feat(staticanalysis): trivy mannifest scan command (#41)

* trivy mannifest scan command

* multiple manifest format supported

* mivor refactorings

Author: thelonewolf1603

.claude/settings.local.json

@@ -5,9 +5,14 @@
       "Bash(go fmt:*)",
       "Bash(go vet:*)",
       "Bash(go build:*)",
-      "Bash(chmod:*)"
+      "Bash(chmod:*)",
+      "Bash(grep -oE \"[^/]*Manifest[^/]*\\\\.toml$\")",
+      "Bash(rm -rf scantest)",
+      "Bash(mkdir -p scantest/multi scantest/single)",
+      "Bash(/home/ubuntu/jh/jh scan *)",
+      "Bash(gofmt -l scan.go main.go)"
     ],
     "deny": [],
     "ask": []
   }
-}
+}

CLAUDE.md

@@ -21,6 +21,7 @@ The application follows a command-line interface pattern using the Cobra library
 - **credentials.go**: Registry credential management (list, add, update, delete) with REST API integration
 - **landing.go**: Landing page management (show, update, remove) with REST API integration
 - **vuln.go**: Vulnerability scanning for Julia packages via REST API
+- **scan.go**: Trivy manifest scanning — discover and upload a Julia manifest (+ optional project file) and fetch results via the StaticAnalysis service. Manifest discovery recognizes every name Julia/Pkg accepts (`Manifest.toml`, `JuliaManifest.toml`, and version-specific `Manifest-v1.11.toml` / `JuliaManifest-v1.11.toml`); when a directory holds more than one, the user is prompted to select (defaults to the highest-precedence candidate). Project file is `Project.toml` or `JuliaProject.toml`
 - **git.go**: Git integration (clone, push, fetch, pull) with JuliaHub authentication
 - **julia.go**: Julia installation and management
 - **run.go**: Julia execution with JuliaHub configuration
@@ -62,6 +63,7 @@ The application follows a command-line interface pattern using the Cobra library
    - `jh admin credential delete`: Delete a credential — subcommands: `token`, `ssh`, `github-app`; takes positional identifier
    - `jh admin landing-page`: Landing page management (show/update/remove custom markdown landing page with REST API)
    - `jh vuln`: Vulnerability scanning for Julia packages (REST API; defaults to latest stable version via `GET /docs/<registry>/<package>/versions.json`; supports `--version` for a specific version, `--registry` to specify the registry for version lookup (default: General), `--advisory` to filter to a specific advisory ID, `--all` to show all advisories regardless of affected status, and `--verbose` for additional details)
+   - `jh scan`: Manifest vulnerability scanning via the StaticAnalysis service (REST API under `/api/v0/static_analysis/`); uploads a `Manifest.toml` (and sibling `Project.toml` unless `--no-project`) and POSTs to `/manifest/scan` to obtain a `run_uuid`; subcommands `status` and `results` hit `/manifest/scan/status/{run_uuid}` and `/results/manifest/{run_uuid}`; **polls by default** and prints results when the scan completes — Ctrl+C detaches and the `run_uuid` (printed up front) can be passed to `jh scan status` / `jh scan results` later. Pass `--no-wait` to submit-and-exit. `--csv` requests `text/csv` (content-negotiated via `Accept` header)
    - `jh clone`: Git clone with JuliaHub authentication and project name resolution
    - `jh push/fetch/pull`: Git operations with JuliaHub authentication
    - `jh git-credential`: Git credential helper for seamless authentication
@@ -229,6 +231,26 @@ go run . vuln MyPkg --registry MyRegistry
 go run . vuln SomePackage -s nightly.juliahub.dev
 ```
 
+### Test manifest scan operations
+```bash
+# Submit a scan for the current directory's Manifest.toml (+ sibling Project.toml);
+# polls until done by default. Ctrl+C detaches — the scan keeps running on the server.
+go run . scan
+
+# Scan a project directory (still polls until done)
+go run . scan ./my-project
+
+# Scan an explicit manifest, write CSV results to a file
+go run . scan Manifest.toml --project=Project.toml --csv --output results.csv
+
+# Submit and return immediately without polling
+go run . scan --no-wait
+
+# Check status / fetch results for an earlier run_uuid
+go run . scan status <run-uuid>
+go run . scan results <run-uuid> --csv
+```
+
 ### Test Git operations
 ```bash
 go run . clone john/my-project  # Clone from another user

