preflight.sh

Field	Value
Type	Shell
Source	Forge/Skills/Security_Scan/scripts/preflight.sh
Parent	Forge
GitHub	Forge/Skills/Security_Scan/scripts/preflight.sh

This page is auto-generated. Edit the source to change the content.

#!/usr/bin/env bash
# Checks which scanners are available. Never fails the build -- it reports.
# Usage: preflight.sh [static|live|all]
set -uo pipefail

MODE="${1:-all}"
MISSING=()
PRESENT=()

check() {
  local bin="$1" label="$2" hint="$3"
  if command -v "$bin" >/dev/null 2>&1; then
    local version=""
    case "$bin" in
      semgrep)  version="$(semgrep --version 2>/dev/null | tail -1)" ;;
      trivy)    version="$(trivy --version 2>/dev/null | head -1 | sed 's/Version: //')" ;;
      gitleaks) version="$(gitleaks version 2>/dev/null)" ;;
      checkov)  version="$(checkov --version 2>/dev/null)" ;;
      nuclei)   version="$(nuclei -version 2>/dev/null | head -1)" ;;
    esac
    PRESENT+=("$label ${version:+(v$version)}")
  else
    MISSING+=("$label -- $hint")
  fi
}

# ZAP is preferred as a native install (Forgentic image). Docker is a local fallback.
check_zap() {
  if command -v zap-baseline.py >/dev/null 2>&1 && command -v zap.sh >/dev/null 2>&1; then
    local version=""
    version="$(zap.sh -version 2>/dev/null | tail -1)"
    PRESENT+=("ZAP (DAST, native) ${version:+(v$version)}")
  elif command -v docker >/dev/null 2>&1; then
    local version=""
    version="$(docker --version 2>/dev/null)"
    PRESENT+=("ZAP (DAST, via Docker) ${version:+($version)}")
  else
    MISSING+=("ZAP (DAST) -- native zap.sh + zap-baseline.py (Forgentic image) or Docker (ghcr.io/zaproxy/zaproxy:stable)")
  fi
}

if [[ "$MODE" == "static" || "$MODE" == "all" ]]; then
  check semgrep  "Semgrep (SAST)"        "pip install semgrep  |  brew install semgrep"
  check trivy    "Trivy (deps/IaC/SBOM)" "brew install trivy  |  see trivy.dev installation docs"
  check gitleaks "Gitleaks (secrets)"    "brew install gitleaks  |  github.com/gitleaks/gitleaks releases"
  check checkov  "Checkov (IaC)"         "pip install checkov"
fi

if [[ "$MODE" == "live" || "$MODE" == "all" ]]; then
  check nuclei "Nuclei (templated DAST)" "brew install nuclei  |  see docs.projectdiscovery.io"
  check_zap
fi

echo "=== Scanner preflight (${MODE}) ==="
if [[ ${#PRESENT[@]} -gt 0 ]]; then
  printf 'available: %s\n' "${PRESENT[@]}"
fi
if [[ ${#MISSING[@]} -gt 0 ]]; then
  echo
  echo "not installed:"
  printf '  %s\n' "${MISSING[@]}"
  echo
  echo "Scans will skip these and continue. Coverage will be partial."
fi
exit 0