Package: cycode
Cycode CLI User GuideThe Cycode Command Line Interface (CLI) is an application you can install on your local machine which can scan your locally stored repositories for any secrets or infrastructure as code misconfigurations.This guide will guide you through both installation and usage.Table of ContentsPrerequisitesInstallationInstall Cycode CLIUsing the Auth CommandUsing the Configure CommandAdd to Environment VariablesOn Unix/LinuxOn WindowsInstall Pre-Commit HookCycode CommandScan CommandRunning a ScanRepository ScanBranch OptionMonitor OptionReport OptionPackage Vulnerabilities ScanLicense Compliance OptionSeverity ThresholdPath ScanTerraform Plan ScanCommit History ScanCommit Range OptionPre-Commit ScanScan ResultsShow/Hide SecretsSoft FailExample Scan ResultsSecrets Result ExampleIaC Result ExampleSCA Result ExampleSAST Result ExampleCompany’s Custom Remediation GuidelinesIgnoring Scan ResultsIgnoring a Secret ValueIgnoring a Secret SHA ValueIgnoring a PathIgnoring a Secret, IaC, or SCA RuleIgnoring a PackageIgnoring using config fileReport commandGenerating SBOM ReportSyntax HelpPrerequisitesThe Cycode CLI application requires Python version 3.7 or later.Use thecycode authcommandto authenticate to Cycode with the CLIAlternatively, you can obtain a Cycode Client ID and Client Secret Key by following the steps detailed in theService Account TokenandPersonal Access Tokenpages, which contain details on obtaining these values.InstallationThe following installation steps are applicable to both Windows and UNIX / Linux operating systems.[!NOTE]
The following steps assume the use ofpython3andpip3for Python-related commands; however, some systems may instead use thepythonandpipcommands, depending on your Python environment’s configuration.Install Cycode CLITo install the Cycode CLI application on your local machine, perform the following steps:Open your command line or terminal application.Execute one of the following commands:pip3 install cycode- to install from PyPIbrew install cycode- to install from HomebrewNavigate to the top directory of the local repository you wish to scan.There are three methods to set the Cycode client ID and client secret:cycode auth(Recommended)cycode configureAdd them to yourenvironment variablesUsing the Auth Command[!NOTE]
This is therecommendedmethod for setting up your local machine to authenticate with Cycode CLI.Type the following command into your terminal/command line window:cycode authA browser window will appear, asking you to log into Cycode (as seen below):Enter your login credentials on this page and log in.You will eventually be taken to the page below, where you'll be asked to choose the business group you want to authorize Cycode with (if applicable):[!NOTE]
This will be the default method for authenticating with the Cycode CLI.Click theAllowbutton to authorize the Cycode CLI on the selected business group.Once completed, you'll see the following screen, if it was selected successfully:In the terminal/command line screen, you will see the following when exiting the browser window:SuccessfullyloggedintocycodeUsing the Configure Command[!NOTE]
If you already set up your Cycode Client ID and Client Secret through the Linux or Windows environment variables, those credentials will take precedent over this method.Type the following command into your terminal/command line window:cycode configureEnter your Cycode API URL value (you can leave blank to use default value).CycodeAPIURL[https://api.cycode.com]:https://api.onpremise.comEnter your Cycode APP URL value (you can leave blank to use default value).CycodeAPPURL[https://app.cycode.com]:https://app.onpremise.comEnter your Cycode Client ID value.CycodeClientID[]:7fe5346b-xxxx-xxxx-xxxx-55157625c72dEnter your Cycode Client Secret value.CycodeClientSecret[]:c1e24929-xxxx-xxxx-xxxx-8b08c1839a2eIf the values were entered successfully, you'll see the following message:SuccessfullyconfiguredCLIcredentials!or/andSuccessfullyconfiguredCycodeURLs!If you go into the.cycodefolder under your user folder, you'll find these credentials were created and placed in thecredentials.yamlfile in that folder.
