eslint-plugin-ai-guard 1.2.3 → 1.2.4

package/dist/cli/index.js

@@ -1259,11 +1259,13 @@ function sanitizeSarifTags(tags) {
   );
 }
 function sanitizeSarifProperties(props) {
+  const confidence = props.confidence ?? "low";
   return {
     tags: sanitizeSarifTags(props.tags),
-    confidence: props.confidence ?? "low",
+    confidence,
     category: props.category ?? "AI Patterns",
-    "problem.severity": props.problemSeverity ?? "low"
+    "security-severity": confidenceToSecuritySeverity(confidence),
+    precision: confidenceToPrecision(confidence)
   };
 }
 function sanitizeSarifRule(rule) {
@@ -1295,6 +1297,34 @@ function sanitizeSarifLog(log2) {
     }))
   };
 }
+function confidenceToSecuritySeverity(confidence) {
+  switch (confidence) {
+    case "high":
+      return "8.0";
+    case "medium":
+      return "5.0";
+    case "low":
+      return "3.0";
+    case "informational":
+      return "1.0";
+    default:
+      return "3.0";
+  }
+}
+function confidenceToPrecision(confidence) {
+  switch (confidence) {
+    case "high":
+      return "high";
+    case "medium":
+      return "medium";
+    case "low":
+      return "low";
+    case "informational":
+      return "low";
+    default:
+      return "low";
+  }
+}
 function confidenceToSarifLevel(confidence) {
   switch (confidence) {
     case "high":
@@ -1323,20 +1353,6 @@ function confidenceToRank(confidence) {
       return 30;
   }
 }
-function confidenceToGitHubSeverity(confidence) {
-  switch (confidence) {
-    case "high":
-      return "high";
-    case "medium":
-      return "medium";
-    case "low":
-      return "low";
-    case "informational":
-      return "recommendation";
-    default:
-      return "low";
-  }
-}
 function filePathToUri(filePath) {
   return filePath.replace(/\\/g, "/");
 }
@@ -1384,8 +1400,7 @@ function buildRuleDescriptors(ruleIds) {
       properties: sanitizeSarifProperties({
         tags: rawTags,
         confidence,
-        category,
-        problemSeverity: confidenceToGitHubSeverity(confidence)
+        category
       })
     });
   });
@@ -1419,11 +1434,87 @@ function buildSarifResult(issue, file) {
     ],
     properties: {
       confidence: confidence ?? "low",
+      "security-severity": confidenceToSecuritySeverity(confidence),
+      precision: confidenceToPrecision(confidence),
       ...asyncRiskType && { asyncRiskType },
       ...category && { category }
     }
   };
 }
+function enhanceTagsWithGitHubSemantics(ruleId, baseTags) {
+  const category = ISSUE_CATEGORY[ruleId];
+  const tags = [...baseTags];
+  if (category === "Security" || ruleId.includes("secret") || ruleId.includes("eval") || ruleId.includes("sql") || ruleId.includes("deserialize") || ruleId.includes("auth")) {
+    tags.push("security", "correctness", "reliability");
+  } else {
+    tags.push("correctness", "reliability");
+  }
+  return sanitizeSarifTags(tags);
+}
+function normalizeSarifForGitHub(log2) {
+  const normalizedRuns = log2.runs.map((run) => {
+    const rules = run.tool.driver.rules.map((rule) => {
+      const confidence = ISSUE_CONFIDENCE[rule.id];
+      const properties = rule.properties || {};
+      properties["security-severity"] = confidenceToSecuritySeverity(confidence);
+      properties["precision"] = confidenceToPrecision(confidence);
+      const currentTags = properties.tags || [];
+      properties.tags = enhanceTagsWithGitHubSemantics(rule.id, currentTags);
+      delete properties["problem.severity"];
+      const defaultConfiguration = rule.defaultConfiguration || { level: "warning" };
+      let normalizedConfigLevel = defaultConfiguration.level;
+      if (!["error", "warning", "note", "none"].includes(normalizedConfigLevel)) {
+        normalizedConfigLevel = confidenceToSarifLevel(confidence);
+      }
+      if (normalizedConfigLevel === "none") {
+        normalizedConfigLevel = "note";
+      }
+      return {
+        ...rule,
+        defaultConfiguration: {
+          ...defaultConfiguration,
+          level: normalizedConfigLevel
+        },
+        properties
+      };
+    });
+    const results = run.results.map((result) => {
+      const confidence = ISSUE_CONFIDENCE[result.ruleId];
+      const properties = result.properties || {};
+      properties["security-severity"] = confidenceToSecuritySeverity(confidence);
+      properties["precision"] = confidenceToPrecision(confidence);
+      let normalizedLevel = result.level;
+      if (!["error", "warning", "note", "none"].includes(normalizedLevel)) {
