feat: add image --upload to push an SBOM for an image tag OD-710 by claudiacodacy · Pull Request #50 · codacy/codacy-cloud-cli

claudiacodacy · 2026-09-21T12:45:49Z

PR 2 of the OD-710 stack.

Stacked on #49 — that is the base branch, so this diff shows only the upload work. Merge #49 first; this retargets to main automatically.

PR	Scope	State
1	`images` (list) and `image` (list tags, show a tag, `--delete` scoped by `--tag`)	#49
2	`--upload` (`uploadImageSbom`)	this one
3	bulk cleanup — `--delete --keep-latest <n>`	blocked on the org-wide metrics wipe

What's here

codacy image gh my-org my-service --tag 1.2.3 --upload ./sbom.json
codacy image gh my-org my-service --tag 1.2.3 --upload ./sbom.json --environment production --repository my-repo

uploadImageSbom was already in the generated SbomService — no npm run update-api.

Decisions worth a look

--upload is a verb, --tag is its scope — the same shape --delete already uses, so no new flag vocabulary. --tag is required here: the API keys an upload on image and tag, with no untagged fallback. Refused by name before the file is read.
The file is validated locally. An unreadable path and an empty file both fail immediately with something actionable, instead of as a 400 from the other side of the network.
Sent as a File, not a bare Blob. A Blob goes out as filename="blob", which tells the server and anyone reading a request log nothing; a File carries the real name. The generated client's isBlob accepts both. Media type comes from the extension (.json, .xml, else application/octet-stream — letting the API decide rather than guessing wrong in the request).
--upload and --delete are refused together. Unlike --delete's two scopes, these are two verbs; asking for both says nothing coherent about what should happen to the SBOM. This is the one mutual-exclusion guard that earns its place.
--environment / --repository are omitted when unset rather than sent as undefined form fields.
Account token only — and that's the awkward part. uploadImageSbom isn't on the repository-token whitelist, but uploading an SBOM from a pipeline is exactly where a project token would be natural (the coverage reporter already reads CODACY_PROJECT_TOKEN there), and the upload already names a repositoryName. Logged as a ranked gap in SPECS/missing-endpoints.md for the API owners to decide on — not assumed.

Tests

9 new (image.test.ts is now 25), 708 passing. Covers the happy path, the File name/type/contents, optional passthroughs, XML inference, missing --tag, missing file, empty file, the --upload/--delete refusal, and JSON output. Docs updated: SPECS/commands/images.md, SPECS/README.md, SPECS/missing-endpoints.md, README.md, src/commands/AGENTS.md, changeset (minor).

🤖 Generated with Claude Code

…r images OD-710 Adds the first of three stacked PRs for OD-710: listing and deleting. `codacy images <provider> <org>` lists container images with SBOMs uploaded to an organization, with a tag count per image — the number an org at the 1000-tag cap needs to see. `ImageSummary` carries no count, so it comes from listImageTags' pagination.total with limit 1, fanned out at a bounded concurrency of 8, degrading to a dim `-` per image on failure and opt-out-able with -N/--no-tag-counts. `codacy image <provider> <org> <image>` lists that image's tags and deletes them: -t/--delete-tag <tag> for one, -D/--delete for the image and all its SBOMs. Both confirm via the shared confirmAction (-y/--skip-confirmation for CI; a non-TTY without it aborts) and print a notice first, because a single SBOM delete currently zero-fills Container Scanning metrics for the whole organization until the next nightly scan. That defect is also why bulk cleanup (--keep-latest) is not here: it would fire the wipe once per tag. Both commands are account-token only — no image operation is on the repository-token whitelist — and go through sanitizeText() on every value that arrived with the SBOM upload. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

… tag fan-out Review feedback on OD-710. `--delete-tag <tag>` is gone. `--delete` is now the only delete verb and `--tag <tag>` scopes it, the same split `issues --ignore` makes with its filters: the flag that narrows what is acted on is the flag that narrows what is shown. `--delete` alone takes the image and every SBOM under it, `--tag X --delete` takes one tag, and the mutual-exclusion guard two verbs needed is gone with them. `--tag` without an action shows that one tag, paging the listing and matching exactly (the tags endpoint has no per-tag filter) — the shape `pull-request --issue <id>` already uses. The `images` tag-count fan-out is gone too: the count belongs on `ImageSummary`, so it is being added server-side instead of derived at one extra request per image. `images` is one request per page again, and `-N, --no-tag-counts` goes with it. Filed as a pending backend task. The whole-image `--delete` keeps its own `limit: 1` count lookup, which only feeds the confirmation prompt. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

codacy-production · 2026-09-21T12:46:48Z

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 28 complexity · 7 duplication

