Add repository-level vulnerability summary to vulnerabilities command by colinmoynes · Pull Request #282 · cloudsmith-io/cloudsmith-cli

colinmoynes · 2026-03-27T16:53:54Z

This pull request introduces improvements to the vulnerability command. It adds a repository-level vulnerability summary capability, allowing users to aggregate and filter vulnerability data across all packages in a repository.

Type of Change

Additional Notes

Copilot

Pull request overview

This PR expands the CLI’s vulnerability reporting to support repository-level aggregation, and also introduces download-command enhancements (filename filtering and multi-package downloads), along with associated version/dependency bumps.

Changes:

Add cloudsmith vulnerabilities OWNER/REPO mode to aggregate vulnerability counts across all packages in a repository (with filtering and JSON output).
Enhance cloudsmith download with --filename filtering (including glob patterns) and --download-all, plus improved multi-match display.
Bump CLI version metadata to 1.16.0 and update cloudsmith-api dependency to 2.0.25.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
`cloudsmith_cli/cli/commands/vulnerabilities.py`	Adds repo-level summary mode, aggregation/filtering, and rich table output.
`cloudsmith_cli/core/api/vulnerabilities.py`	Updates summary table rendering and adjusts scan identifier handling.
`cloudsmith_cli/cli/validators.py`	Adds validator to accept `OWNER/REPO[/SLUG_PERM]` for vulnerabilities command arg.
`cloudsmith_cli/core/download.py`	Adds filename filtering (server/client side) and refactors multi-match output via rich table; adds resolve-all helper.
`cloudsmith_cli/cli/commands/download.py`	Adds `--filename` and `--download-all`, refactors download flow, and adds safe path joining.
`cloudsmith_cli/core/tests/test_download.py`	Adds unit tests for filename filtering, resolve-all behavior, and multi-match display.
`cloudsmith_cli/cli/tests/commands/test_download.py`	Adds integration-style CLI tests for new download flags/behavior.
`cloudsmith_cli/cli/commands/upstream.py`	Adds `alpine` to supported upstream formats list.
`README.md`	Documents new `download` flags (`--filename`, `--download-all`).
`CHANGELOG.md`	Adds entries for new features/releases (but currently with duplicated `1.14.0` sections).
`setup.py` / `requirements.txt`	Bumps `cloudsmith-api` dependency from `2.0.24` to `2.0.25`.
`cloudsmith_cli/data/VERSION` / `.bumpversion.cfg`	Bumps version to `1.16.0`.

Comments suppressed due to low confidence (2)

CHANGELOG.md:60

The changelog now contains two separate ## [1.14.0] sections (with different dates), which makes it ambiguous which entry is authoritative. Consider consolidating these into a single 1.14.0 section (or correcting the version/date as appropriate).

## [1.14.0] - 2026-03-11

### Added

- Added `vulnerabilities` command to retrieve security scan results for a package
  - Summary View (Default): Displays a high-level count of vulnerabilities broken down by severity (Critical, High, Medium, Low, Unknown).
  - Assessment View `--show-assessment` (`-A`): Provides a detailed breakdown where vulnerabilities are:
    - Grouped by the specific affected upstream package / dependency.
    - Sorted by severity (Critical first).
    - Richly formatted tables.
  - Filtering Capabilities:
    - By Severity: `--severity` Show only specific levels (e.g., just Critical and High).
    - By Status: `--fixable | --non-fixable` Filter to show only "Fixable" vulnerabilities (where a patch exists) or "Non-Fixable" ones.
  - Supports `--output-format json | pretty_json` for programmatic usage

## [1.14.0] - 2026-03-13

### Added

- Added `vulnerabilities` command to retrieve security scan results for a package
  - Summary View (Default): Displays a high-level count of vulnerabilities broken down by severity (Critical, High, Medium, Low, Unknown).
  - Assessment View `--show-assessment` (`-A`): Provides a detailed breakdown where vulnerabilities are:
    - Grouped by the specific affected upstream package / dependency.
    - Sorted by severity (Critical first).
    - Richly formatted tables.
  - Filtering Capabilities:

CHANGELOG.md:23

cloudsmith_cli/data/VERSION and .bumpversion.cfg are bumped to 1.16.0, but the new vulnerability summary entry is still under [Unreleased] rather than the 1.16.0 release section. If this change is part of 1.16.0, consider moving it into the ## [1.16.0] section; otherwise consider not bumping the version yet.

## [Unreleased]

### Added

- Added repository-level vulnerability summary (`cloudsmith vulnerabilities OWNER/REPO`)
  - Aggregates scan results across all packages into a single color-coded table
  - Packages sorted by total vulnerability count (descending)
  - Packages without scan results are silently omitted
  - Supports `--severity` and `--fixable/--non-fixable` filters

## [1.16.0] - 2026-03-24

### Added

- Added Alpine Upstream support for managing upstream configurations.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

cloudsmith_cli/cli/commands/vulnerabilities.py

cloudsmith_cli/core/api/vulnerabilities.py

cloudsmith_cli/cli/commands/vulnerabilities.py

…andling.

…now for single packages

…bility-summary-for

… status including "Security scan not supported" and "No issues found" to match the UI.

