iam-policy-validator 1.7.0__py3-none-any.whl → 1.7.2__py3-none-any.whl

iam_validator/checks/action_resource_matching.py

@@ -21,6 +21,8 @@ Example:
     This check will report: s3:GetObject requires arn:aws:s3:::mybucket/*
 """
 
+import re
+
 from iam_validator.core.aws_fetcher import AWSServiceFetcher
 from iam_validator.core.check_registry import CheckConfig, PolicyCheck
 from iam_validator.core.models import Statement, ValidationIssue
@@ -231,18 +233,23 @@ class ActionResourceMatchingCheck(PolicyCheck):
         if reason:
             message = reason
         elif all_required_formats and len(all_required_formats) > 1:
-            types = ", ".join(f["type"] for f in all_required_formats)
+            types = ", ".join(f"`{f['type']}`" for f in all_required_formats)
             message = (
-                f"No resources match for action '{action}'. This action requires one of: {types}"
+                f"No resources match for action `{action}`. This action requires one of: {types}"
             )
         else:
             message = (
-                f"No resources match for action '{action}'. "
-                f"This action requires resource type: {required_type}"
+                f"No resources match for action `{action}`. "
+                f"This action requires resource type: `{required_type}`"
             )
 
         # Build suggestion with examples
-        suggestion = self._get_suggestion(action, required_format, provided_resources)
+        suggestion = self._get_suggestion(
+            action=action,
+            required_format=required_format,
+            provided_resources=provided_resources,
+            all_required_formats=all_required_formats,
+        )
 
         return ValidationIssue(
             severity=self.get_severity(config),
@@ -265,6 +272,7 @@ class ActionResourceMatchingCheck(PolicyCheck):
         action: str,
         required_format: str,
         provided_resources: list[str],
+        all_required_formats: list[dict] | None = None,
     ) -> str:
         """
         Generate helpful suggestion for fixing the mismatch.
@@ -281,44 +289,75 @@ class ActionResourceMatchingCheck(PolicyCheck):
         # Special case: Wildcard resource
         if required_format == "*":
             return (
-                f'Action {action} can only use Resource: "*" (wildcard).\n'
+                f'Action `{action}` can only use Resource: "*" (wildcard).\n'
                 f"  This action does not support resource-level permissions.\n"
                 f'  Example: "Resource": "*"'
             )
 
-        # Extract resource type from ARN pattern
-        # Pattern format: arn:${Partition}:service:${Region}:${Account}:resourceType/...
-        # Examples:
-        #   arn:${Partition}:s3:::${BucketName}/${ObjectName} -> object
-        #   arn:${Partition}:iam::${Account}:user/${UserName} -> user
-        resource_type = self._extract_resource_type_from_pattern(required_format)
-
-        # Build service-specific suggestion
+        # Build service-specific suggestion with proper markdown formatting
         suggestion_parts = []
 
-        # Add action description
-        suggestion_parts.append(f"Action {action} requires {resource_type} resource type.")
+        # If multiple resource types are valid, show all of them
+        if all_required_formats and len(all_required_formats) > 1:
+            resource_types = [fmt["type"] for fmt in all_required_formats]
+            suggestion_parts.append(
+                f"Action `{action}` requires one of these resource types: {', '.join(f'`{t}`' for t in resource_types)}"
+            )
+            suggestion_parts.append("")
 
-        # Add expected format
-        suggestion_parts.append(f"  Expected format: {required_format}")
+            # Show format and example for each resource type
+            for fmt in all_required_formats:
+                resource_type = fmt["type"]
+                arn_format = fmt["format"]
 
-        # Add practical example based on the pattern
-        example = self._generate_example_arn(required_format)
-        if example:
-            suggestion_parts.append(f"  Example: {example}")
+                suggestion_parts.append(
+                    f"**Option {all_required_formats.index(fmt) + 1}: `{resource_type}` resource**"
+                )
+                suggestion_parts.append("```")
+                suggestion_parts.append(arn_format)
+                suggestion_parts.append("```")
 
-        # Add helpful context for common patterns
-        context = self._get_resource_context(action_name, resource_type, required_format)
-        if context:
-            suggestion_parts.append(f"  {context}")
+                # Add practical example
+                example = self._generate_example_arn(arn_format)
+                if example:
+                    suggestion_parts.append(f"Example: `{example}`")
 
