CLI reference
Global flags
Argus shares one flag set across all its subcommands. A command ignores the flags it has no use for, so the same names mean the same thing everywhere.
Global flags
These apply to every subcommand.
| Property | Default | Description |
|---|---|---|
--pom | pom.xml | Path to the project POM Argus reads and patches. |
--config | config.yml | Path to the Argus config file. Its registries power version discovery and its libraries/couplings blocks carry remediation policy. |
--report | report.json | Path for the JSON scan report. |
--sarif | — | Path for an optional SARIF 2.1.0 report. Omitted when empty. |
--out | patches/ | Output directory for generated patch POMs. |
--maven-args | — | Extra arguments appended to every Maven invocation. |
--npm-test-script | — | package.json script name used for npm test qualification. Overrides ARGUS_NPM_TEST_SCRIPT. |
--dry-run | false | Plan and report without writing patches or publishing. |
--log-level | warn | Logging verbosity. |
--cache-dir | .argus-cache/ | Advisory cache directory. Overridden by ARGUS_CACHE_DIR. |
--cache-ttl | 24h | How long hydrated advisories stay cached before re-fetching. |
Merge request flags
These shape publication, and so matter to run and mr. Several default to GitLab CI variables, which is what makes the command so short inside a pipeline.
| Property | Default | Description |
|---|---|---|
--patches | patches/ | Directory of patch POMs to publish. |
--gitlab-url | $CI_SERVER_URL | GitLab server URL. Falls back to CI_SERVER_URL, then https://gitlab.com. |
--project-id | $CI_PROJECT_ID | Target GitLab project. Falls back to CI_PROJECT_ID. |
--target-branch | $CI_DEFAULT_BRANCH | Branch merge requests target. Falls back to CI_DEFAULT_BRANCH, then main. |
--labels | security,argus | Comma-separated MR labels. Overridden by ARGUS_LABELS. |
--branch-prefix | argus | Source branch namespace for generated MRs. See ARGUS_BRANCH_PREFIX. |
--commit-prefix | security: | Prefix for generated commit messages. See ARGUS_COMMIT_MESSAGE_PREFIX. |
--breaking-change-label | Breaking Change | Label applied to merge requests that require a major version bump. |
--mr-appendix | — | Path to a Markdown file appended to every generated MR description (policy notice, comms). See ARGUS_MR_APPENDIX and Merge requests. |
Run-only flags
These two only affect run, where they switch off the publish and curate phases respectively.
| Property | Default | Description |
|---|---|---|
--no-publish | false | Run the pipeline through qualification but open no merge requests. |
--no-curate | false | Skip the stale-override curation assessment. |
Precedence
Where a flag and an environment variable cover the same ground, the flag wins: --labels overrides ARGUS_LABELS, --branch-prefix overrides ARGUS_BRANCH_PREFIX, and so on. The GitLab connection flags fall back to the matching CI_* variables when you do not pass them. The complete environment-variable list is on the Environment variables page.