Basic implementation of compliance scan command

[oxisto]

This is a basic implementation of the compliance scan command. It will output an example SARIF finding, but will do an actual CPG translation.

The syntax is the following: codyze compliance --project-dir [project-directory] --sources [your-sources]

This will do an actual CPG translation and print a "note" SARIF finding on the console

[codecov]

Codecov Report

Attention: Patch coverage is 85.91549% with 20 lines in your changes missing coverage. Please review.

Project coverage is 77.93%. Comparing base (9dae567) to head (78fb721).

Files with missing lines	Patch %	Lines
.../main/kotlin/de/fraunhofer/aisec/codyze/Project.kt	85.71%	4 Missing and 7 partials ⚠️
...ain/kotlin/de/fraunhofer/aisec/codyze/QueryHost.kt	81.25%	1 Missing and 2 partials ⚠️
...n/de/fraunhofer/aisec/codyze/compliance/Command.kt	93.10%	1 Missing and 1 partial ⚠️
...e/fraunhofer/aisec/codyze/QueryScriptDefinition.kt	88.23%	1 Missing and 1 partial ⚠️
...fraunhofer/aisec/codyze/compliance/SecurityGoal.kt	50.00%	0 Missing and 1 partial ⚠️
...n/kotlin/de/fraunhofer/aisec/codyze/Application.kt	0.00%	1 Missing ⚠️

Additional details and impacted files

Files with missing lines	Coverage Δ
...fraunhofer/aisec/codyze/compliance/SecurityGoal.kt	73.17% <50.00%> (ø)
...n/kotlin/de/fraunhofer/aisec/codyze/Application.kt	0.00% <0.00%> (ø)
...n/de/fraunhofer/aisec/codyze/compliance/Command.kt	93.10% <93.10%> (ø)
...e/fraunhofer/aisec/codyze/QueryScriptDefinition.kt	88.23% <88.23%> (ø)
...ain/kotlin/de/fraunhofer/aisec/codyze/QueryHost.kt	81.25% <81.25%> (ø)
.../main/kotlin/de/fraunhofer/aisec/codyze/Project.kt	85.71% <85.71%> (ø)

... and 4 files with indirect coverage changes

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[KuechA]

I'm not the biggest fan of these hardcoded paths and would prefer passing an argument in the CLI

[oxisto]

My idea for the future would be to replace the security-goals.yaml with a project.yaml or something similar, which basically describes the whole project structure and has the "authority" to change these paths, I am not sure if they are really suitable for CLI args. My suggestion is to extract these hardcoded paths into a Project structure (which is already prepare) so we can make them dynamic in the future.

[fwendland]

I wouldn't inherit from ProjectCommand because I currently see no reason to specify a project dir or CPG translation options. We're also not calling analyze().

Should we use use a CliktCommand for now?