DevOps-Security-Agent-Skills/security/scanning/vulnerability-scanning/scripts/scan-repo.sh

#!/bin/bash
# Repository Vulnerability Scanner
# Scans for vulnerabilities in dependencies and IaC
# Usage: ./scan-repo.sh [directory] [--output report.json]

set -euo pipefail

SCAN_DIR="${1:-.}"
OUTPUT="${2:-}"

echo "========================================="
echo "Repository Security Scan"
echo "Directory: $SCAN_DIR"
echo "========================================="
echo ""

ISSUES_FOUND=0

# Trivy filesystem scan
if command -v trivy &>/dev/null; then
    echo "=== Trivy Filesystem Scan ==="
    trivy fs "$SCAN_DIR" \
        --severity HIGH,CRITICAL \
        --scanners vuln,secret,config \
        --ignore-unfixed \
        || ISSUES_FOUND=1
    echo ""
fi

# Check for secrets with gitleaks
if command -v gitleaks &>/dev/null; then
    echo "=== GitLeaks Secret Scan ==="
    gitleaks detect --source "$SCAN_DIR" --no-git || ISSUES_FOUND=1
    echo ""
fi

# Check Terraform with tfsec
if command -v tfsec &>/dev/null && [ -d "$SCAN_DIR" ]; then
    if find "$SCAN_DIR" -name "*.tf" -print -quit | grep -q .; then
        echo "=== TFSec Terraform Scan ==="
        tfsec "$SCAN_DIR" --minimum-severity HIGH || ISSUES_FOUND=1
        echo ""
    fi
fi

# Check Kubernetes manifests with kubesec
if command -v kubesec &>/dev/null; then
    for manifest in $(find "$SCAN_DIR" -name "*.yaml" -o -name "*.yml" 2>/dev/null | head -10); do
        if grep -q "kind:" "$manifest" 2>/dev/null; then
            echo "=== Kubesec: $manifest ==="
            kubesec scan "$manifest" 2>/dev/null || true
        fi
    done
fi

# Python dependencies
if [ -f "$SCAN_DIR/requirements.txt" ]; then
    if command -v pip-audit &>/dev/null; then
        echo "=== Python Dependency Audit ==="
        pip-audit -r "$SCAN_DIR/requirements.txt" || ISSUES_FOUND=1
        echo ""
    fi
fi

# Node.js dependencies
if [ -f "$SCAN_DIR/package.json" ]; then
    if command -v npm &>/dev/null; then
        echo "=== NPM Audit ==="
        (cd "$SCAN_DIR" && npm audit --audit-level=high 2>/dev/null) || ISSUES_FOUND=1
        echo ""
    fi
fi

echo "========================================="
if [ $ISSUES_FOUND -eq 1 ]; then
    echo "⚠ Security issues found - review above"
    exit 1
else
    echo "✓ No critical security issues found"
fi
echo "========================================="