README.md

@@ -13,6 +13,7 @@ A command-line interface for interacting with JuliaHub, a platform for Julia com
 - **Julia Integration**: Install Julia and run with JuliaHub package server configuration
 - **User Management**: Display user information, list users and groups
 - **Vulnerability Scanning**: Scan Julia packages for known security vulnerabilities
+- **Manifest Scanning**: Upload a `Manifest.toml` for a server-side Trivy vulnerability scan of its pinned dependencies
 - **Administrative Commands**: Manage users, groups, tokens, credentials, and system resources (requires admin permissions)
 
 ## Installation
@@ -266,6 +267,24 @@ echo '{"name":"MyToken","url":"https://github.com","value":"ghp_xxxx"}' | jh adm
   - Advisory IDs are clickable links to the JuliaLang SecurityAdvisories repository
   - Each advisory shows: severity scores, affected status, full summary, affected versions, and version ranges
 
+### Manifest Scanning (`jh scan`)
+
+- `jh scan [path]` - Upload a `Manifest.toml` (and the sibling `Project.toml` when present), queue a Trivy vulnerability scan, and (by default) poll until it finishes
+  - `path` may be a directory (looks for `Manifest.toml` and `Project.toml` inside) or a manifest file; defaults to the current directory
+  - `--project <path>` - Use an explicit `Project.toml` instead of the auto-detected sibling
+  - `--no-project` - Skip the `Project.toml` even if a sibling exists
+  - `--tool <id>` - Static analysis tool id (default: `juliahub-trivy`)
+  - `--no-wait` - Submit and return immediately, printing only the `run_uuid`
+  - `--csv` - Request results as CSV (negotiated via the `Accept` header; ignored with `--no-wait`)
+  - `--output <file>` / `-o` - Write the results to a file instead of stdout
+  - `--poll-interval <sec>` - Poll cadence while waiting (default: 3)
+  - `--timeout <sec>` - Max seconds to wait for the scan (default: 600)
+  - The `run_uuid` is printed up front, so Ctrl+C during polling leaves the scan running on the server; resume with `jh scan status` / `jh scan results`
+- `jh scan status <run-uuid>` - Show lifecycle status (`staging`, `initiated`, `queued`, `completed`, `failed`) plus tool/timing info and any failure reason
+- `jh scan results <run-uuid>` - Fetch results for a finished scan
+  - `--csv` - CSV output instead of JSON
+  - `--output <file>` / `-o` - Write to a file instead of stdout
+
 ### Update (`jh update`)
 
 - `jh update` - Check for updates and automatically install the latest version
@@ -483,6 +502,32 @@ jh vuln MyPkg --registry MyRegistry
 jh vuln SomePackage -s nightly.juliahub.dev
 ```
 
+### Manifest Scanning
+
+```bash
+# Scan the Manifest.toml + Project.toml in the current directory; polls until done
+jh scan
+
+# Scan the manifest from a specific project directory
+jh scan ./my-project
+
+# Use an explicit manifest file and override the Project.toml path
+jh scan Manifest.toml --project=Project.toml
+
+# Write CSV results to a file instead of JSON on stdout
+jh scan --csv --output results.csv
+
+# Submit the scan and return immediately (prints just the run_uuid)
+jh scan --no-wait
+
+# Check the status of an earlier scan (e.g. after Ctrl+C or --no-wait)
+jh scan status <run-uuid>
+
+# Pull results for a finished scan
+jh scan results <run-uuid>
+jh scan results <run-uuid> --csv --output results.csv
+```
+
 ### Git Workflow
 
 ```bash

main.go

@@ -4,8 +4,11 @@ import (
 	"bufio"
 	"fmt"
 	"os"
+	"os/signal"
 	"path/filepath"
 	"strings"
+	"syscall"
+	"time"
 
 	"github.com/spf13/cobra"
 )
@@ -734,6 +737,158 @@ Use --advisory to look up a specific advisory by ID.`,
 	},
 }
 