+        normalizedLevel = confidenceToSarifLevel(confidence);
+      }
+      if (normalizedLevel === "none") {
+        normalizedLevel = "note";
+      }
+      const kind = confidence === "informational" ? "informational" : "fail";
+      return {
+        ...result,
+        level: normalizedLevel,
+        kind,
+        properties
+      };
+    });
+    return {
+      ...run,
+      tool: {
+        ...run.tool,
+        driver: {
+          ...run.tool.driver,
+          rules
+        }
+      },
+      results
+    };
+  });
+  return {
+    ...log2,
+    runs: normalizedRuns
+  };
+}
 function buildSarifLog(result, version = PKG_VERSION) {
   const usedRuleIds = collectUsedRuleIds(result);
   const rules = buildRuleDescriptors(usedRuleIds);
@@ -1457,7 +1548,7 @@ function buildSarifLog(result, version = PKG_VERSION) {
       }
     ]
   };
-  return sanitizeSarifLog(log2);
+  return normalizeSarifForGitHub(sanitizeSarifLog(log2));
 }
 function sarifToJson(log2) {
   return JSON.stringify(log2, null, 2);
@@ -1470,7 +1561,7 @@ function buildSarifDebugInfo(result) {
     const category = ISSUE_CATEGORY[id] ?? "AI Patterns";
     const categorySlug = category.toLowerCase().replace(/\s+/g, "-");
     const rawTags = [...meta?.tags ?? ["ai-guard"], categorySlug];
-    const sanitizedTags = sanitizeSarifTags(rawTags);
+    const sanitizedTags = enhanceTagsWithGitHubSemantics(id, rawTags);
     return {
       id,
       rawTags,
@@ -1478,11 +1569,29 @@ function buildSarifDebugInfo(result) {
       hasDuplicatesInRaw: rawTags.length !== new Set(rawTags).size,
       confidence: confidence ?? "low",
       category,
-      level: confidenceToSarifLevel(confidence)
+      level: confidenceToSarifLevel(confidence),
+      securitySeverity: confidenceToSecuritySeverity(confidence),
+      precision: confidenceToPrecision(confidence)
     };
   });
+  const resultsEmitted = [];
+  for (const file of result.files) {
+    for (const issue of file.issues) {
+      const confidence = ISSUE_CONFIDENCE[issue.ruleId];
+      resultsEmitted.push({
+        ruleId: issue.ruleId,
+        level: confidenceToSarifLevel(confidence),
+        kind: confidence === "informational" ? "informational" : "fail",
+        securitySeverity: confidenceToSecuritySeverity(confidence),
+        precision: confidenceToPrecision(confidence),
+        filePath: file.filePath,
+        line: issue.line
+      });
+    }
+  }
   return {
     rulesEmitted,
+    resultsEmitted,
     totalResults: result.files.reduce((n, f) => n + f.issues.length, 0),
     version: PKG_VERSION
   };
@@ -2021,21 +2130,47 @@ function registerRunCommand(program2) {
       const sarifJson = sarifToJson(sarifLog);
       if (opts.debugSarif) {
         const debugInfo = buildSarifDebugInfo(result);
-        process.stderr.write("\n[debug-sarif] SARIF Tag Normalization Trace\n");
+        process.stderr.write("\n[debug-sarif] SARIF GitHub Compatibility Trace\n");
         process.stderr.write("[debug-sarif] \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
+        process.stderr.write("[debug-sarif] Rules Emitted:\n");
         for (const r of debugInfo.rulesEmitted) {
-          process.stderr.write(`[debug-sarif] ${r.id}
+          process.stderr.write(`[debug-sarif]   - ${r.id}:
+`);
+          process.stderr.write(`[debug-sarif]     confidence:        ${r.confidence}
+`);
+          process.stderr.write(`[debug-sarif]     level:             ${r.level}
+`);
+          process.stderr.write(`[debug-sarif]     security-severity: ${r.securitySeverity}
+`);
+          process.stderr.write(`[debug-sarif]     precision:         ${r.precision}
 `);
-          process.stderr.write(`[debug-sarif]   raw:       ${JSON.stringify(r.rawTags)}
+          process.stderr.write(`[debug-sarif]     raw tags:          ${JSON.stringify(r.rawTags)}
 `);
-          process.stderr.write(`[debug-sarif]   sanitized: ${JSON.stringify(r.sanitizedTags)}
+          process.stderr.write(`[debug-sarif]     normalized tags:   ${JSON.stringify(r.sanitizedTags)}
 `);
           if (r.hasDuplicatesInRaw) {
-            process.stderr.write(`[debug-sarif]   \u26A0 had duplicates \u2014 deduplicated
+            process.stderr.write(`[debug-sarif]     \u26A0 had duplicates \u2014 deduplicated
+`);
+          }
+        }
+        process.stderr.write("\n[debug-sarif] Results Emitted:\n");
+        if (debugInfo.resultsEmitted.length === 0) {
+          process.stderr.write("[debug-sarif]   (none)\n");
+        } else {
+          for (const res of debugInfo.resultsEmitted) {