And the URLs were placed in theconfig.yamlfile in that folder.Add to Environment VariablesOn Unix/Linux:exportCYCODE_CLIENT_ID={yourCycodeID}exportCYCODE_CLIENT_SECRET={yourCycodeSecretKey}On WindowsFrom the Control Panel, navigate to the System menu:Next, click Advanced system settings:In the System Properties window that opens, click the Environment Variables button:CreateCYCODE_CLIENT_IDandCYCODE_CLIENT_SECRETvariables with values matching your ID and Secret Key, respectively:Insert the cycode.exe into the path to complete the installation.Install Pre-Commit HookCycode’s pre-commit hook can be set up within your local repository so that the Cycode CLI application will identify any issues with your code automatically before you commit it to your codebase.Perform the following steps to install the pre-commit hook:Install the pre-commit framework:pip3 install pre-commitNavigate to the top directory of the local repository you wish to scan.Create a new YAML file named.pre-commit-config.yaml(include the beginning.) in the repository’s top directory that contains the following:repos:-repo:https://github.com/cycodehq/cycode-clirev:v1.4.0hooks:-id:cycodestages:-commitInstall Cycode’s hook:pre-commit install[!NOTE]
A successful hook installation will result in the message:Pre-commit installed at .git/hooks/pre-commitCycode CLI CommandsThe following are the options and commands available with the Cycode CLI application:OptionDescription-o,--output [text|json|table]Specify the output (text/json/table). The default istext.-v,--verboseShow detailed logs.--helpShow options for given command.CommandDescriptionauthAuthenticates your machine to associate CLI with your Cycode account.configureInitial command to authenticate your CLI client with Cycode using client ID and client secret.ignoreIgnore a specific value, path or rule ID.scanScan content for secrets/IaC/SCA/SAST violations. You need to specify which scan type:ci/commit_history/path/repository/etc.reportGenerate report for SCA SBOM.versionShow the version and exit.Scan CommandRunning a ScanThe Cycode CLI application offers several types of scans so that you can choose the option that best fits your case. The following are the current options and commands available:OptionDescription-t, --scan-type [secret|iac|sca|sast]Specify the scan you wish to execute (secret/iac/sca/sast), the default issecret--secret TEXTSpecify a Cycode client secret for this specific scan execution--client-id TEXTSpecify a Cycode client ID for this specific scan execution--show-secret BOOLEANShow secrets in plain text. SeeShow/Hide Secretssection for more details.--soft-fail BOOLEANRun scan without failing, always return a non-error status code. SeeSoft Failsection for more details.--severity-threshold [INFO|LOW|MEDIUM|HIGH|CRITICAL]Show only violations at the specified level or higher (supported for the SCA scan type only).--sca-scanSpecify the SCA scan you wish to execute (package-vulnerabilities/license-compliance). The default is both--monitorWhen specified, the scan results will be recorded in the knowledge graph. Please note that when working inmonitormode, the knowledge graph will not be updated as a result of SCM events (Push, Repo creation). (Supported for SCA scan type only).--reportWhen specified, a violations report will be generated. A URL link to the report will be printed as an output to the command execution--no-restoreWhen specified, Cycode will not run restore command. Will scan direct dependencies ONLY!--helpShow options for given command.CommandDescriptioncommit_historyScan all the commits history in this git repositorypathScan the files in the path supplied in the commandpre_commitUse this command to scan the content that was not committed yetrepositoryScan git repository including its historyRepository ScanA repository scan examines an entire local repository for any exposed secrets or insecure misconfigurations. This more holistic scan type looks at everything: the current state of your repository and its commit history. It will look not only for secrets that are currently exposed within the repository but previously deleted secrets as well.To execute a full repository scan, execute the following:cycode scan repository {{path}}For example, consider a scenario in which you want to scan your repository stored in~/home/git/codebase. You could then execute the following:cycode scan repository ~/home/git/codebaseThe following option is available for use with this command:OptionDescription-b, --branch TEXTBranch to scan, if not set scanning the default branchBranch OptionTo scan a specific branch of your local repository, add the argument-b(alternatively,--branch) followed by the name of the branch you wish to scan.Consider the previous example. If you wanted to only scan a branch nameddev, you could execute the following:cycode scan repository ~/home/git/codebase -b devor:cycode scan repository ~/home/git/codebase --branch devMonitor Option[!NOTE]
