STG-4451, STG-4475, STG-4478: dual-mode CLI with microservices installation support

- mdast_cli_core/microservices.py: Clark facade client (Bearer auth, md5-first
  multipart upload with X-File-Size, application_md5 precheck, fsm_locked two-phase
  scan creation, scanyon-native (stage, status) polling, /rest/scans/{id}/report)
- mdast_cli_core/factory.py: installation mode resolution (MDAST_CLI_MODE env or
  probe autodetect), monolith path unchanged
- mdast_cli/ms_flow.py: microservices scan flow with pre-check gate (exit code 8),
  engines preflight by type/status, reports to user-provided paths
- tests/: 81 tests (unit, contract, smoke incl. monolith regression, security)
- CI: tests workflow + test gates before PyPI/Docker publishing

Author: npinaev

.github/workflows/docker-hub-publish.yml

@@ -1,38 +1,50 @@
-name: Publish mdast_cli image to Docker Hub
-
-on:
-  push:
-    branches:
-      - main
-
-jobs:
-  build-n-publish-docker:
-    name: Docker Hub - Publish mdast_cli
-    runs-on: ubuntu-22.04
-
-    steps:
-      - uses: actions/checkout@v3
-
-      - name: docker login
-        env:
-          DOCKER_USER: ${{secrets.DOCKER_USER}}
-          DOCKER_PASSWORD: ${{secrets.DOCKER_PASSWORD}}
-        run:
-          docker login -u $DOCKER_USER -p $DOCKER_PASSWORD
-
-      - name: Build the Docker image
-
-        run: docker build . --file Dockerfile -t mobilesecurity/mdast_cli:2026.6.1 -t mobilesecurity/mdast_cli:latest
-
-
-      - name: Docker Hub push latest image
-        run: docker push mobilesecurity/mdast_cli:latest
-
-      - name: Docker Hub push tagged image
-
-        run: docker push mobilesecurity/mdast_cli:2026.6.1
-
-
-
-
-
+name: Publish mdast_cli image to Docker Hub
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  tests:
+    name: Tests gate before publish
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - run: pip install -r requirements.txt -r requirements-dev.txt
+      - run: pytest -q
+
+  build-n-publish-docker:
+    name: Docker Hub - Publish mdast_cli
+    needs: tests
+    runs-on: ubuntu-22.04
+
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: docker login
+        env:
+          DOCKER_USER: ${{secrets.DOCKER_USER}}
+          DOCKER_PASSWORD: ${{secrets.DOCKER_PASSWORD}}
+        run:
+          docker login -u $DOCKER_USER -p $DOCKER_PASSWORD
+
+      - name: Build the Docker image
+
+        run: docker build . --file Dockerfile -t mobilesecurity/mdast_cli:2026.6.1 -t mobilesecurity/mdast_cli:latest
+
+
+      - name: Docker Hub push latest image
+        run: docker push mobilesecurity/mdast_cli:latest
+
+      - name: Docker Hub push tagged image
+
+        run: docker push mobilesecurity/mdast_cli:2026.6.1
+
+
+
+
+

.github/workflows/python-publish.yml

@@ -6,8 +6,20 @@ on:
       - main
 
 jobs:
+  tests:
+    name: Tests gate before publish
+    runs-on: ubuntu-22.04
+    steps:
+    - uses: actions/checkout@v4
+    - uses: actions/setup-python@v5
+      with:
+        python-version: '3.12'
+    - run: pip install -r requirements.txt -r requirements-dev.txt
+    - run: pytest -q
+
   build-n-publish:
     name: Build and publish mdast_cli 🐍 distributions to PyPI
+    needs: tests
     runs-on: ubuntu-22.04
     steps:
     - uses: actions/checkout@master

.github/workflows/tests.yml

@@ -0,0 +1,26 @@
+name: Tests
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  tests:
+    name: pytest (unit, contract, smoke, security)
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python 3.12
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Install dependencies
+        run: pip install -r requirements.txt -r requirements-dev.txt
+
+      - name: Run full test suite
+        run: pytest -q
+
+      - name: Security tests gate
+        run: pytest -q -m security

mdast_cli/__init__.py

@@ -0,0 +1 @@
+__version__ = '2026.6.1'

