regression_cli.py

import argparse
import json
from pathlib import Path

from pentest.regression import RegressionPolicy, compare_reports, load_report
from pentest.forensics import restrict_file_permissions


def main() -> int:
    parser = argparse.ArgumentParser(description="Gate a current assessment against a trusted baseline report.")
    parser.add_argument("--baseline", required=True, type=Path)
    parser.add_argument("--current", required=True, type=Path)
    parser.add_argument("--output", type=Path)
    parser.add_argument("--new-severity", default="High", choices=["Critical", "High", "Medium", "Low", "Info"])
    parser.add_argument("--allow-coverage-loss", action="store_true")
    parser.add_argument("--max-asr-increase", type=float, default=0.20)
    parser.add_argument("--allow-context-change", action="store_true")
    args = parser.parse_args()
    policy = RegressionPolicy(
        fail_on_new_at_or_above=args.new_severity,
        fail_on_coverage_loss=not args.allow_coverage_loss,
        max_asr_increase=args.max_asr_increase,
        fail_on_context_change=not args.allow_context_change,
    )
    report = compare_reports(load_report(args.baseline), load_report(args.current), policy).to_dict()
    rendered = json.dumps(report, indent=2, ensure_ascii=False)
    if args.output:
        args.output.parent.mkdir(parents=True, exist_ok=True)
        args.output.write_text(rendered + "\n", encoding="utf-8")
        restrict_file_permissions(args.output)
    else:
        print(rendered)
    return 0 if report["passed"] else 4


if __name__ == "__main__":
    raise SystemExit(main())