eslint-plugin-ai-guard 1.2.6 → 1.2.7

package/dist/cli/index.js

@@ -1206,6 +1206,7 @@ async function runEslint(options) {
 }
 
 // cli/utils/sarif.ts
+var import_crypto = require("crypto");
 var import_path3 = __toESM(require("path"));
 
 // cli/utils/version.ts
@@ -1233,6 +1234,8 @@ function readVersion() {
 var PKG_VERSION = _version ?? (_version = readVersion());
 
 // cli/utils/sarif.ts
+var SARIF_AUTOMATION_ID = "ai-guard";
+var FINGERPRINT_KEY = "ai-guard/v1";
 var RULE_DOCS = {
   "ai-guard/no-empty-catch": { shortDesc: "Empty catch block silently swallows errors", tags: ["reliability"] },
   "ai-guard/no-broad-exception": { shortDesc: "Catching broad Exception/Error masks specific failures", tags: ["reliability"] },
@@ -1375,6 +1378,16 @@ function normalizeSarifPath(filePath, repoRoot) {
   }
   return normalized;
 }
+function generateStableFingerprint(normalizedUri, ruleId, startLine, message) {
+  const normalizedMessage = message.trim().toLowerCase().replace(/\s+/g, " ");
+  const input = [
+    ruleId,
+    normalizedUri.toLowerCase(),
+    String(startLine),
+    normalizedMessage
+  ].join(":");
+  return (0, import_crypto.createHash)("sha256").update(input, "utf8").digest("hex");
+}
 function collectUsedRuleIds(result) {
   const ids = /* @__PURE__ */ new Set();
   for (const file of result.files) {
@@ -1429,12 +1442,23 @@ function buildSarifResult(issue, file, repoRoot) {
   const asyncRiskType = ISSUE_ASYNC_RISK_TYPE[issue.ruleId];
   const category = ISSUE_CATEGORY[issue.ruleId];
   const sarifUri = normalizeSarifPath(file.filePath, repoRoot);
+  const fingerprint = generateStableFingerprint(
+    sarifUri,
+    issue.ruleId,
+    Math.max(1, issue.line),
+    issue.message
+  );
   return {
     ruleId: issue.ruleId,
     level: confidenceToSarifLevel(confidence),
     kind: confidence === "informational" ? "informational" : "fail",
     rank: confidenceToRank(confidence),
     message: { text: issue.message },
+    // partialFingerprints: per-result hash for GitHub alert deduplication.
+    // Without this, GitHub closes and reopens every alert on every scan run.
+    partialFingerprints: {
+      [FINGERPRINT_KEY]: fingerprint
+    },
     locations: [
       {
         physicalLocation: {
@@ -1557,6 +1581,12 @@ function buildSarifLog(result, version = PKG_VERSION, repoRoot) {
             rules
           }
         },
+        // automationDetails.id: stable tool identifier for GitHub Code Scanning.
+        // Groups all ai-guard scan runs into one persistent analysis slot.
+        // MUST remain "ai-guard" forever — changing this orphans all existing alerts.
+        automationDetails: {
+          id: SARIF_AUTOMATION_ID
+        },
         results: sarifResults,
         properties: {
           preset: "recommended",
@@ -1616,6 +1646,13 @@ function buildSarifDebugInfo(result, repoRoot) {
     }
     for (const issue of file.issues) {
       const confidence = ISSUE_CONFIDENCE[issue.ruleId];
+      const normalizedUri = normalizeSarifPath(file.filePath, repoRoot);
+      const fingerprint = generateStableFingerprint(
+        normalizedUri,
+        issue.ruleId,
+        Math.max(1, issue.line),
+        issue.message
+      );
       resultsEmitted.push({
         ruleId: issue.ruleId,
         level: confidenceToSarifLevel(confidence),
@@ -1623,12 +1660,15 @@ function buildSarifDebugInfo(result, repoRoot) {
         securitySeverity: confidenceToSecuritySeverity(confidence),
         precision: confidenceToPrecision(confidence),
         filePath: file.filePath,
-        normalizedUri: normalizeSarifPath(file.filePath, repoRoot),
-        line: issue.line
+        normalizedUri,
