Code Quality

Code Quality is a code-quality observation platform. It runs a suite of static-analysis and security scanners across your source tree, collects every finding into a single database, and tracks how code quality changes over time.

Each argus run scans your repositories and records a run — tracked with timestamps, code statistics, and the config that produced it. Successive runs accumulate in the same database, so quality can be compared and trended across scans. Optional post-scan steps enrich findings with NVD CVE/CVSS data, derive cross-run issue lifecycle state (open / resolved / regressed), and render interactive reports for three audiences — customers, engineering leads, and developers fixing findings.

Quick Start

# Install all required tools
argus tools install

# Generate a starter config
argus init

# Build
./build.sh 0.1.0

# Dry run — see what would be scanned
argus run --src ~/workspace --config config.yaml --dry-run

# Full scan
argus run --src ~/workspace --config config.yaml

# Enrich the latest run with NVD CVE/CVSS data (optional post-scan step)
argus enrich --run latest
argus enrich --run latest --api-key $NVD_API_KEY   # higher NVD rate limit

# Derive cross-run issue lifecycle (run after each scan to keep issues up to date)
argus consolidate --run latest      # process the most recent run
argus consolidate --all             # bootstrap from all historical runs

# Query issue lifecycle state
argus issues stats                  # counts by status + severity + per-run trend
argus issues list                   # open issues (default)
argus issues list --status regressed --severity high   # regressions only

# Manage runs
argus runs list                     # show all runs
argus runs delete --run "Q1 Scan"   # remove a run and its data

# Interactive reports — three audiences, three subcommands
argus reports customer --latest           # HTML + PDF, aggregates only, externally distributable
argus reports internal --latest           # HTML + PDF, aggregates + methodology footer
argus reports dev      --latest           # HTML + XLSX, per-finding view with file paths and snippets

# Trend report across the last 12 runs (customer or internal; dev is always single-run)
argus reports internal --last 12

# Backfill via snapshot — scan the code as it was at a past date
argus snapshot create --src ~/workspace --config config.yaml \
  --name 2025-Q4 --date 2025-10-01 --out ~/snapshots
argus run --src ~/snapshots/2025-Q4 --config config.yaml \
  --name 2025-Q4-baseline --timestamp 20251001T00:00:00
argus snapshot destroy --path ~/snapshots/2025-Q4

Continue with:

CLI Reference — every command, subcommand, and flag
Configuration — the config.yaml reference: projects, tools, and profiles