@aikidosec/ci-api-client

Aikido Security CI client

This CLI tool can help integrate Aikido Security scans into any custom CI pipeline such as Jenkins, CircleCI,... If you are looking to add checks to a Github, Azure Repos,.. pull request, you do not need this package and you can use our native plugins.

Installation and setup

The quickest way to get started is to install the cli tool as a global package.

# npm users
$ npm install -g @aikidosec/ci-api-client

# yarn users
$ yarn global add @aikidosec/ci-api-client

After installation, you'll need to setup your Aikido API key. You can add your key by requesting a token on the Continuous Integrations page in the Integrations section of the Aikido web platform. Click the "Start integrating" link and setup your key globally by executing

$ aikido-api-client apikey <your-api-key-here>

⚠️ Your Aikido API key is stored in ~/.config/configstore/aikido-api-client.json. If you don't want this behaviour (e.g. for security related issues), you can also provide your API key to aikido-api-client by adding --apikey <your-api-key-here to every command. However, for the examples below, we'll assume you've used aikido-api-client apikey <your-api-key-here to save your API key. If --apikey is provided while a key is set in the configuration file on disk, the key that was provided with --apikey will be used.

Use case: release gating

The example below shows how to use the scan-release command. The use case here is to block a new build or a new release as long as issues are still open.

$ aikido-api-client scan-release <repository_id or repository_name> <commit_id>

Usage: Aikido API Client scan-release [options] <repository_id> <commit_id>
Run a release scan of an Aikido repo.
Arguments:
  repository_id                     The internal GitHub/Gitlab/Bitbucket/.. repository id you want to scan.
  commit_id                         The commit you want to scan
Options:
  --no-fail-on-dependency-scan      Don't fail when scanning depedencies. Default is to fail on new CVE
  --fail-on-sast-scan               Let Aikido fail when new static code analysis issues have been detected
  --fail-on-iac-scan                Let Aikido fail when new infrastructure as code issues have been detected
  --fail-on-secrets-scan            Let Aikido fail when new exposed secrets have been detected
  --minimum-severity-level <level>  Set the minimum severity level. Accepted options are: LOW, MEDIUM, HIGH and CRITICAL. (choices: "LOW", "MEDIUM",
                                    "HIGH", "CRITICAL")

--sla-mode Let Aikido only fail only on open issues that have gone out of SLA. -h, --help display help for command

## Use case: pull request checks & gating

The example below shows how to use the 'scan' command. The use case here is to add a red/green check to a pull request based on the difference in files (head vs base commit).

$ aikido-api-client scan <repositoryid or repositoryname <basecommitid <headcommitid

Usage: Aikido API Client scan [options] <repositoryid <basecommitid <headcommitid [branchname] Run a scan of an Aikido repo. Arguments: repositoryid The internal GitHub/Gitlab/Bitbucket/.. repository id you want to scan. basecommitid The base commit of the code you want to scan (e.g. the commit where you branched from for your PR or the initial commit of your repo) headcommitid The latest commit you want to include in your scan (e.g. the latest commit id of your pull request) branchname The branch name (default: "main") Options: --pull-request-title <title Your pull request title --pull-request-url <url Your pull request URL --self-managed-scanners <scanners... Set the minimum severity level. Accepted options are: LOW, MEDIUM, HIGH and CRITICAL. (choices: "checkov", "json-sbom") --expected-amount-json-sboms <amount The expected amount of json sbombs --no-fail-on-dependency-scan Don't fail when scanning depedencies. Default is to fail on new CVE --fail-on-sast-scan Let Aikido fail when new static code analysis issues have been detected --fail-on-iac-scan Let Aikido fail when new infrastructure as code issues have been detected --fail-on-secrets-scan Let Aikido fail when new exposed secrets have been detected --minimum-severity-level <level Set the minimum severity level. Accepted options are: LOW, MEDIUM, HIGH and CRITICAL. (choices: "LOW", "MEDIUM", "HIGH", "CRITICAL") --poll-interval [interval] The poll interval when checking for an updated scan result (preset: 5) --base-branch <branchname Optional: base branch for the release gated scan. -h, --help display help for command

## How it works

The CLI will spawn a cloud-based scan and then report scan progress. It will exit with exitCode `0` if the scan was successfull (`gate_passed: true`). The process will exit with exitCode `10` if the scan was unsuccesfull (`gate_passed: false`). If anything else goes wrong (e.g. API unavailable, scanning unavailable, other unexpected issue) the process will exit with exitCode `1`.

If you want the scan to run quietly (without output), you can add the `--quiet` option to the command.

Please note that the repository_id which you need to provide to the CLI is the unique ID of the Git provider you are using, not the ID of the repository in Aikido. You can also find this ID in Aikido, by going to the repository's detail page and clicking on the Git provider's icon in the header. Alternatively, you can pass the repository name as it is defined in Aikido.

For more options and combinations, check the help output