+            process.stderr.write(`[debug-sarif]   - ${res.ruleId} (${res.filePath}:${res.line}):
+`);
+            process.stderr.write(`[debug-sarif]     level:             ${res.level}
+`);
+            process.stderr.write(`[debug-sarif]     kind:              ${res.kind}
+`);
+            process.stderr.write(`[debug-sarif]     security-severity: ${res.securitySeverity}
+`);
+            process.stderr.write(`[debug-sarif]     precision:         ${res.precision}
 `);
           }
         }
-        process.stderr.write("\n");
+        process.stderr.write("[debug-sarif] \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n");
       }
       if (opts.sarifOutput) {
         import_fs4.default.writeFileSync(opts.sarifOutput, sarifJson, "utf-8");
@@ -2388,7 +2523,7 @@ function registerChangedCommand(program2) {
     "--max-warnings <n>",
     "Fail if warnings exceed this count",
     (v) => Number.parseInt(v, 10)
-  ).option("--verbose", "Expand all findings (disable grouping)").option("--quiet", "Show errors only").option("--debug-timing", "Print per-phase timing diagnostics").option("--debug-git", "Print full git resolution trace (useful for diagnosing zero-file issues)").option("--debug-ci", "Print CI environment state (GITHUB_* vars, SARIF path, summary path)").action(async (opts) => {
+  ).option("--verbose", "Expand all findings (disable grouping)").option("--quiet", "Show errors only").option("--debug-timing", "Print per-phase timing diagnostics").option("--debug-git", "Print full git resolution trace (useful for diagnosing zero-file issues)").option("--debug-ci", "Print CI environment state (GITHUB_* vars, SARIF path, summary path)").option("--debug-sarif", "Print SARIF tag normalization trace \u2014 diagnose duplicate-tag schema issues").action(async (opts) => {
     const preset = opts.strict ? "strict" : opts.security ? "security" : "recommended";
     const inCI = isGitHubActions();
     const baseRef = opts.base ?? (opts.pr || inCI ? getGitHubBaseRef() : void 0);
@@ -2500,8 +2635,56 @@ function handleResults(result, opts, preset, scanMode, changedFilesCount, inCI,
   if (opts.sarif) {
     const sarifLog = buildSarifLog(result);
     const sarifJson = sarifToJson(sarifLog);
+    if (opts.debugSarif) {
+      const debugInfo = buildSarifDebugInfo(result);
+      process.stderr.write("\n[debug-sarif] SARIF GitHub Compatibility Trace\n");
+      process.stderr.write("[debug-sarif] \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
+      process.stderr.write("[debug-sarif] Rules Emitted:\n");
+      for (const r of debugInfo.rulesEmitted) {
+        process.stderr.write(`[debug-sarif]   - ${r.id}:
+`);
+        process.stderr.write(`[debug-sarif]     confidence:        ${r.confidence}
+`);
+        process.stderr.write(`[debug-sarif]     level:             ${r.level}
+`);
+        process.stderr.write(`[debug-sarif]     security-severity: ${r.securitySeverity}
+`);
+        process.stderr.write(`[debug-sarif]     precision:         ${r.precision}
+`);
+        process.stderr.write(`[debug-sarif]     raw tags:          ${JSON.stringify(r.rawTags)}
+`);
+        process.stderr.write(`[debug-sarif]     normalized tags:   ${JSON.stringify(r.sanitizedTags)}
+`);
+        if (r.hasDuplicatesInRaw) {
+          process.stderr.write(`[debug-sarif]     \u26A0 had duplicates \u2014 deduplicated
+`);
+        }
+      }
+      process.stderr.write("\n[debug-sarif] Results Emitted:\n");
+      if (debugInfo.resultsEmitted.length === 0) {
+        process.stderr.write("[debug-sarif]   (none)\n");
+      } else {
+        for (const res of debugInfo.resultsEmitted) {
+          process.stderr.write(`[debug-sarif]   - ${res.ruleId} (${res.filePath}:${res.line}):
+`);
+          process.stderr.write(`[debug-sarif]     level:             ${res.level}
+`);
+          process.stderr.write(`[debug-sarif]     kind:              ${res.kind}
+`);
+          process.stderr.write(`[debug-sarif]     security-severity: ${res.securitySeverity}
+`);
+          process.stderr.write(`[debug-sarif]     precision:         ${res.precision}
+`);
+        }
+      }
+      process.stderr.write("[debug-sarif] \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n");
+    }
     if (resolvedSarifPath) {
       import_fs5.default.writeFileSync(resolvedSarifPath, sarifJson, "utf-8");
+      if (opts.debugSarif) {
+        process.stderr.write(`[debug-sarif] SARIF written to: ${resolvedSarifPath}
+`);
+      }
     } else {
       console.log(sarifJson);
     }