CI/CD Security Scanner Wrapper

A Python script that wraps a dependency vulnerability scanner for use in continuous integration pipelines, providing proper exit codes, machine-readable output, and failure handling.

Requirements

Create a Python script that scans Python project dependencies for vulnerabilities and integrates seamlessly with CI/CD pipelines.

Core Functionality

The script must:

1. Scan a Python project for dependency vulnerabilities in the current directory
2. Generate machine-readable output suitable for automated processing
3. Return appropriate exit codes:
   • Exit with code 0 when no vulnerabilities are found
   • Exit with non-zero code when vulnerabilities are detected
4. Support non-blocking mode where the scan continues even when vulnerabilities are found, always exiting with code 0

Command-Line Interface

The script should accept the following command-line arguments:

• --output-format: Specify the output format (default: json)
• --non-blocking: When specified, the script should not fail the build even if vulnerabilities are found
• --target: Optional path to scan (default: current directory)

Output Requirements

• The output must be structured and parseable by CI/CD tools
• Include vulnerability details in the output when vulnerabilities are found
• Write output to stdout

Test Cases

Test 1: Scanning with vulnerabilities found { .test }

Given a project with vulnerable dependencies:

• The scanner should detect the vulnerabilities
• The scanner should exit with a non-zero exit code
• The output should be in the specified format and include vulnerability details

@test

Test 2: Non-blocking mode { .test }

Given a project with vulnerable dependencies and non-blocking mode enabled:

• The scanner should detect the vulnerabilities
• The scanner should exit with code 0 (success)
• The output should still include vulnerability details

@test

Test 3: Scanning with no vulnerabilities { .test }

Given a project with no vulnerable dependencies:

• The scanner should complete successfully
• The scanner should exit with code 0
• The output should indicate no vulnerabilities were found

@test

Implementation

@generates

API

import sys
import argparse

def scan_dependencies(target_path: str, output_format: str, non_blocking: bool) -> dict:
    """
    Scans dependencies for vulnerabilities.

    Args:
        target_path: Path to the project directory to scan
        output_format: Format for output (e.g., 'json')
        non_blocking: If True, always return success exit code

    Returns:
        Dictionary containing scan results
    """
    pass

def main():
    """
    Main entry point for the CI/CD scanner script.
    Parses arguments and executes the scan.
    """
    pass

if __name__ == "__main__":
    main()

Dependencies { .dependencies }

safety { .dependency }

Provides vulnerability scanning for Python dependencies.