CLI reference

argus run

The complete pipeline in one command. run discovers vulnerabilities, plans and qualifies fixes, opens merge requests, and reconciles old ones. Everything Argus does, end to end.

Synopsis

terminal

export GITLAB_PRIVATE_TOKEN=glpat-your-token-here

argus run \
  --pom pom.xml \
  --gitlab-url https://gitlab.example.com \
  --project-id 4567

export GITLAB_PRIVATE_TOKEN=glpat-your-token-here

argus run \
  --pom pom.xml \
  --gitlab-url https://gitlab.example.com \
  --project-id 4567

What it does

run is the command you schedule. It walks the full pipeline: it builds the SBOM and queries the enabled advisory sources, plans a remediation for each advisory via the strategy ladder, validates every patched POM with Maven, opens a merge request for each qualified fix, and finally reconciles, closing merge requests it previously opened that no longer correspond to outstanding work. Given the same project and advisories, it makes the same decisions every time.

Talking to GitLab

Publishing needs three things: where GitLab lives, which project to publish into, and a token to authenticate with. Pass the first two as --gitlab-url and --project-id, and supply the token in the GITLAB_PRIVATE_TOKEN environment variable. Inside GitLab CI you can usually omit the flags entirely; they fall back to the standard CI_SERVER_URL, CI_PROJECT_ID, and CI_DEFAULT_BRANCH variables:

terminal

# Inside GitLab CI, the connection details come from CI_* variables
argus run

# Inside GitLab CI, the connection details come from CI_* variables
argus run

Turning phases off

Two flags let you stop short of the full run. --no-publish writes local POM artifacts and runs the default final remediation pass against them, so cleanup-derived artifacts are rescanned, any still-fixable vulnerabilities are added, and the final local POM is verified with mvn clean verify. It opens no merge requests. --no-curate skips the stale-override assessment that run otherwise performs alongside remediation.

terminal

# Produce final verified local patches, but stop short of publishing
argus run --no-publish

# Publish, but skip the stale-override curation pass
argus run --no-curate

# Produce final verified local patches, but stop short of publishing
argus run --no-publish

# Publish, but skip the stale-override curation pass
argus run --no-curate

Reconciliation

On every run, Argus reconciles the merge requests it manages: when a remediation it previously opened is no longer needed (because the dependency was upgraded, the advisory was withdrawn, or a human merged the fix), the corresponding merge request is closed. It only ever touches merge requests it owns; anything a person opened is left alone. The behaviour is tunable through ARGUS_RECONCILIATION_STRATEGY and related variables. See Merge requests.