Metric Results

Complexity 28

Duplication 7

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

codacy-production

Pull Request Overview

Codacy reports the PR as not up to standards. The upload success messages interpolate user-controlled values without sanitization, allowing terminal-control injection; this should be fixed before merging.

The repository-token authentication criterion is not directly covered by the provided tests, leaving a security-related behavior gap. The upload command also has elevated complexity and no independently verifiable coverage report.

About this PR

Add an automated test proving repository-token authentication is rejected before any upload request is made.
The image command and upload flow have accumulated multiple responsibilities, while production coverage cannot be independently verified from the report. Consider separating dispatch, file handling, and result rendering as follow-up maintainability work.

1 comment outside of the diff

src/commands/image.ts

_{line 92-159 🟡 MEDIUM RISK}
Suggestion: Extract action selection and validation into focused helpers, keeping upload, delete, tag display, and list dispatch separate without changing CLI behavior.

Test suggestions

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Repository-token authentication is rejected for image uploads before any request.

_{TIP How was this review? Give us feedback}

codacy-production · 2026-09-21T13:18:21Z

+
+  console.log(
+    ansis.dim(
+      `\nRun 'codacy image ${provider} ${organization} ${image} --tag ${opts.tag}' to see it.`,


_{🟡 MEDIUM RISK}

Use sanitized values when constructing this follow-up command; do not interpolate raw image or opts.tag into terminal output.

Fixed — image and opts.tag are sanitized in the follow-up hint. The file already sanitized both everywhere else; this line and the success line above it were the exceptions.

_{🤖 Generated by /pr-fixup command}

codacy-production · 2026-09-21T13:18:21Z

+    ...(opts.environment ? { environment: opts.environment } : {}),
+  });
+
+  spinner.succeed(`Uploaded ${path.basename(file)} for ${label}.`);


_{🟡 MEDIUM RISK}

Sanitize the basename before including it in the success message, and sanitize every upload-derived value in follow-up command output to prevent terminal-control injection.

Fixed. The basename is sanitized in the success line. Same reasoning as the image and tag beside it: all three are strings this process was handed rather than strings it chose.

_{🤖 Generated by /pr-fixup command}

codacy-production · 2026-09-21T13:18:21Z

+async function executeUpload(
+  provider: string,
+  organization: string,
+  image: string,
+  file: string,
+  opts: {
+    tag?: string;
+    environment?: string;
+    repositoryName?: string;
+    json: boolean;
+  },
+): Promise<void> {
+  if (!opts.tag) {
+    throw new Error(
+      "--upload requires --tag <tag>: an SBOM is uploaded for one image tag.",
+    );
+  }
+
+  let contents: Buffer;
+  try {
+    contents = await fs.readFile(file);
+  } catch {
+    throw new Error(`Could not read SBOM file '${file}'.`);
+  }
+  if (contents.length === 0) {
+    throw new Error(`SBOM file '${file}' is empty.`);
+  }
+
+  const label = `${sanitizeText(image)}:${sanitizeText(opts.tag)}`;
+  const spinner = ora(`Uploading SBOM for ${label}...`).start();
+
+  // `File` rather than a bare `Blob` so the multipart part carries the real
+  // filename — a `Blob` is sent as `filename="blob"`, which tells the server
+  // (and anyone reading a request log) nothing. The generated client's
+  // `isBlob` accepts both.
+  const sbom = new File([contents], path.basename(file), {
+    type: sbomContentType(file),
+  });
+
+  await SbomService.uploadImageSbom(provider, organization, {
+    sbom,
+    imageName: image,
+    tag: opts.tag,
+    ...(opts.repositoryName ? { repositoryName: opts.repositoryName } : {}),
+    ...(opts.environment ? { environment: opts.environment } : {}),
+  });
+
+  spinner.succeed(`Uploaded ${path.basename(file)} for ${label}.`);
+
+  if (opts.json) {
+    printJson({
+      imageName: image,
+      tag: opts.tag,
+      ...(opts.repositoryName ? { repositoryName: opts.repositoryName } : {}),
+      ...(opts.environment ? { environment: opts.environment } : {}),
+      uploaded: true,
+    });
+    return;
+  }
+
+  console.log(
+    ansis.dim(
+      `\nRun 'codacy image ${provider} ${organization} ${image} --tag ${opts.tag}' to see it.`,
+    ),
+  );
+}


_{🟡 MEDIUM RISK}

Suggestion: Extract SBOM file loading/File construction and upload-result rendering into focused helpers, preserving validation order, optional-field omission, spinner behavior, error messages, and tests.

See Issue in Codacy

Partly. Reading and validating the SBOM file is a self-contained step with its own failure modes, so it comes out as readSbomFile — that is what took executeUpload back under the line limit, and validation order, spinner behaviour and error messages are unchanged. The result rendering stays inline: it is a printJson call and a console.log, and extracting those would add a hop without removing a decision.

_{🤖 Generated by /pr-fixup command}

Codacy flagged five complexity issues on this PR: the `images` action callback (89 lines, CCN 17), `listTags` (66 lines, CCN 13) and `fetchTags` (CCN 9). Each is the same shape — a page loop, a JSON projection and a table build sharing one function — so each gets the same treatment `image.ts` already used for `fetchTags`/`listTags`: the cursor loop and the table rendering come out, the caller is left orchestrating. Two sanitization gaps came out with them, both values that arrive from the API rather than from the user's own command line: - `showTag`'s "Delete this tag with --tag <tag>" hint interpolated `match.tag` raw, while the table two lines above sanitized every field. - The metrics-wipe notice went to stdout, so `--output json` emitted prose ahead of the JSON document. It is a warning, so it belongs on stderr; a declined confirmation under `--output json` now reports itself as `{deleted: false, aborted: true}` rather than a prose line. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

The first split left it at 55 lines against a limit of 50. The JSON projection and the whole table-mode rendering come out as `projectImage` and `printImages`, leaving `listImages` with the limit, the fetch and the choice between the two modes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Semgrep read `--tag <tag>` and `<image>` in help text as HTML with interpolated variables, three times. And the reviewers flagged a missing `sanitizeText()` on a value the user had typed on their own command line, which is not the CWE-150 sink the API-supplied fields are — the real miss was next to it, on a value that had come back from the API. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

PR 2 of the OD-710 stack, on top of the listing/deleting commands. `codacy image <provider> <org> <image> --tag <tag> --upload ./sbom.json` uploads an SPDX or CycloneDX SBOM via the already-generated uploadImageSbom. It fits the command's existing split — --upload is the verb, --tag is the scope — and requires --tag, since the API keys an upload on image and tag with no untagged fallback. The file is validated locally first, so an unreadable path or an empty file fails with something actionable instead of a remote 400. It goes out as a File rather than a bare Blob so the multipart part carries the real filename (a Blob is sent as filename="blob"), with the media type inferred from the extension. Optional -e/--environment and -r/--repository map to the API's environment/repositoryName and are omitted rather than sent as undefined. --upload and --delete are refused together: unlike --delete's two scopes, these are two verbs, and asking for both says nothing coherent. Still account-token only. That is the awkward part — uploading from a pipeline is exactly where a project token would be natural — so the whitelist gap is logged in SPECS/missing-endpoints.md. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

…choes Codacy flagged `executeUpload` at 55 lines (limit 50). Reading and validating the file is a self-contained step with its own failure modes, so it moves to `readSbomFile` and the upload path is left with the request and its output. The success line and the follow-up-command hint interpolated the filename, image and tag raw. All three are strings this process was handed rather than strings it chose, and the file already sanitizes image and tag everywhere else — the exceptions were the two places they were echoed back. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

alerizzo · 2026-09-22T08:56:21Z

Code review

Reviewed as part of the #49 → #50 → #52 → #53 stack, against the merged state. No merge-blocking issues found in this PR's own diff.

Checked and clear: --tag is required and refused before the file is read; --upload + --delete mutual exclusion; local validation of an unreadable and an empty file; the File construction carries the real filename and an extension-inferred media type (global File is available under the declared engines: node >=20); --environment / --repository are omitted rather than sent undefined; resolveAccountAuth runs before any request; image, tag and filename all pass through sanitizeText() before styling.

One note that is not a defect in this PR, but affects the feature it adds: --upload failures surface through the top-level handleError, so they only carry the API's real message once #53 lands. The tag-mismatch case in #53's description (SBOM tag mismatch: expected 9.9.9, found 3.20) is an upload error, so this PR's most common failure mode reads as Error: Bad Request until then. Worth keeping the stack merging in order rather than landing #50 on its own.

_{🤖 Generated by /code-review command}

confirmAction built its readline interface with `output: process.stdout`. `process.stdin.isTTY` is true whenever stdin is a terminal — including when stdout is a pipe — so `image ... --delete --output json | jq` sent the question and the echoed keystroke into jq, which failed on them. The code comment beside the abort branch asserted the opposite. Fixed in utils/prompt.ts rather than per command: a confirmation is interaction, not program output, so it belongs on the stream the spinners already use, and no command has to thread its output format down into the prompt. Every caller benefits (image --delete, issues --ignore, tools --import); interactive runs are unchanged, both streams reaching the same terminal. A non-TTY stdin still declines outright. Adds utils/prompt.test.ts — the helper had none, every caller having mocked it — pinning the stream, the y/N parsing and the non-TTY refusal. Also replaces two images.test.ts assertions that could not fail: - "renders a dim dash for missing values" asserted only that the image name appeared, so it passed with the orDash fallback deleted or printing the literal "undefined". It now counts the row's three dashes. - "caps --limit at 1000" asserted a page size of 100, which is Math.min(limit, PAGE_SIZE) for any limit >= 100 and never exercised MAX_LIMIT. It now pages a cursor that never ends and asserts the loop stops after 10 requests, with the mock bounded at 20 so a broken clamp fails in milliseconds rather than hanging. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

# Conflicts: # SPECS/README.md

npm run check-types runs tsc --noEmit over the tests too. The readline mock's ReadLineOptions and SbomService's CancelablePromise return type both need an explicit cast. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

claudiacodacy · 2026-09-22T10:09:41Z

Agreed on the sequencing — the stack merges in order, #49 → #50 → #52 → #53, so --upload never ships without the error-message fix behind it. No changes to this PR's own diff.

It has been merged forward from #49, so it now carries the confirmAction stderr fix and picks up the rest of the stack in order.

_{🤖 Generated by /pr-fixup command}

It ran as long as the feature entry it follows up on, against a 311-char median for the table. The reasoning is already in the commit message, the PR reply and the code comments; the changelog needs the what and the why-it-mattered. Test count back to this branch's own measured total. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

# Conflicts: # SPECS/README.md

The merge-base changed after approval.

# Conflicts: # README.md # SPECS/README.md # SPECS/commands/images.md # src/commands/AGENTS.md # src/commands/image.test.ts # src/commands/image.ts

The merge-base changed after approval.

claudiacodacy and others added 2 commits September 21, 2026 13:24

claudiacodacy added this pull request to stack #51 September 21, 2026 12:46

This was referenced Sep 21, 2026

feat: image --delete --keep-latest for release-pipeline tag cleanup, and surface API error messages OD-710 #52

Merged

fix: surface the API's error message instead of the client's status name #53

Merged

claudiacodacy marked this pull request as ready for review September 21, 2026 13:17

codacy-production Bot reviewed Sep 21, 2026

View reviewed changes

claudiacodacy requested a review from alerizzo September 21, 2026 13:18

claudiacodacy and others added 2 commits September 21, 2026 22:59

docs: record the JSON delete contract in the spec and changeset

6d83899

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

claudiacodacy force-pushed the feat/od-710-image-upload branch from 0ac1c31 to 01b24dc Compare September 21, 2026 22:07

claudiacodacy force-pushed the feat/od-710-image-upload branch from 01b24dc to e5d8b71 Compare September 21, 2026 22:13

claudiacodacy and others added 3 commits September 21, 2026 23:17

claudiacodacy force-pushed the feat/od-710-image-upload branch from e5d8b71 to bc2b864 Compare September 21, 2026 22:17

alerizzo mentioned this pull request Sep 22, 2026

feat: add images and image commands for listing and deleting container images OD-710 #49

