apiiro-scan（apiiro 扫描）

Apiiro Scan

Security scanning via the Apiiro CLI.

Fast Scan

Quick local scan for secrets and OSS vulnerabilities. Requires a git repo with an origin remote. Auto-detects changed files when none specified.

apiiro fast-scan secrets                          # Scan for secrets
apiiro fast-scan secrets src/config.ts            # Scan specific files
apiiro fast-scan secrets --staged                 # Staged files only (pre-commit)
apiiro fast-scan oss package.json bun.lock        # OSS vulnerabilities
apiiro fast-scan all                              # Both concurrently
apiiro fast-scan config                           # Get scan configuration

Options: --staged, --full (scan entire file, not just git-changed lines), --timeout <ms> (default: 2000), -o, --output <json|text>, -f, --file <path>.

Exit codes: 0 = clean, 1 = high/critical risks found.

Diff Scan

Compare two git references for security risks. Primary CI/CD integration point.

apiiro diff-scan -b main -c feature-branch -r https://github.com/org/repo --wait
apiiro diff-scan -b main -c feature-branch -r https://github.com/org/repo --wait --wait-external
apiiro diff-scan -b abc123 -c def456 -r <repo-url> --baseline-type Commit --candidate-type Commit --wait
apiiro diff-scan -s <scan-id>                     # Check existing scan status
apiiro diff-scan -i                               # Interactive mode

Exit codes: 0 = success/warn, 1 = blocked/failed, 2 = scan still pending.

Pre-commit Hook

apiiro hooks pre-commit install                   # Install (scans all types)
apiiro hooks pre-commit install --scan-type secrets --force
apiiro hooks pre-commit status
apiiro hooks pre-commit uninstall

Skip temporarily with git commit --no-verify.

Global Options

-o, --output <json|text>, -f, --file <path>, --no-color.