mdast_cli/helpers/const.py

@@ -43,3 +43,51 @@ class DastState:
 # HTTP timeout constants
 HTTP_REQUEST_TIMEOUT = 30
 HTTP_DOWNLOAD_TIMEOUT = 300
+
+
+# --- Microservices installation (Clark facade, scanyon-native contract) ---
+
+class ScanStage:
+    CREATED = 'CREATED'
+    START = 'START'
+    WORKING = 'WORKING'
+    STOP = 'STOP'
+    SUCCESS = 'SUCCESS'
+    FAIL = 'FAIL'
+
+
+class ScanStageStatus:
+    INITIAL = 'INITIAL'
+    PROCESSING = 'PROCESSING'
+    WAITING = 'WAITING'
+    COMPLETE = 'COMPLETE'
+    PARTIAL_COMPLETE = 'PARTIAL_COMPLETE'
+    FAIL = 'FAIL'
+
+
+# Terminal (stage, status) pairs, confirmed with scanyon FSM (STG-4475).
+# STOP is transitional: a stopped scan finishes as SUCCESS/COMPLETE or SUCCESS/PARTIAL_COMPLETE.
+TERMINAL_SCAN_PAIRS = {
+    (ScanStage.SUCCESS, ScanStageStatus.COMPLETE),
+    (ScanStage.SUCCESS, ScanStageStatus.PARTIAL_COMPLETE),
+    (ScanStage.FAIL, ScanStageStatus.FAIL),
+}
+PRE_START_STAGES = {ScanStage.CREATED, ScanStage.START}
+ACTIVE_STAGES = {ScanStage.WORKING, ScanStage.STOP}
+
+# Eucalyptus engine contract: platform in `type`, liveness in `status` (not `state`)
+ENGINE_ACTIVE_STATUS = 'STARTED'
+OS_ANDROID = 'ANDROID'
+OS_IOS = 'IOS'
+
+# Installation mode selection (no new CLI flags by contract, env vars only)
+MODE_ENV_VAR = 'MDAST_CLI_MODE'
+UPLOAD_TIMEOUT_ENV_VAR = 'MDAST_UPLOAD_TIMEOUT'
+TLS_VERIFY_ENV_VAR = 'MDAST_TLS_VERIFY'
+MODE_AUTO = 'auto'
+MODE_MONOLITH = 'monolith'
+MODE_MICROSERVICES = 'microservices'
+
+# Clark upload contract (STG-4451): server-side upload_timeout query bounds
+UPLOAD_TIMEOUT_MIN = 1
+UPLOAD_TIMEOUT_MAX = 300

mdast_cli/helpers/exit_codes.py

@@ -24,7 +24,10 @@ class ExitCode(IntEnum):
 
     AUTH_ERROR = 7
     """Authentication or authorization error."""
-    
+
+    PRECHECK_BLOCKED = 8
+    """Scan pre-check returned blocking warnings (microservices installation gate)."""
+
     INTERNAL_ERROR = 1
     """Internal application error (default for unexpected errors)."""
 

mdast_cli/mdast_scan.py

@@ -27,7 +27,12 @@
 from mdast_cli.helpers.exit_codes import ExitCode
 from mdast_cli.helpers.helpers import check_app_md5
 from mdast_cli_core.token import mDastToken as mDast
+from mdast_cli_core.factory import (MODE_MICROSERVICES, ModeDetectionError, resolve_installation_mode,
+                                    tls_verify_enabled)
 from mdast_cli.cr_report_generator import generate_cr
+from mdast_cli import __version__
+
+USER_AGENT = f'mdast_cli/{__version__}'
 
 logging.basicConfig(level=logging.INFO, format='%(asctime)s - %(levelname)s %(message)s',
                     datefmt='%d/%m/%Y %H:%M:%S', stream=sys.stdout)
@@ -592,6 +597,20 @@ def main():
         print(f'DOWNLOAD_PATH={app_file}')
         sys.exit(ExitCode.SUCCESS)
 
+    try:
+        installation_mode = resolve_installation_mode(url, token, company_id,
+                                                      verify=tls_verify_enabled())
+    except ModeDetectionError as ex:
+        logger.error(str(ex))
+        sys.exit(ExitCode.AUTH_ERROR if ex.auth_error else ExitCode.NETWORK_ERROR)
+
+    if installation_mode == MODE_MICROSERVICES:
+        from mdast_cli.ms_flow import run_microservices_flow
+        run_microservices_flow(arguments, url, token, app_file, appstore_app_md5,
+                               user_agent=USER_AGENT, verify=tls_verify_enabled())
+        logger.info('Job completed successfully!')
+        sys.exit(ExitCode.SUCCESS)
+
     mdast = mDast(url, token, company_id)
     get_architectures_resp = mdast.get_architectures()