+        line: issue.line,
+        fingerprint
       });
     }
   }
   return {
+    automationId: SARIF_AUTOMATION_ID,
+    fingerprintKey: FINGERPRINT_KEY,
     rulesEmitted,
     resultsEmitted,
     pathsDebug,
@@ -2113,7 +2153,7 @@ function registerRunCommand(program2) {
     "--max-warnings <n>",
     "Fail with exit code 1 if warnings exceed this count",
     (value) => Number.parseInt(value, 10)
-  ).option("--verbose", "Show all issues \u2014 disable grouping of repeated warnings").option("--quiet", "Only show errors \u2014 suppress warnings and informational hints").option("--debug-timing", "Print per-phase timing diagnostics").option("--debug-sarif", "Print SARIF tag/level normalization trace \u2014 diagnose schema issues").option("--debug-sarif-paths", "Print path normalization trace \u2014 diagnose GitHub Code Scanning path resolution").option("--sarif-output <file>", "Write SARIF to this file instead of stdout").action(async (opts) => {
+  ).option("--verbose", "Show all issues \u2014 disable grouping of repeated warnings").option("--quiet", "Only show errors \u2014 suppress warnings and informational hints").option("--debug-timing", "Print per-phase timing diagnostics").option("--debug-sarif", "Print SARIF tag/level normalization trace \u2014 diagnose schema issues").option("--debug-sarif-paths", "Print path normalization trace \u2014 diagnose GitHub Code Scanning path resolution").option("--debug-sarif-persistence", "Print persistence identity trace \u2014 fingerprints, automationDetails, category").option("--sarif-output <file>", "Write SARIF to this file instead of stdout").action(async (opts) => {
     if (opts.maxWarnings !== void 0 && (!Number.isInteger(opts.maxWarnings) || opts.maxWarnings < 0)) {
       log.blank();
       log.error("--max-warnings must be a non-negative integer.");
@@ -2241,6 +2281,34 @@ function registerRunCommand(program2) {
         }
         process.stderr.write("[debug-sarif-paths] \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n");
       }
+      if (opts.debugSarifPersistence) {
+        const debugInfo = buildSarifDebugInfo(result, repoRoot);
+        process.stderr.write("\n[debug-sarif-persistence] GitHub Persistence Identity Trace\n");
+        process.stderr.write("[debug-sarif-persistence] \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
+        process.stderr.write(`[debug-sarif-persistence] automationDetails.id: ${debugInfo.automationId}
+`);
+        process.stderr.write(`[debug-sarif-persistence] fingerprintKey:        ${debugInfo.fingerprintKey}
+`);
+        process.stderr.write(`[debug-sarif-persistence] GITHUB_WORKSPACE:      ${repoRoot ?? "(not set)"}
+`);
+        process.stderr.write(`[debug-sarif-persistence] totalResults:          ${debugInfo.totalResults}
+
+`);
+        if (debugInfo.resultsEmitted.length === 0) {
+          process.stderr.write("[debug-sarif-persistence]   (no findings \u2014 no fingerprints to show)\n");
+        } else {
+          process.stderr.write("[debug-sarif-persistence] Fingerprints (stable identity per finding):\n");
+          for (const res of debugInfo.resultsEmitted) {
+            process.stderr.write(`[debug-sarif-persistence]   \u2500 ${res.ruleId}
+`);
+            process.stderr.write(`[debug-sarif-persistence]     file:        ${res.normalizedUri}:${res.line}
+`);
+            process.stderr.write(`[debug-sarif-persistence]     fingerprint: ${res.fingerprint}
+`);
+          }
+        }
+        process.stderr.write("[debug-sarif-persistence] \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n");
+      }
       if (opts.sarifOutput) {
