Skip to content

Add --dry-run flag to CLI (#1967)#2046

Open
YUVRAJ-SINGH-3178 wants to merge 5 commits into
utksh1:mainfrom
YUVRAJ-SINGH-3178:feature-1967-cli-dry-run
Open

Add --dry-run flag to CLI (#1967)#2046
YUVRAJ-SINGH-3178 wants to merge 5 commits into
utksh1:mainfrom
YUVRAJ-SINGH-3178:feature-1967-cli-dry-run

Conversation

@YUVRAJ-SINGH-3178

Copy link
Copy Markdown
Contributor

Hey! This PR adds a handy --dry-run flag to the CLI as requested in #1967.

It makes it super easy to preview exactly what command a plugin is going to run under the hood, without actually firing off a scan or saving a task to the database.

Here's how it works:

  • Added the --dry-run argument to the secuscan scan parser in cli.py.
  • If the flag is passed, it uses the plugin_manager to build the command with all the interpolated inputs.
  • It also fully simulates the Docker sandbox environment by prepending the exact docker run prefix (with memory/cpu limits) that the executor would normally use.
  • Finally, it just prints the final resolved command to the terminal and cleanly exits with a 0 code.

It's great for debugging plugins. Let me know what you think!

@utksh1 utksh1 added level:beginner 20 pts difficulty label for small beginner-friendly PRs type:feature Feature work category bonus label area:backend Backend API, database, or service work area:plugins Scanner plugin metadata, schemas, or plugin runtime work labels Jul 24, 2026

@utksh1 utksh1 left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please rebase this CLI dry-run branch and add focused tests showing it prints the resolved command, never executes the scanner, preserves validation/safe-mode behavior, and returns a useful error for invalid inputs.

@utksh1 utksh1 left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please add focused CLI tests for --dry-run: it must print the resolved command, return nonzero for an unknown plugin or invalid command, avoid task creation/execution, and reflect Docker wrapping when enabled. Rebase on main afterward.

@utksh1 utksh1 left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please add focused CLI tests for --dry-run: it must print the resolved command, return nonzero for an unknown plugin or invalid command, avoid task creation/execution, and reflect Docker wrapping when enabled. Rebase on main afterward.

@utksh1 utksh1 left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please rebase this CLI dry-run branch and add focused tests showing it prints the resolved command, never executes the scanner, preserves validation/safe-mode behavior, and returns a useful error for invalid inputs.

@YUVRAJ-SINGH-3178
YUVRAJ-SINGH-3178 force-pushed the feature-1967-cli-dry-run branch from 8d4d8cd to a9afc64 Compare July 24, 2026 13:16
@YUVRAJ-SINGH-3178

Copy link
Copy Markdown
Contributor Author

I've completed the --dry-run implementation:

  • The CLI now safely bypasses execution and prints the target command when --dry-run is used.
  • Added unit tests in test_cli.py to guarantee no background tasks are accidentally spawned.
  • Fully rebased onto main to resolve conflicts.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area:backend Backend API, database, or service work area:plugins Scanner plugin metadata, schemas, or plugin runtime work level:beginner 20 pts difficulty label for small beginner-friendly PRs type:feature Feature work category bonus label

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants