cli
cli copied to clipboard
Add new subcommand fix that supports issue remediation
Overview
Users should be able to run phylum fix <pkg-lock-file> to address issues in their projects. The fix subcommand should attempt to maximize the user score by remediating as many issues as possible. Fixes should update the package file(s).
There should be a few options for the fix subcommand:
phylum fix <pkg-file> <issue-id>Fix all issues of the given issue id in a projectphylum fix <pkg-file> <issue-id> <pkgName@pkgVersion>Fix the specified issue for the specific dependency
Acceptance Criteria
- [ ] The CLI should implement a new subcommand
phylum fixwith support for specifying issue IDs and specific dependencies - [ ] The CLI should take a path to a package lock file
- [ ] Given a package lock file that does not exist or is inaccessible we should clearly notify the user
- [ ] Given a valid package lock path, we should submit it to the API for possible fixes and remediations (see: https://github.com/phylum-dev/api/issues/156)
- [ ] Fixes and remediations received from the API should be applied to the specified package lock file
- [ ] Any issues that are unable to be remediated should be displayed to the user
- [ ] The user should be prompted before proposed fixes are made to their package lock file
- [ ] If multiple fixes exist for a specific issue, prompt the user to select an option
- [ ] By default, and with no other options,
phylum fixwill attempt to fix the most issues to maximize the user score. - [ ] Once a fix has been applied, prompt user of any next steps. For example, in NPM we might update the
package.jsonfile, but the user should be responsible for updating theirpackage-lock.jsonfile. We might instruct them to “Fixes have been applied and yourpackage.jsonfile has been updated! Runnpm install --package-lock-onlyto generate a new package lock file”.