This option is only available to SCA scans.To push scan results tied to theSCA policiesfound in an SCA type scan to Cycode's knowledge graph, add the argument--monitorto the scan command.Consider the following example. The following command will scan the repository for SCA policy violations and push them to Cycode:cycode scan -t sca --monitor repository ~/home/git/codebaseor:cycode scan --scan-type sca --monitor repository ~/home/git/codebaseWhen using this option, the scan results from this scan will appear in the knowledge graph, which can be foundhere.[!WARNING]
You must be anowneror anadminin Cycode to view the knowledge graph page.Report Option[!NOTE]
This option is not available to IaC scans.To push scan results tied to theSCA policiesfound in the Repository scan to Cycode, add the argument--reportto the scan command.cycode scan -t sca --report repository ~/home/git/codebasecycode scan -t secret --report repository ~/home/git/codebaseor:cycode scan --scan-type sca --report repository ~/home/git/codebasecycode scan --scan-type secret --report repository ~/home/git/codebaseWhen using this option, the scan results from this scan will appear in the On-Demand Scans section of Cycode. To get to this page, click the link that appears after the printed results::warning:NOTEYou must be anowneror anadminin Cycode to view this page.The report page will look something like below:Package Vulnerabilities Option[!NOTE]
This option is only available to SCA scans.To scan a specific package vulnerability of your local repository, add the argument--sca-scan package-vulnerabilitiesfollowing the-t scaor--scan-type scaoption.Consider the previous example. If you wanted to only run an SCA scan on package vulnerabilities, you could execute the following:cycode scan -t sca --sca-scan package-vulnerabilities repository ~/home/git/codebaseor:cycode scan --scan-type sca --sca-scan package-vulnerabilities repository ~/home/git/codebaseLicense Compliance Option[!NOTE]
This option is only available to SCA scans.To scan a specific branch of your local repository, add the argument--sca-scan license-compliancefollowed by the name of the branch you wish to scan.Consider the previous example. If you wanted to only scan a branch nameddev, you could execute the following:cycode scan -t sca --sca-scan license-compliance repository ~/home/git/codebase -b devor:cycode scan --scan-type sca --sca-scan license-compliance repository ~/home/git/codebaseSeverity Threshold[!NOTE]
This option is only available to SCA scans.To limit the results of thescascan to a specific severity threshold, add the argument--severity-thresholdto the scan command.Consider the following example. The following command will scan the repository for SCA policy violations that have a severity of Medium or higher:cycode scan -t sca --security-threshold MEDIUM repository ~/home/git/codebaseor:cycode scan --scan-type sca --security-threshold MEDIUM repository ~/home/git/codebasePath ScanA path scan examines a specific local directory and all the contents within it, instead of focusing solely on a GIT repository.To execute a directory scan, execute the following:cycode scan path {{path}}For example, consider a scenario in which you want to scan the directory located at~/home/git/codebase. You could then execute the following:cycode scan path ~/home/git/codebaseTerraform Plan ScanCycode CLI supports Terraform plan scanning (supporting Terraform 0.12 and later)Terraform plan file must be in JSON format (having.jsonextension)How to generate a Terraform plan from Terraform configuration file?Initialize a working directory that contains Terraform configuration file:terraform initCreate Terraform execution plan and save the binary output:terraform