build_and_scan.sh

#!/bin/bash
# ============================================================
# build_and_scan.sh
# One-command: build docker image -> run scan -> extract results
# Usage: bash build_and_scan.sh
# ============================================================
set -e

IMAGE_NAME="codeql-curl-audit"
CONTAINER_NAME="codeql-scan"
OUTPUT_DIR="./output"

echo "[1/4] Building Docker image (this may take 10-20 minutes on first run)..."
docker build -t ${IMAGE_NAME} .

echo "[2/4] Creating container..."
docker rm -f ${CONTAINER_NAME} 2>/dev/null || true
docker create --name ${CONTAINER_NAME} ${IMAGE_NAME}

echo "[3/4] Extracting results..."
mkdir -p ${OUTPUT_DIR}
docker cp ${CONTAINER_NAME}:/output/results.sarif ${OUTPUT_DIR}/
docker cp ${CONTAINER_NAME}:/output/results.csv ${OUTPUT_DIR}/

# Also copy source for context extraction later
echo "[3.5/4] Extracting curl source (for LLM context extraction)..."
docker cp ${CONTAINER_NAME}:/src/curl ${OUTPUT_DIR}/curl-src

echo "[4/4] Cleanup container..."
docker rm ${CONTAINER_NAME}

echo ""
echo "=== Done ==="
echo "Results:"
echo "  SARIF report: ${OUTPUT_DIR}/results.sarif"
echo "  CSV report:   ${OUTPUT_DIR}/results.csv"
echo "  Source code:   ${OUTPUT_DIR}/curl-src/"
echo ""
echo "Next step: run the SARIF parser to extract vulnerability context"
echo "  python3 codes/parse_sarif.py ${OUTPUT_DIR}/results.sarif ${OUTPUT_DIR}/curl-src"