml @@ -1,10 +1,10 @@ -# SDLC Code Scanner Configuration +# Portfolio Code Scanner Configuration # Docker Configuration docker: base_image: "python:3.11-slim" dockerfile_path: "./Dockerfile" - container_name: "sdlc-code-scanner" + container_name: "portfolio-code-scanner" working_dir: "/app" # Repository Scanning Configuration @@ -184,7 +184,7 @@ execution: # Logging Configuration logging: level: "INFO" # DEBUG, INFO, WARNING, ERROR, CRITICAL - file: "/app/logs/sdlc-code-scanner.log" + file: "/app/logs/portfolio-code-scanner.log" console: true format: "%(asctime)s - %(name)s - %(levelname)s - %(message)s" diff --git a/entrypoint.sh b/entrypoint.sh index f35df7a..c56c1be 100644 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -1,5 +1,5 @@ #!/bin/bash -# GitHub Action entrypoint script for SDLC Code Scanner +# GitHub Action entrypoint script for Portfolio Code Scanner set -e # ============================================================================= @@ -18,13 +18,13 @@ VERBOSE="${INPUT_VERBOSE:-false}" # GitHub-specific paths GITHUB_WORKSPACE="${GITHUB_WORKSPACE:-/github/workspace}" -REPORT_DIR="${GITHUB_WORKSPACE}/.sdlc-code-scanner-reports" +REPORT_DIR="${GITHUB_WORKSPACE}/.portfolio-code-scanner-reports" # Create report directory with permission handling # GitHub Actions workspace may have restrictive permissions create_fallback_report_dir() { echo "::warning::Using /tmp for reports due to workspace permission issues" - REPORT_DIR="/tmp/.sdlc-code-scanner-reports" + REPORT_DIR="/tmp/.portfolio-code-scanner-reports" mkdir -p "$REPORT_DIR" # Copy reports to workspace at the end if possible FALLBACK_REPORT_DIR="true" @@ -78,7 +78,7 @@ add_step_summary() { # ============================================================================= echo "==============================================" -echo "SDLC Code Scanner - GitHub Action" +echo "Portfolio Code Scanner - GitHub Action" echo "==============================================" echo "" @@ -229,7 +229,7 @@ log_end_group log_info "Generating Summary" -add_step_summary "# SDLC Code Scanner Security Scan Results" +add_step_summary "# Portfolio Code Scanner Security Scan Results" add_step_summary "" add_step_summary "## Summary" add_step_summary "" @@ -365,7 +365,7 @@ log_end_group add_step_summary "" add_step_summary "---" -add_step_summary "*Generated by [SDLC Code Scanner](https://github.com/crofton-cloud/sdlc-code-scanner)*" +add_step_summary "*Generated by [Portfolio Code Scanner](https://github.com/williambrady/portfolio-code-scanner)*" log_end_group @@ -390,7 +390,7 @@ fi # If we used fallback report directory, try to copy reports to workspace if [[ "${FALLBACK_REPORT_DIR:-}" == "true" ]]; then - WORKSPACE_REPORT_DIR="${GITHUB_WORKSPACE}/.sdlc-code-scanner-reports" + WORKSPACE_REPORT_DIR="${GITHUB_WORKSPACE}/.portfolio-code-scanner-reports" if mkdir -p "$WORKSPACE_REPORT_DIR" 2>/dev/null; then # Attempt to copy reports and verify success if cp -r "$REPORT_DIR"/* "$WORKSPACE_REPORT_DIR"/ 2>/dev/null; then @@ -399,7 +399,7 @@ if [[ "${FALLBACK_REPORT_DIR:-}" == "true" ]]; then if [[ "$COPIED_FILES" -gt 0 ]]; then echo "Reports copied to workspace: $WORKSPACE_REPORT_DIR ($COPIED_FILES files)" # Update output to point to workspace location (relative path) - set_output "report-path" ".sdlc-code-scanner-reports" + set_output "report-path" ".portfolio-code-scanner-reports" SARIF_IN_WORKSPACE=$(find "$WORKSPACE_REPORT_DIR" -name "*.sarif" -type f | head -1) if [[ -f "$SARIF_IN_WORKSPACE" ]]; then RELATIVE_SARIF="${SARIF_IN_WORKSPACE#$GITHUB_WORKSPACE/}" diff --git a/scripts/run-local-scan.sh b/scripts/run-local-scan.sh index f0695e0..379bd0f 100644 --- a/scripts/run-local-scan.sh +++ b/scripts/run-local-scan.sh @@ -1,5 +1,5 @@ #!/bin/bash -# SDLC Code Scanner - Local Repository Scan +# Portfolio Code Scanner - Local Repository Scan # Usage: ./scripts/run-local-scan.sh /path/to/repo set -e @@ -8,7 +8,7 @@ REPO_PATH="${1:-.}" OUTPUT_DIR="${2:-./reports}" CONFIG_FILE="${3:-./config/config.yaml}" -echo "SDLC Code Scanner - Local Repository Scan" +echo "Portfolio Code Scanner - Local Repository Scan" echo "========================================" echo "Repository: $REPO_PATH" echo "Output: $OUTPUT_DIR" @@ -39,7 +39,7 @@ docker run --rm \ -v "$(realpath "$REPO_PATH"):/repo:ro" \ -v "$(realpath "$OUTPUT_DIR"):/app/reports" \ -v "$(realpath "$CONFIG_FILE"):/app/config/config.yaml:ro" \ - sdlc-code-scanner:latest \ + portfolio-code-scanner:latest \ scan-local \ --repo-path /repo \ --output-dir /app/reports \ diff --git a/src/__init__.py b/src/__init__.py index 30018de..1c5446e 100644 --- a/src/__init__.py +++ b/src/__init__.py @@ -1,4 +1,4 @@ -"""SDLC Code Scanner - Security scanning tool for AWS IaC""" +"""Portfolio Code Scanner - Security scanning tool for AWS IaC""" __version__ = "0.1.0" -__author__ = "Crofton Cloud" +__author__ = "William Brady" diff --git a/src/formatters/html_formatter.py b/src/formatters/html_formatter.py index 10009e6..dc1fe3c 100644 --- a/src/formatters/html_formatter.py +++ b/src/formatters/html_formatter.py @@ -39,7 +39,7 @@ def _generate_html(self, report_data: Dict[str, Any]) -> str: - SDLC Code Scanner - Scan Report + Portfolio Code Scanner - Scan Report