plan -out={tfplan_output}Convert the binary output file into readable JSON:terraform show -json {tfplan_output} > {tfplan}.jsonScan your{tfplan}.jsonwith Cycode CLI:cycode scan -t iac path ~/PATH/TO/YOUR/{tfplan}.jsonCommit History ScanA commit history scan is limited to a local repository’s previous commits, focused on finding any secrets within the commit history, instead of examining the repository’s current state.To execute a commit history scan, execute the following:cycode scan commit_history {{path}}For example, consider a scenario in which you want to scan the commit history for a repository stored in~/home/git/codebase. You could then execute the following:cycode scan commit_history ~/home/git/codebaseThe following options are available for use with this command:OptionDescription-r, --commit_range TEXTScan a commit range in this git repository, by default cycode scans all commit history (example: HEAD~1)Commit Range OptionThe commit history scan, by default, examines the repository’s entire commit history, all the way back to the initial commit. You can instead limit the scan to a specific commit range by adding the argument--commit_rangefollowed by the name you specify.Consider the previous example. If you wanted to scan only specific commits on your repository, you could execute the following:cycode scan commit_history -r {{from-commit-id}}...{{to-commit-id}} ~/home/git/codebaseORcycode scan commit_history --commit_range {{from-commit-id}}...{{to-commit-id}} ~/home/git/codebasePre-Commit ScanA pre-commit scan automatically identifies any issues before you commit changes to your repository. There is no need to manually execute this scan; simply configure the pre-commit hook as detailed under the Installation section of this guide.After your install the pre-commit hook and, you may, on occasion, wish to skip scanning during a specific commit. Simply add the following to yourgitcommand to skip scanning for a single commit:SKIP=cycode git commit -m <your commit message>Scan ResultsEach scan will complete with a message stating if any issues were found or not.If no issues are found, the scan ends with the following success message:Good job! No issues were found!!! 👏👏👏If an issue is found, aFound issue of type:message appears upon completion instead:⛔Foundissueoftype:generic-password(ruleID:ce3a4de0-9dfc-448b-a004-c538cf8b4710)infile:config/my_config.py
SecretSHA:a44081db3296c84b82d12a35c446a3cba19411dddfa0380134c75f7b3973bff0⛔0|@@-0,0+1@@1|+my_password='h3l***********350'2|\NonewlineatendoffileIn the event an issue is found, review the file in question for the specific line highlighted by the result message. Implement any changes required to resolve the issue, then execute the scan again.Show/Hide SecretsIn the above example, a secret was found in the filesecret_test, located in the subfoldercli. The second part of the message shows the specific line the secret appears in, which in this case is a value assigned togoogleApiKey.Note how the above example obscures the actual secret value, replacing most of the secret with asterisks. Scans obscure secrets by default, but you may optionally disable this feature in order to view the full secret (assuming the machine you are viewing the scan result on is sufficiently secure from prying eyes).To disable secret obfuscation, add the--show-secretargument to any type of scan, then assign it a1value to show the full secret in the result message, or0to hide the secret (which is done by default).In the following example, a Path Scan is executed against theclisubdirectory with the option enabled to display any secrets found in full:cycode scan --show-secret=1 path ./cliThe result would then not be obfuscated:⛔Foundissueoftype:generic-password(ruleID:ce3a4de0-9dfc-448b-a004-c538cf8b4710)infile:config/my_config.py
SecretSHA:a44081db3296c84b82d12a35c446a3cba19411dddfa0380134c75f7b3973bff0⛔0|@@-0,0+1@@1|+my_password='h3110w0r1d!@#$350'2|\NonewlineatendoffileSoft FailUtilizing the soft fail feature will not fail the CI/CD step within the pipeline if the Cycode scan finds an issue. Additionally, in case an issue occurs from Cycode’s side, a soft fail will automatically execute to avoid interference.Add the--soft-failargument to any type of scan to configure this feature, then assign a value of1if you want found issues to result in a failure within the CI/CD tool or0for scan results to have no impact (result in asuccessresult).Example Scan ResultsSecrets Result Example⛔Foundissueoftype:generic-password(ruleID:ce3a4de0-9dfc-448b-a004-c538cf8b4710)infile:config/my_config.py