+var scanCmd = &cobra.Command{
+	Use:   "scan [path]",
+	Short: "Scan a Julia Manifest.toml for vulnerable dependencies",
+	Long: `Upload a Julia Manifest.toml (and optionally Project.toml) to JuliaHub
+and run a Trivy vulnerability scan against the pinned dependencies.
+
+If [path] is a directory, the manifest is discovered inside it. Every name
+Julia recognizes is detected — Manifest.toml, JuliaManifest.toml, and
+version-specific variants like Manifest-v1.11.toml — and if more than one is
+present you are prompted to pick one. A sibling project file (Project.toml or
+JuliaProject.toml) is included unless --no-project is set. If [path] is a file,
+it is treated as the manifest. Defaults to the current directory when [path]
+is omitted.
+
+By default the command submits the scan and polls until it finishes, then
+prints the results. The server-assigned run_uuid is printed up front, so
+you can interrupt with Ctrl+C at any time and resume later with:
+
+  jh scan status <run-uuid>
+  jh scan results <run-uuid>
+
+Pass --no-wait to submit the scan and return immediately. Use --csv to
+fetch results as CSV instead of JSON.`,
+	Example: `  jh scan
+  jh scan ./my-project
+  jh scan Manifest.toml --project=Project.toml
+  jh scan --no-wait
+  jh scan --csv --output results.csv`,
+	Args: cobra.MaximumNArgs(1),
+	Run: func(cmd *cobra.Command, args []string) {
+		server, err := getServerFromFlagOrConfig(cmd)
+		if err != nil {
+			fmt.Printf("Failed to get server config: %v\n", err)
+			os.Exit(1)
+		}
+
+		path := ""
+		if len(args) == 1 {
+			path = args[0]
+		}
+		projectOverride, _ := cmd.Flags().GetString("project")
+		noProject, _ := cmd.Flags().GetBool("no-project")
+		tool, _ := cmd.Flags().GetString("tool")
+		noWait, _ := cmd.Flags().GetBool("no-wait")
+		csv, _ := cmd.Flags().GetBool("csv")
+		output, _ := cmd.Flags().GetString("output")
+		pollSec, _ := cmd.Flags().GetInt("poll-interval")
+		timeoutSec, _ := cmd.Flags().GetInt("timeout")
+
+		inputs, err := resolveScanInputs(path, projectOverride, noProject)
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "%v\n", err)
+			os.Exit(1)
+		}
+		fmt.Fprintf(os.Stderr, "Uploading %s", inputs.ManifestPath)
+		if inputs.ProjectPath != "" {
+			fmt.Fprintf(os.Stderr, " (+ %s)", inputs.ProjectPath)
+		}
+		fmt.Fprintln(os.Stderr)
+
+		runUUID, err := submitManifestScan(server, tool, inputs)
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "%v\n", err)
+			os.Exit(1)
+		}
+
+		fmt.Fprintf(os.Stderr, "Submitted scan: %s\n", runUUID)
+
+		if noWait {
+			fmt.Println(runUUID)
+			return
+		}
+
+		// Trap Ctrl+C while polling so the user can leave the scan
+		// running on the server and reattach later via `jh scan status`
+		// / `jh scan results`.
+		sigChan := make(chan os.Signal, 1)
+		signal.Notify(sigChan, os.Interrupt, syscall.SIGTERM)
+		go func() {
+			<-sigChan
+			fmt.Fprintf(os.Stderr, "\nLeaving scan %s running on the server.\n", runUUID)
+			fmt.Fprintf(os.Stderr, "Check progress with:\n  jh scan status %s\n", runUUID)
+			fmt.Fprintf(os.Stderr, "Fetch results once complete with:\n  jh scan results %s\n", runUUID)
+			os.Exit(0)
+		}()
+
+		fmt.Fprintf(os.Stderr, "Polling for completion (Ctrl+C to detach)...\n")
+		_, err = pollManifestScanUntilDone(
+			server, runUUID,
+			time.Duration(pollSec)*time.Second,
+			time.Duration(timeoutSec)*time.Second,
+		)
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "%v\n", err)
+			os.Exit(1)
+		}
+
+		body, err := fetchManifestScanResults(server, runUUID, csv)
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "%v\n", err)
+			os.Exit(1)
+		}
+		if err := writeResultsOutput(body, output, csv); err != nil {
+			fmt.Fprintf(os.Stderr, "%v\n", err)
+			os.Exit(1)
+		}
+	},
+}
+
+var scanStatusCmd = &cobra.Command{
+	Use:   "status <run-uuid>",
+	Short: "Show status of a manifest scan",
+	Args:  cobra.ExactArgs(1),
+	Run: func(cmd *cobra.Command, args []string) {
+		server, err := getServerFromFlagOrConfig(cmd)
+		if err != nil {
+			fmt.Printf("Failed to get server config: %v\n", err)
+			os.Exit(1)
+		}
+		status, err := fetchManifestScanStatus(server, args[0])
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "%v\n", err)
+			os.Exit(1)
+		}
+		printManifestScanStatus(status)
+	},
+}
+
+var scanResultsCmd = &cobra.Command{
+	Use:   "results <run-uuid>",
+	Short: "Fetch results for a completed manifest scan",
+	Args:  cobra.ExactArgs(1),
+	Run: func(cmd *cobra.Command, args []string) {
+		server, err := getServerFromFlagOrConfig(cmd)
+		if err != nil {
+			fmt.Printf("Failed to get server config: %v\n", err)
+			os.Exit(1)
+		}
+		csv, _ := cmd.Flags().GetBool("csv")
+		output, _ := cmd.Flags().GetString("output")
+		body, err := fetchManifestScanResults(server, args[0], csv)
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "%v\n", err)
+			os.Exit(1)
+		}
+		if err := writeResultsOutput(body, output, csv); err != nil {
+			fmt.Fprintf(os.Stderr, "%v\n", err)
+			os.Exit(1)
+		}
+	},
+}
+
 var packageCmd = &cobra.Command{
 	Use:   "package",
 	Short: "Package search commands",
@@ -2328,6 +2483,19 @@ func init() {
 	vulnCmd.Flags().StringP("registry", "r", "General", "Registry name for version lookup")
 	vulnCmd.Flags().Bool("all", false, "Show all advisories regardless of affected status")
 	vulnCmd.Flags().BoolP("verbose", "v", false, "Show full advisory details (aliases, dates, details, references)")
+	scanCmd.Flags().StringP("server", "s", "juliahub.com", "JuliaHub server")
+	scanCmd.Flags().String("project", "", "Path to Project.toml (defaults to sibling of the manifest if present)")
+	scanCmd.Flags().Bool("no-project", false, "Skip Project.toml even if a sibling file exists")
+	scanCmd.Flags().StringP("tool", "t", "juliahub-trivy", "Static analysis tool id")
+	scanCmd.Flags().Bool("no-wait", false, "Submit the scan and return immediately, printing the run_uuid")
+	scanCmd.Flags().Bool("csv", false, "Fetch results as CSV instead of JSON (ignored with --no-wait)")
+	scanCmd.Flags().StringP("output", "o", "", "Write results to this file instead of stdout")
+	scanCmd.Flags().Int("poll-interval", 3, "Poll interval in seconds while waiting")
+	scanCmd.Flags().Int("timeout", 600, "Max seconds to wait for the scan to finish")
+	scanStatusCmd.Flags().StringP("server", "s", "juliahub.com", "JuliaHub server")
+	scanResultsCmd.Flags().StringP("server", "s", "juliahub.com", "JuliaHub server")
+	scanResultsCmd.Flags().Bool("csv", false, "Fetch results as CSV")
+	scanResultsCmd.Flags().StringP("output", "o", "", "Write results to this file instead of stdout")
 