-        suggestion = "\n".join(suggestion_parts)
+                suggestion_parts.append("")
+        else:
+            # Single resource type - show detailed info
+            # Extract resource type from ARN pattern
+            # Pattern format: arn:${Partition}:service:${Region}:${Account}:resourceType/...
+            # Examples:
+            #   arn:${Partition}:s3:::${BucketName}/${ObjectName} -> object
+            #   arn:${Partition}:iam::${Account}:user/${UserName} -> user
+            resource_type = self._extract_resource_type_from_pattern(required_format)
+
+            # Add action description
+            suggestion_parts.append(f"Action `{action}` requires `{resource_type}` resource type.")
+            suggestion_parts.append("")
+
+            # Add expected format in code block
+            suggestion_parts.append("**Expected format:**")
+            suggestion_parts.append(f"```\n{required_format}\n```")
+
+            # Add practical example based on the pattern
+            example = self._generate_example_arn(required_format)
+            if example:
+                suggestion_parts.append("**Example:**")
+                suggestion_parts.append(f"```\n{example}\n```")
+
+            # Add helpful context for common patterns
+            context = self._get_resource_context(action_name, resource_type, required_format)
+            if context:
+                suggestion_parts.append(f"**Note:** {context}")
 
         # Add current resources to help user understand the mismatch
         if provided_resources and len(provided_resources) <= 3:
-            current = ", ".join(provided_resources)
-            suggestion += f"\n  Current resources: {current}"
+            suggestion_parts.append("**Current resources:**")
+            for resource in provided_resources:
+                suggestion_parts.append(f"- `{resource}`")
 
+        suggestion = "\n".join(suggestion_parts)
         return suggestion
 
     def _extract_resource_type_from_pattern(self, pattern: str) -> str:
@@ -340,17 +379,14 @@ class ActionResourceMatchingCheck(PolicyCheck):
 
         # Extract resource type (part before / or entire string)
         if "/" in resource_part:
-            resource_type = resource_part.split("/")[0]
+            resource_type = resource_part.split("/", maxsplit=1)[0]
         elif ":" in resource_part:
-            resource_type = resource_part.split(":")[0]
+            resource_type = resource_part.split(":", maxsplit=1)[0]
         else:
             resource_type = resource_part
 
         # Remove template variables like ${...}
-        import re
-
         resource_type = re.sub(r"\$\{[^}]+\}", "", resource_type)
-
         return resource_type.strip() or "resource"
 
     def _generate_example_arn(self, pattern: str) -> str:
@@ -359,8 +395,6 @@ class ActionResourceMatchingCheck(PolicyCheck):
 
         Converts AWS template variables to realistic examples.
         """
-        import re
-
         example = pattern
 
         # Common substitutions

iam_validator/checks/condition_key_validation.py

@@ -52,26 +52,26 @@ class ConditionKeyValidationCheck(PolicyCheck):
                         continue
 
                     # Validate against action and resource types
-                    is_valid, error_msg, warning_msg = await fetcher.validate_condition_key(
-                        action, condition_key, resources
-                    )
+                    result = await fetcher.validate_condition_key(action, condition_key, resources)
 
-                    if not is_valid:
+                    if not result.is_valid:
                         issues.append(
                             ValidationIssue(
                                 severity=self.get_severity(config),
                                 statement_sid=statement_sid,
                                 statement_index=statement_idx,
                                 issue_type="invalid_condition_key",
-                                message=error_msg or f"Invalid condition key: {condition_key}",
+                                message=result.error_message
+                                or f"Invalid condition key: {condition_key}",
                                 action=action,
                                 condition_key=condition_key,
                                 line_number=line_number,
+                                suggestion=result.suggestion,
                             )
                         )
                         # Only report once per condition key (not per action)
                         break
-                    elif warning_msg and warn_on_global_keys:
+                    elif result.warning_message and warn_on_global_keys:
                         # Add warning for global condition keys with action-specific keys
                         # Only if warn_on_global_condition_keys is enabled
                         issues.append(
@@ -80,7 +80,7 @@ class ConditionKeyValidationCheck(PolicyCheck):
                                 statement_sid=statement_sid,
                                 statement_index=statement_idx,
                                 issue_type="global_condition_key_with_action_specific",
-                                message=warning_msg,
+                                message=result.warning_message,
                                 action=action,
                                 condition_key=condition_key,
                                 line_number=line_number,