SecretSHA:a44081db3296c84b82d12a35c446a3cba19411dddfa0380134c75f7b3973bff0⛔0|@@-0,0+1@@1|+my_password='h3l***********350'2|\NonewlineatendoffileIaC Result Example⛔Foundissueoftype:Resourceshouldusenon-defaultnamespace(ruleID:bdaa88e2-5e7c-46ff-ac2a-29721418c59c)infile:./k8s/k8s.yaml⛔7|name:secrets-file8|namespace:default9|resourceVersion:"4228"SCA Result Example⛔Foundissueoftype:Securityvulnerabilityinpackage'pyyaml'referencedinproject'Users/myuser/my-test-repo':ImproperInputValidationinPyYAML(ruleID:d003b23a-a2eb-42f3-83c9-7a84505603e5)infile:Users/myuser/my-test-repo/requirements.txt⛔1|PyYAML~=5.3.12|vyper==0.3.13|cleo==1.0.0a5SAST Result Example⛔Foundissueoftype:Detectedarequestusing'http://'.Thisrequestwillbeunencrypted,andattackerscouldlistenintotrafficonthenetworkandbeabletoobtainsensitiveinformation.Use'https://'instead.(ruleID:3fbbd34b-b00d-4415-b9d9-f861c076b9f2)infile:./requests.py⛔2|3|res=requests.get('http://example.com',timeout=1)4|print(res.content)Company’s Custom Remediation GuidelinesIf your company has set custom remediation guidelines in the relevant policy via the Cycode portal, you'll see a field for “Company Guidelines” that contains the remediation guidelines you added. Note that if you haven't added any company guideline, this field will not appear in the CLI tool.Ignoring Scan ResultsIgnore rules can be added to ignore specific secret values, specific SHA512 values, specific paths, and specific Cycode secret and IaC rule IDs. This will cause the scan to not alert these values. The ignore rules are written and saved locally in the./.cycode/config.yamlfile.:warning:WarningAdding values to be ignored should be done with careful consideration of the values, paths, and policies to ensure that the scans will pick up true positives.The following are the options available for thecycode ignorecommand:OptionDescription--by-value TEXTIgnore a specific value while scanning for secrets. SeeIgnoring a Secret Valuefor more details.--by-sha TEXTIgnore a specific SHA512 representation of a string while scanning for secrets. SeeIgnoring a Secret SHA Valuefor more details.--by-path TEXTAvoid scanning a specific path. Need to specify scan type. SeeIgnoring a Pathfor more details.--by-rule TEXTIgnore scanning a specific secret rule ID/IaC rule ID/SCA rule ID. SeeIgnoring a Secret or Iac Rulefor more details.--by-package TEXTIgnore scanning a specific package version while running an SCA scan. Expected pattern -name@version. SeeIgnoring a Packagefor more details.-t, --scan-type [secret|iac|sca|sast]Specify the scan you wish to execute (secret/iac/sca/sast), The default value issecret-g, --globalAdd an ignore rule and update it in the global.cycodeconfig fileIn the following example, a pre-commit scan runs and finds the following:⛔Foundissueoftype:generic-password(ruleID:ce3a4de0-9dfc-448b-a004-c538cf8b4710)infile:config/my_config.py
SecretSHA:a44081db3296c84b82d12a35c446a3cba19411dddfa0380134c75f7b3973bff0⛔0|@@-0,0+1@@1|+my_password='h3l***********350'2|\NonewlineatendoffileIf this is a value that is not a valid secret, then use thecycode ignorecommand to ignore the secret by its value, SHA value, specific path, or rule ID. If this is an IaC scan, then you can ignore that result by its path or rule ID.Ignoring a Secret ValueTo ignore a specific secret value, you will need to use the--by-valueflag. This will ignore the given secret value from all future scans. Use the following command to add a secret value to be ignored:cycode ignore --by-value {{secret-value}}In the example at the top of this section, the command to ignore a specific secret value is as follows:cycode ignore --by-value h3110w0r1d!@#$350In the example above, replace theh3110w0r1d!