…ndling and results handling.

estebangarcia · 2026-04-03T13:20:46Z

cloudsmith_cli/cli/commands/vulnerabilities.py

+def get_packages_in_repo(opts, owner, repo):
+    """Get all packages in a repository, paginating through all pages."""
+    all_packages = []
+    page = 1
+    page_size = 100  # fetch in larger batches for efficiency
+
+    try:
+        while True:
+            packages, page_info = list_packages(
+                opts=opts,
+                owner=owner,
+                repo=repo,
+                query=None,
+                sort=None,
+                page=page,
+                page_size=page_size,
+            )
+
+            if packages:
+                all_packages.extend(packages)
+
+            # No page info means single page or no results
+            if not page_info:
+                break
+
+            current_page = getattr(page_info, "page", page)
+            total_pages = getattr(page_info, "page_total", 1)
+
+            if current_page >= total_pages:
+                break
+
+            page += 1
+
+    except Exception as exc:
+        raise click.ClickException(
+            f"Failed to list packages for '{owner}/{repo}'. "
+            f"Please check the owner and repository names are correct. "
+            f"Detail: {exc}"
+        ) from exc
+
+    if not all_packages:
+        raise click.ClickException(
+            f"No packages found in '{owner}/{repo}'. "
+            f"The repository may be empty, or the owner/repo names may be incorrect."
+        )
+
+    return [
+        (pkg["slug_perm"], pkg.get("name", pkg["slug_perm"]), pkg.get("version", ""))
+        for pkg in all_packages
+    ]


question: why do you need a new function for this instead of doing the same as here? https://github.com/cloudsmith-io/cloudsmith-cli/blob/master/cloudsmith_cli/cli/commands/list_.py#L221

Also if there's a lot of packages this will take A WHILE

estebangarcia · 2026-04-03T13:48:10Z

cloudsmith_cli/core/api/vulnerabilities.py

+        # click.echo(
+        #     f"No vulnerability scan results found for package: {package}", err=True
+        # )
+        return None


change: if you don't need the echo here anymore remove the comment

estebangarcia · 2026-04-03T13:50:42Z

cloudsmith_cli/cli/commands/vulnerabilities.py

+        slugs = get_packages_in_repo(opts, owner, repo)
+
+        repo_summary_rows = _collect_repo_scan_data(
+            opts, owner, repo, slugs, severity_filter, fixable
+        )


nit: you should test this out with a repo with a high count of packages, got the feeling it will take a very long time to gather all the data you need. A server-side component might be needed

colinmoynes requested a review from a team as a code owner March 27, 2026 16:53

Copilot AI review requested due to automatic review settings March 27, 2026 16:53

colinmoynes added the enhancement label Mar 27, 2026

Copilot started reviewing on behalf of colinmoynes March 27, 2026 16:54 View session

Copilot AI reviewed Mar 27, 2026

View reviewed changes

colinmoynes force-pushed the ceng-747-cloudsmith-cli-repo-level-vulnerability-summary-for branch from 842b05e to df3070c Compare March 27, 2026 17:03

colinmoynes added 9 commits March 27, 2026 17:09

initial commit

f7e348a

Repo summary of package vulnerabilities. Single table. Better error h…

2be21be

…andling.

better handling of -A flag for repo summary

2045f3b

add org and repo to repo summary json output

338e374

processing bar added for better ux

4ed5460

added slug_perm to package data in repo summary json

77279dd

improvied table colour rendering for severities. Shows total as well …

a26ff7c

…now for single packages

changelog ready for next release. potentially 1.17.0

1e2f53b

moved changes to unreleased

0f5ee19

colinmoynes force-pushed the ceng-747-cloudsmith-cli-repo-level-vulnerability-summary-for branch from df3070c to 0f5ee19 Compare March 27, 2026 17:12

colinmoynes and others added 2 commits March 27, 2026 17:22

fix pagination for get_packages_in_repo

5cf5a09

fix: download command in the saml context (#283)

b6ef8cd

colinmoynes force-pushed the ceng-747-cloudsmith-cli-repo-level-vulnerability-summary-for branch from da15095 to b6ef8cd Compare April 1, 2026 09:45

colinmoynes and others added 7 commits April 1, 2026 10:45

Merge branch 'master' into ceng-747-cloudsmith-cli-repo-level-vulnera…

9318618

…bility-summary-for

All packages now show and not just vulnerable packages, with accurate…

6262176

… status including "Security scan not supported" and "No issues found" to match the UI.

Added "Identifier" column to results table. Improved severity flag ha…

e4011b0

…ndling and results handling.

Updated testcases for vulnerabilities

ac1d701

Removed references to slugs for single package mode

e2cf6f6

Updated changelog

6fa1a96

Added readme update to vulnerabilities command

f558754

estebangarcia requested changes Apr 3, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add repository-level vulnerability summary to vulnerabilities command#282

Add repository-level vulnerability summary to vulnerabilities command#282
colinmoynes wants to merge 18 commits intomasterfrom
ceng-747-cloudsmith-cli-repo-level-vulnerability-summary-for

colinmoynes commented Mar 27, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

estebangarcia Apr 3, 2026

Uh oh!

estebangarcia Apr 3, 2026

Uh oh!

estebangarcia Apr 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

4 participants

Conversation

colinmoynes commented Mar 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Type of Change

Additional Notes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

estebangarcia Apr 3, 2026

Choose a reason for hiding this comment

Uh oh!

estebangarcia Apr 3, 2026

Choose a reason for hiding this comment

Uh oh!

estebangarcia Apr 3, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

4 participants

colinmoynes commented Mar 27, 2026 •

edited

Loading