 	authCmd.AddCommand(authLoginCmd, authRefreshCmd, authStatusCmd, authEnvCmd)
 	jobCmd.AddCommand(jobListCmd, jobStartCmd)
@@ -2371,8 +2539,9 @@ func init() {
 	juliaCmd.AddCommand(juliaInstallCmd)
 	runCmd.AddCommand(runSetupCmd)
 	gitCredentialCmd.AddCommand(gitCredentialHelperCmd, gitCredentialGetCmd, gitCredentialStoreCmd, gitCredentialEraseCmd, gitCredentialSetupCmd)
+	scanCmd.AddCommand(scanStatusCmd, scanResultsCmd)
 
-	rootCmd.AddCommand(authCmd, jobCmd, datasetCmd, projectCmd, packageCmd, registryCmd, userCmd, groupCmd, adminCmd, juliaCmd, cloneCmd, pushCmd, fetchCmd, pullCmd, runCmd, gitCredentialCmd, updateCmd, vulnCmd)
+	rootCmd.AddCommand(authCmd, jobCmd, datasetCmd, projectCmd, packageCmd, registryCmd, userCmd, groupCmd, adminCmd, juliaCmd, cloneCmd, pushCmd, fetchCmd, pullCmd, runCmd, gitCredentialCmd, updateCmd, vulnCmd, scanCmd)
 }
 
 func main() {