@#$350value with your non-masked secret value. See the Cycode scan options for details on how to see secret values in the scan results.Ignoring a Secret SHA ValueTo ignore a specific secret SHA value, you will need to use the--by-shaflag. This will ignore the given secret SHA value from all future scans. Use the following command to add a secret SHA value to be ignored:cycode ignore --by-sha {{secret-sha-value}}In the example at the top of this section, the command to ignore a specific secret SHA value is as follows:cycode ignore --by-sha a44081db3296c84b82d12a35c446a3cba19411dddfa0380134c75f7b3973bff0In the example above, replace thea44081db3296c84b82d12a35c446a3cba19411dddfa0380134c75f7b3973bff0value with your secret SHA value.Ignoring a PathTo ignore a specific path for either secret, IaC, or SCA scans, you will need to use the--by-pathflag in conjunction with the-t, --scan-typeflag (you must specify the scan type). This will ignore the given path from all future scans for the given scan type. Use the following command to add a path to be ignored:cycode ignore -t {{scan-type}} --by-path {{path}}ORcycode ignore --scan-type {{scan-type}} --by-path {{path}}In the example at the top of this section, the command to ignore a specific path for a secret is as follows:cycode ignore -t secret --by-path ~/home/my-repo/configIn the example above, replace the~/home/my-repo/configvalue with your path value.In the example at the top of this section, the command to ignore a specific path from IaC scans is as follows:cycode ignore -t iac --by-path ~/home/my-repo/configIn the example above, replace the~/home/my-repo/configvalue with your path value.In the example at the top of this section, the command to ignore a specific path from SCA scans is as follows:cycode ignore -t sca --by-path ~/home/my-repo/configIn the example above, replace the~/home/my-repo/configvalue with your path value.Ignoring a Secret, IaC, SCA, or SAST RuleTo ignore a specific secret, IaC, SCA, or SAST rule, you will need to use the--by-ruleflag in conjunction with the-t, --scan-typeflag (you must specify the scan type). This will ignore the given rule ID value from all future scans. Use the following command to add a rule ID value to be ignored:cycode ignore -t {{scan-type}} --by-rule {{rule-ID}}ORcycode ignore --scan-type {{scan-type}} --by-rule {{rule-ID}}In the example at the top of this section, the command to ignore the specific secret rule ID is as follows:cycode ignore --scan-type secret --by-rule ce3a4de0-9dfc-448b-a004-c538cf8b4710In the example above, replace thece3a4de0-9dfc-448b-a004-c538cf8b4710value with the rule ID you want to ignore.In the example at the top of this section, the command to ignore the specific IaC rule ID is as follows:cycode ignore --scan-type iac --by-rule bdaa88e2-5e7c-46ff-ac2a-29721418c59cIn the example above, replace thebdaa88e2-5e7c-46ff-ac2a-29721418c59cvalue with the rule ID you want to ignore.In the example at the top of this section, the command to ignore the specific SCA rule ID is as follows:cycode ignore --scan-type sca --by-rule dc21bc6b-9f4f-46fb-9f92-e4327ea03f6bIn the example above, replace thedc21bc6b-9f4f-46fb-9f92-e4327ea03f6bvalue with the rule ID you want to ignore.Ignoring a Package[!NOTE]
This option is only available to the SCA scans.To ignore a specific package in the SCA scans, you will need to use the--by-packageflag in conjunction with the-t, --scan-typeflag (you must specify thescascan type). This will ignore the given package, using the{{package_name}}@{{package_version}}formatting, from all future scans. Use the following command to add a package and version to be ignored:cycode ignore --scan-type sca --by-package {{package_name}}@{{package_version}}ORcycode ignore -t sca --by-package {{package_name}}@{{package_version}}In the example below, the command to ignore a specific SCA package is as follows:cycode ignore --scan-type sca --by-package pyyaml@5.3.1In the example above, replacepyyamlwith package name and5.3.1with the package version you want to ignore.Ignoring using config fileThe applied ignoring rules are stored in the configuration file calledconfig.yaml.
This file could be easily shared between developers or even committed to remote Git.
These files are always located in the.cycodefolder.
The folder starts with a dot (.), and you should enable the displaying of hidden files to see it.Path of the config filesBy default, allcycode ignorecommands save the ignoring rule to the current directory from which CLI has been run.Example: running ignoring CLI command from/Users/name/projects/backendwill createconfig.yamlin/Users/name/projects/backend/.cycode➜backendpwd/Users/name/projects/backend
➜backendcycodeignore--by-valuetest-value
➜backendtree-a
.