Merged

claudiacodacy and others added 4 commits September 22, 2026 11:00

Merge branch 'feat/od-710-images-commands' into feat/od-710-image-upload

6d0fe44

# Conflicts: # SPECS/README.md

fix: satisfy check-types in the two new test files

c2b1468

npm run check-types runs tsc --noEmit over the tests too. The readline mock's ReadLineOptions and SbomService's CancelablePromise return type both need an explicit cast. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Merge branch 'feat/od-710-images-commands' into feat/od-710-image-upload

b15ec7c

alerizzo previously approved these changes Sep 22, 2026

View reviewed changes

claudiacodacy and others added 2 commits September 22, 2026 11:30

Merge branch 'feat/od-710-images-commands' into feat/od-710-image-upload

4e13a9e

# Conflicts: # SPECS/README.md

claudiacodacy dismissed alerizzo’s stale review via 4e13a9e September 22, 2026 10:32

joanasteodoro previously approved these changes Sep 22, 2026

View reviewed changes

Base automatically changed from feat/od-710-images-commands to main September 22, 2026 10:40

joanasteodoro previously approved these changes Sep 22, 2026

View reviewed changes

Merge remote-tracking branch 'origin/main' into feat/od-710-image-upload

f9f726e

# Conflicts: # README.md # SPECS/README.md # SPECS/commands/images.md # src/commands/AGENTS.md # src/commands/image.test.ts # src/commands/image.ts

joanasteodoro approved these changes Sep 22, 2026

View reviewed changes

claudiacodacy merged commit 4dfa3dd into main Sep 22, 2026
4 checks passed

claudiacodacy deleted the feat/od-710-image-upload branch September 22, 2026 10:45

github-actions Bot mentioned this pull request Sep 22, 2026

chore: version packages #54

Merged

claudiacodacy mentioned this pull request Sep 22, 2026

docs: move and rewrite the image tagging guidance [OD-707] codacy/docs#2757

Merged

Navigation Menu

feat: add image --upload to push an SBOM for an image tag OD-710 - #50

feat: add image --upload to push an SBOM for an image tag OD-710#50
claudiacodacy merged 15 commits into
mainfrom
feat/od-710-image-upload

claudiacodacy commented Sep 21, 2026

Uh oh!

codacy-production Bot commented Sep 21, 2026 •

edited

Loading

Uh oh!

codacy-production Bot left a comment

Uh oh!

codacy-production Bot Sep 21, 2026

Uh oh!

claudiacodacy Sep 21, 2026

Uh oh!

codacy-production Bot Sep 21, 2026

Uh oh!

claudiacodacy Sep 21, 2026

Uh oh!

codacy-production Bot Sep 21, 2026

Uh oh!

claudiacodacy Sep 21, 2026

Uh oh!

alerizzo commented Sep 22, 2026

Uh oh!

claudiacodacy commented Sep 22, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

claudiacodacy commented Sep 21, 2026

What's here

Decisions worth a look

Tests

Uh oh!

codacy-production Bot commented Sep 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Up to standards ✅

Uh oh!

codacy-production Bot left a comment

Choose a reason for hiding this comment

Pull Request Overview

About this PR

Test suggestions

Uh oh!

codacy-production Bot Sep 21, 2026

Choose a reason for hiding this comment

Uh oh!

claudiacodacy Sep 21, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production Bot Sep 21, 2026

Choose a reason for hiding this comment

Uh oh!

claudiacodacy Sep 21, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production Bot Sep 21, 2026

Choose a reason for hiding this comment

Uh oh!

claudiacodacy Sep 21, 2026

Choose a reason for hiding this comment

Uh oh!

alerizzo commented Sep 22, 2026

Code review

Uh oh!

claudiacodacy commented Sep 22, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

codacy-production Bot commented Sep 21, 2026 •

edited

Loading