Metadata-Version: 2.4
Name: vera-audit
Version: 0.1.0
Summary: Vera command-line client — scan your app for store-compliance issues from the terminal.
Keywords: app-store,google-play,compliance,audit,mobile,cli
Author: Reef Inc.
License-Expression: LicenseRef-Proprietary
Classifier: Development Status :: 3 - Alpha
Classifier: Environment :: Console
Classifier: Intended Audience :: Developers
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Topic :: Software Development :: Quality Assurance
Requires-Dist: typer>=0.15,<0.17
Requires-Dist: httpx>=0.27,<0.29
Requires-Dist: rich>=13.7,<15
Requires-Python: >=3.12
Project-URL: Homepage, https://98.80.215.12.sslip.io
Description-Content-Type: text/markdown

# vera — the Vera CLI

Scan your app for App Store / Google Play compliance issues from the terminal.
A standalone client for the Vera service: it talks to the same `/api/*` surface
as the dashboard and complements the MCP server (which cannot upload a local
project).

```
vera login          # sign in through your browser
vera init           # create a project (+ short questionnaire)
vera scan           # zip this folder, upload, watch the audit live
vera audits list    # recent runs
vera audits show latest
```

## Install

The distribution on PyPI is **`vera-audit`**; the command you type is `vera`.
(`vera` and `vera-cli` belong to an unrelated project, and PyPI rejects
`vera-scan` as too similar to the existing `verascan` — it ignores `-`, `_`
and `.` when comparing names.)

```bash
uv tool install vera-audit      # recommended: uv fetches its own Python
pipx install vera-audit         # if you already use pipx (needs Python 3.12+)
```

Or the one-liner, which installs `uv` first if the machine does not have it:

```bash
curl -fsSL https://98.80.215.12.sslip.io/install.sh | sh
```

> The one-liner is served by `veracode-client` at `GET /install.sh`. It only
> works once the server has a real TLS certificate — today nginx serves a
> self-signed cert, so `curl` refuses the connection. Use `uv tool install`
> until the domain + certbot change ships, and do **not** paste a `curl -k`
> version: piping an unverified script into a shell is exactly the thing TLS
> is there to prevent.

`VERA_VERSION=0.1.0` pins a version; `VERA_PACKAGE` overrides the distribution.

```bash
uv tool upgrade vera-audit      # update
uv tool uninstall vera-audit    # remove
```

## Configuration

Precedence: flag > environment > `~/.config/vera/config.json` > default.

| Setting | Flag | Env | Default |
|---|---|---|---|
| Server URL | `--base-url` | `VERA_BASE_URL` | `https://98.80.215.12.sslip.io` |
| Skip TLS verify | `--insecure` | `VERA_INSECURE=1` | on for the default host only (self-signed cert) |

`vera config` prints the effective values; `vera config set base-url …`
persists one. Credentials live in `~/.config/vera/credentials.json` (0600),
one entry per server.

## Exit codes

| Code | Meaning |
|---|---|
| 0 | Success; a completed audit with no error-severity findings |
| 1 | Unexpected error (network, API) |
| 2 | Usage error |
| 3 | Not signed in / session expired |
| 4 | Audit failed or timed out |
| 5 | Audit completed with error-severity findings (CI-friendly) |

## What `vera scan` uploads

The CLI packages the directory with the same exclusion policy the server
enforces on extraction (`src/veracode/server/scan/sanitize.py`): dependency
and build folders (`node_modules`, `Pods`, `.git`, `DerivedData`, …), secrets
(`.env*`, keys, certificates), nested archives, binaries, and files over
10 MB never leave your machine. The zip is deterministic, so re-scanning an
unchanged project reuses the previous audit (`--force` re-runs it).

## Server operator setup (required for `vera login`)

The login flow opens the browser to Supabase and catches the redirect on
`http://127.0.0.1:8976/callback` (falling back to ports 8977/8978). Those URLs
must be added to the Supabase project's **Auth → URL Configuration → Redirect
URLs** allowlist:

```
http://127.0.0.1:8976/callback
http://127.0.0.1:8977/callback
http://127.0.0.1:8978/callback
```

Until that is configured, browser sign-in cannot return to the CLI (the
paste-the-redirect-URL fallback is offered, but Supabase may reject the
redirect outright).

## Smoke test against the deployed server

```bash
uv run vera login
uv run vera init --yes --label smoke
uv run vera scan tests/fixtures/tiny-app
```

## API documentation

`cli/openapi.yaml` documents the `/api/*` surface this CLI consumes. It is
hand-written; update it in the same PR as any `/api/*` change.

## Development

```bash
cd cli
uv sync
uv run vera --help
uv run pytest
uv run ruff check .
uv tool install --force .      # install this checkout on your PATH
```

## Releasing

CI: `.github/workflows/release-cli.yml` builds, tests, and publishes to PyPI
with trusted publishing (OIDC — no API token stored).

```bash
# 1. bump both (a test asserts they match):
#      cli/pyproject.toml  → project.version
#      cli/src/vera_cli/__init__.py → __version__
# 2. merge to main, then:
git tag cli-v0.1.0
git push origin cli-v0.1.0
```

The workflow refuses to publish if the tag and `pyproject.toml` version
disagree. Actions → **Release CLI** → Run workflow does a build-only dry run.

One-time setup, both required before the first tag:

1. **PyPI trusted publisher** — on PyPI, create the `vera-audit` project (or add
   a pending publisher at <https://pypi.org/manage/account/publishing/>) with
   owner `Reef-Inc`, repository `veracode`, workflow `release-cli.yml`,
   environment `pypi`.
2. **GitHub environment** — repo Settings → Environments → New environment
   named `pypi` (add required reviewers if publishing should need approval).

Note that PyPI is public: publishing ships the CLI source (an sdist anyone can
download) even though this repository is private. The CLI holds no secrets, but
it does disclose the `/api/*` surface it calls.