└──.cycode└──config.yaml2directories,1fileThe second option is to save ignoring rules to the global configuration files.
The path of the global config is~/.cycode/config.yaml,
where~means user`s home directory, for example,/Users/nameon macOS.Saving to the global space could be performed with the-gflag of thecycode ignorecommand.
For example:cycode ignore -g --by-value test-value.Proper working directoryThis is incredibly important to place the.cycodefolder and run CLI from the same place.
You should double-check it when working with different environments like CI/CD (GitHub Actions, Jenkins, etc.).You could commit the.cycodefolder to the root of your repository.
In this scenario, you must run CLI scans from the repository root.
If it doesn't fit your requirements, you could temporarily copy the.cycodefolder
wherever you want and perform a CLI scan from this folder.Structure ignoring rules in the configIt's important to understand how CLI stores ignore rules to be able to read these configuration files or even modify them without CLI.The abstract YAML structure:exclusions:*scanTypeName*:*ignoringType:-*ignoringValue1*-*ignoringValue2*Possible values ofscanTypeName:iac,sca,sast,secret.
Possible values ofignoringType:paths,values,rules,packages,shas.[!WARNING]Values for "ignore by value" are not stored as plain text!
CLI stores sha256 hashes of the values instead.
You should put hashes of the string when modifying the configuration file by hand.Example of realconfig.yaml:exclusions:iac:rules:-bdaa88e2-5e7c-46ff-ac2a-29721418c59csca:packages:-pyyaml@5.3.1secret:paths:-/Users/name/projects/buildrules:-ce3a4de0-9dfc-448b-a004-c538cf8b4710shas:-a44081db3296c84b82d12a35c446a3cba19411dddfa0380134c75f7b3973bff0values:-a665a45920422f9d417e4867efdc4fb8a04a1f3fff1fa07e998e86f7f7a27ae3-60303ae22b998861bce3b28f33eec1be758a213c86c93c076dbe9f558c11c752Report CommandGenerating SBOM ReportA software bill of materials (SBOM) is an inventory of all constituent components and software dependencies involved in the development and delivery of an application.
Using this command you can create an SBOM report for your local project or for your repository URI.The following options are available for use with this command:OptionDescriptionRequiredDefault-f, --format [spdx-2.2|spdx-2.3|cyclonedx-1.4]SBOM formatYes-o, --output-format [JSON]Specify the output file formatNojson--output-file PATHOutput fileNoautogenerated filename saved to the current directory--include-vulnerabilitiesInclude vulnerabilitiesNoFalse--include-dev-dependenciesInclude dev dependenciesNoFalseThe following commands are available for use with this command:CommandDescriptionpathGenerate SBOM report for provided path in the commandrepository_urlGenerate SBOM report for provided repository URI in the commandRepositoryTo create an SBOM report for a repository URI:cycode report sbom --format <sbom format> --include-vulnerabilities --include-dev-dependencies --output-file </path/to/file> repository_url <repository url>For example:cycode report sbom --format spdx-2.3 --include-vulnerabilities --include-dev-dependencies repository_url https://github.com/cycodehq/cycode-cli.gitLocal ProjectTo create an SBOM report for a path:cycode report sbom --format <sbom format> --include-vulnerabilities --include-dev-dependencies --output-file </path/to/file> path </path/to/project>For example:cycode report sbom --format spdx-2.3 --include-vulnerabilities --include-dev-dependencies path /path/to/local/projectSyntax HelpYou may add the--helpargument to any command at any time to see a help message that will display available options and their syntax.To see general help, simply enter the command:cycode --helpTo see scan options, enter:cycode scan --helpTo see the options available for a specific type of scan, enter:cycode scan {{option}} --helpFor example, to see options available for a Path Scan, you would simply enter:cycode scan path --helpTo see the options available for the ignore scan function, use this command:cycode ignore --helpTo see the options available for report, use this command:cycode report --helpTo see the options available for a specific type of report, enter:cycode scan {{option}} --help