The dpndncy command line

The CLI uploads a project to your dpndncY server, waits for the scan, prints the result and exits with a code a pipeline can act on. It is one file with no dependencies, so it runs on a developer laptop or a build agent the same way.

#Getting it

Your server hosts the binaries, so a runner never has to reach the internet:

curl -fsSL https://api.dpndncy.example.com/releases/dpndncy-linux -o dpndncy && chmod +x dpndncy

GET /releases lists what the server has. These URLs are public on purpose: a runner needs the binary before it has a token. They are on the API address, not the console.

With Node 18 or later you can also run the source: node cli/bin/dpndncy.js.

#Connecting

The CLI needs two things: the API address (not the console address) and an API token.

Create the token in the console, Settings, API Tokens. Use a user with the analyst role or above (Tenants, users and access).

For a pipeline, pass them as environment variables:

export DPNDNCY_SERVER=https://api.dpndncy.example.com
export DPNDNCY_TOKEN=<token>

On a workstation, save them once:

dpndncy login --server https://api.dpndncy.example.com --token <token>
dpndncy status        # checks the connection and shows the server version

This writes ~/.dpndncy/config.json. Order of precedence: command-line flags, then environment variables, then the saved file.

#Scanning

dpndncy scan [path] [options]

Source is uploaded as an archive. Files that commonly hold credentials (.env, *.pem, *.key, .npmrc and similar) are left out, and .gitignore and .dpndncyignore rules are honoured.

#Which project a scan belongs to

Every scan is filed under a project. By default the name is taken from, in order:

1. --project, or the DPNDNCY_PROJECT environment variable;
2. the repository name in .git/config (origin);
3. the name in package.json;
4. the folder name.

Set it explicitly in pipelines when the checkout folder is not meaningful (many CI systems check out into a folder called src or workspace). Scans of the same name join the same project, so its history and trend build up. A project that did not exist is created automatically, without scheduled rescans.

#Exit codes

dpndncy exit-codes prints the same table.

#What "the gate failed" means

With --ci:

• Dependency scans fail when the result breaks the tenant's scan policy (Settings, Scan policy; see Scan policies). A policy that tolerates a few medium findings lets the build pass with them. --fail-on-any ignores the policy and fails on any vulnerability.
• Static analysis and secrets fail on any finding.

Without --ci, the same policy verdict decides the exit code and the full result is shown.

The output line starts with PASS or FAIL:

FAIL  sca=5 (scan policy) sast=0 secrets=0
PASS  5 findings within the scan policy

#Other commands

#Troubleshooting