         import_fs4.default.writeFileSync(opts.sarifOutput, sarifJson, "utf-8");
         if (opts.debugSarif) {
@@ -2592,7 +2660,7 @@ function registerChangedCommand(program2) {
     "--max-warnings <n>",
     "Fail if warnings exceed this count",
     (v) => Number.parseInt(v, 10)
-  ).option("--verbose", "Expand all findings (disable grouping)").option("--quiet", "Show errors only").option("--debug-timing", "Print per-phase timing diagnostics").option("--debug-git", "Print full git resolution trace (useful for diagnosing zero-file issues)").option("--debug-ci", "Print CI environment state (GITHUB_* vars, SARIF path, summary path)").option("--debug-sarif", "Print SARIF tag/level normalization trace \u2014 diagnose schema issues").option("--debug-sarif-paths", "Print path normalization trace \u2014 diagnose GitHub Code Scanning path resolution").action(async (opts) => {
+  ).option("--verbose", "Expand all findings (disable grouping)").option("--quiet", "Show errors only").option("--debug-timing", "Print per-phase timing diagnostics").option("--debug-git", "Print full git resolution trace (useful for diagnosing zero-file issues)").option("--debug-ci", "Print CI environment state (GITHUB_* vars, SARIF path, summary path)").option("--debug-sarif", "Print SARIF tag/level normalization trace \u2014 diagnose schema issues").option("--debug-sarif-paths", "Print path normalization trace \u2014 diagnose GitHub Code Scanning path resolution").option("--debug-sarif-persistence", "Print persistence identity trace \u2014 fingerprints, automationDetails, category").action(async (opts) => {
     const preset = opts.strict ? "strict" : opts.security ? "security" : "recommended";
     const inCI = isGitHubActions();
     const baseRef = opts.base ?? (opts.pr || inCI ? getGitHubBaseRef() : void 0);
@@ -2777,6 +2845,34 @@ function handleResults(result, opts, preset, scanMode, changedFilesCount, inCI,
       }
       process.stderr.write("[debug-sarif-paths] \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n");
     }
+    if (opts.debugSarifPersistence) {
+      const debugInfo = buildSarifDebugInfo(result, repoRoot);
+      process.stderr.write("\n[debug-sarif-persistence] GitHub Persistence Identity Trace\n");
+      process.stderr.write("[debug-sarif-persistence] \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
+      process.stderr.write(`[debug-sarif-persistence] automationDetails.id: ${debugInfo.automationId}
+`);
+      process.stderr.write(`[debug-sarif-persistence] fingerprintKey:        ${debugInfo.fingerprintKey}
+`);
+      process.stderr.write(`[debug-sarif-persistence] GITHUB_WORKSPACE:      ${repoRoot ?? "(not set)"}
+`);
+      process.stderr.write(`[debug-sarif-persistence] totalResults:          ${debugInfo.totalResults}
+
+`);
+      if (debugInfo.resultsEmitted.length === 0) {
+        process.stderr.write("[debug-sarif-persistence]   (no findings \u2014 no fingerprints to show)\n");
+      } else {
+        process.stderr.write("[debug-sarif-persistence] Fingerprints (stable identity per finding):\n");
+        for (const res of debugInfo.resultsEmitted) {
+          process.stderr.write(`[debug-sarif-persistence]   \u2500 ${res.ruleId}
+`);
+          process.stderr.write(`[debug-sarif-persistence]     file:        ${res.normalizedUri}:${res.line}
+`);
+          process.stderr.write(`[debug-sarif-persistence]     fingerprint: ${res.fingerprint}
+`);
+        }
+      }
+      process.stderr.write("[debug-sarif-persistence] \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n");
+    }
     if (resolvedSarifPath) {
       import_fs5.default.writeFileSync(resolvedSarifPath, sarifJson, "utf-8");
       if (opts.debugSarif) {