Argus

CLI reference

The Argus CLI

Argus is a single binary. For everyday use there is really only one command, run, with the rest reserved for development and debugging.

Command shape

Every invocation is a subcommand followed by flags. The flags are shared across subcommands (a subcommand ignores the ones it has no use for), which is why the reference splits them into one Global flags page rather than repeating them on every command.

usage
argus <command> [options]

Commands:
  run        Discover, plan, qualify, and publish remediation in one run
  version    Show version info
  help       Show the help menu

Development commands:
  scan       Generate the SBOM and query the advisory sources
  fix        Generate format-preserving patch POM files
  curate     Detect and report stale dependency overrides
  mr         Create or update GitLab merge requests for generated patches

The command you need

run performs the entire pipeline end to end: it builds the SBOM, matches advisories, plans and qualifies fixes, opens merge requests, and reconciles stale ones. It is the command Argus is designed around, and the only one most users ever type.

Development commands

The remaining subcommands each stop at a particular stage of the pipeline, which is useful when you are working on Argus itself or diagnosing a run. scan only looks and changes nothing. fix plans and writes patched POMs to disk without touching any forge. mr takes patches that already exist and opens merge requests for them. curate reports on overrides that may have outlived their usefulness. In production, run does all of this for you in one pass.

The default command

If you pass a subcommand Argus does not recognise, it falls back to scan rather than failing. That is the safest possible default, since scanning never changes anything. Passing no arguments at all prints the help menu.

Reference

Development commands