Skip to content

quickstart.md

Latest commit

 

History

History
126 lines (83 loc) · 2.48 KB

quickstart.md

File metadata and controls

126 lines (83 loc) · 2.48 KB

Quickstart

1. Run Tests

From the repository root:

go -C .\app test ./...
go -C ./app test ./...

2. Check the Installed Version

Repository checkout helper:

Windows

.\sentilook.ps1 version

Debian or Ubuntu

./sentilook.sh version

Fedora

./sentilook.sh version

Direct module alternative:

go -C .\app run ./cmd/sentilook version

Expected output style:

Sentilook CLI (sentilook) v0.2.2 (commit ...)

3. Run a Demo Scan

Windows

.\sentilook.ps1 scan .\demo\demo-secrets --config .\app\configs\default.yaml

Debian or Ubuntu

./sentilook.sh scan ./demo/demo-secrets --config ./app/configs/default.yaml

Fedora

./sentilook.sh scan ./demo/demo-secrets --config ./app/configs/default.yaml

Expected behavior:

  • Sentilook prints run-specific report and audit paths
  • The process exits with code 1 when findings exist
  • The default HTML output is share-safe and uses masked previews plus reduced path exposure
  • The repository-root wrappers normalize the scan target, --config, and --out paths for you

4. Run a SARIF Export

.\sentilook.ps1 scan .\demo\demo-secrets --config .\app\configs\default.yaml --format sarif
./sentilook.sh scan ./demo/demo-secrets --config ./app/configs/default.yaml --format sarif

Expected behavior:

  • app/reports/latest.sarif.json is generated
  • Findings use masked previews only

5. Open the Latest Outputs

  • app/reports/latest.html
  • app/reports/latest.sarif.json
  • app/logs/audit.jsonl

Historical outputs remain available as timestamped files.

6. Docker Smoke Run

Use this when you want a clean Linux check without changing the host machine.

docker run --rm -v "$PWD:/workspace" -w /workspace/app golang:1.24-bookworm \
  bash -c 'go test ./... && go run ./cmd/sentilook scan ../demo/demo-secrets --config ./configs/strict.yaml --out ./reports || [ "$?" -eq 1 ]'

Notes:

  • the strict demo run exits with 1 because findings are expected
  • reports and logs are written back into the mounted repository

7. Local Operator Mode

Use local operator mode only when you need full local file paths during remediation.

report:
  share_safe_mode: false

Notes:

  • the HTML report will show full local file paths
  • operator-mode artifacts are local-only and should not be shared
  • raw secret previews remain masked even in operator mode