iam_validator/checks/condition_type_mismatch.py

@@ -107,8 +107,8 @@ class ConditionTypeMismatchCheck(PolicyCheck):
                         ValidationIssue(
                             severity="warning",
                             message=(
-                                f"Type mismatch (usable but not recommended): Operator '{operator}' expects "
-                                f"{operator_type} values, but condition key '{condition_key}' is type {key_type}. "
+                                f"Type mismatch (usable but not recommended): Operator `{operator}` expects "
+                                f"{operator_type} values, but condition key `{condition_key}` is type {key_type}. "
                                 f"Consider using an ARN-specific operator like ArnEquals or ArnLike instead."
                             ),
                             statement_sid=statement_sid,
@@ -123,8 +123,8 @@ class ConditionTypeMismatchCheck(PolicyCheck):
                         ValidationIssue(
                             severity=self.get_severity(config),
                             message=(
-                                f"Type mismatch: Operator '{operator}' expects {operator_type} values, "
-                                f"but condition key '{condition_key}' is type {key_type}."
+                                f"Type mismatch: Operator `{operator}` expects {operator_type} values, "
+                                f"but condition key `{condition_key}` is type {key_type}."
                             ),
                             statement_sid=statement_sid,
                             statement_index=statement_idx,
@@ -141,7 +141,7 @@ class ConditionTypeMismatchCheck(PolicyCheck):
                         ValidationIssue(
                             severity=self.get_severity(config),
                             message=(
-                                f"Invalid value format for condition key '{condition_key}': {error_msg}"
+                                f"Invalid value format for condition key `{condition_key}`: {error_msg}"
                             ),
                             statement_sid=statement_sid,
                             statement_index=statement_idx,
@@ -172,7 +172,9 @@ class ConditionTypeMismatchCheck(PolicyCheck):
         Returns:
             Type string or None if not found
         """
-        from iam_validator.core.config.aws_global_conditions import get_global_conditions
+        from iam_validator.core.config.aws_global_conditions import (
+            get_global_conditions,
+        )
 
         # Check if it's a global condition key
         global_conditions = get_global_conditions()

iam_validator/checks/full_wildcard.py

@@ -43,19 +43,12 @@ class FullWildcardCheck(PolicyCheck):
                 "message",
                 "Statement allows all actions on all resources - CRITICAL SECURITY RISK",
             )
-            suggestion_text = config.config.get(
+            suggestion = config.config.get(
                 "suggestion",
                 "This grants full administrative access. Replace both wildcards with specific actions and resources to follow least-privilege principle",
             )
             example = config.config.get("example", "")
 
-            # Combine suggestion + example
-            suggestion = (
-                f"{suggestion_text}\nExample:\n```json\n{example}\n```"
-                if example
-                else suggestion_text
-            )
-
             issues.append(
                 ValidationIssue(
                     severity=self.get_severity(config),
@@ -64,6 +57,7 @@ class FullWildcardCheck(PolicyCheck):
                     issue_type="security_risk",
                     message=message,
                     suggestion=suggestion,
+                    example=example if example else None,
                     line_number=statement.line_number,
                 )
             )

iam_validator/checks/mfa_condition_check.py

@@ -70,11 +70,11 @@ class MFAConditionCheck(PolicyCheck):
                         ValidationIssue(
                             severity=self.get_severity(config),
                             message=(
-                                "Dangerous MFA condition pattern detected. "
-                                'Using {"Bool": {"aws:MultiFactorAuthPresent": "false"}} does not enforce MFA '
-                                "because aws:MultiFactorAuthPresent may not exist in the request context. "
-                                'Consider using {"Bool": {"aws:MultiFactorAuthPresent": "true"}} in an Allow statement, '
-                                "or use BoolIfExists in a Deny statement."
+                                "**Dangerous MFA condition pattern detected.** "
+                                'Using `{"Bool": {"aws:MultiFactorAuthPresent": "false"}}` does not enforce MFA '
+                                "because `aws:MultiFactorAuthPresent` may not exist in the request context. "
+                                'Consider using `{"Bool": {"aws:MultiFactorAuthPresent": "true"}}` in an Allow statement, '
+                                "or use `BoolIfExists` in a Deny statement."
                             ),
                             statement_sid=statement_sid,
                             statement_index=statement_idx,
@@ -97,10 +97,10 @@ class MFAConditionCheck(PolicyCheck):
                         ValidationIssue(
                             severity=self.get_severity(config),
                             message=(
-                                "Dangerous MFA condition pattern detected. "
-                                'Using {"Null": {"aws:MultiFactorAuthPresent": "false"}} only checks if the key exists, '
+                                "**Dangerous MFA condition pattern detected.** "
+                                'Using `{"Null": {"aws:MultiFactorAuthPresent": "false"}}` only checks if the key exists, '
                                 "not whether MFA was actually used. This does not enforce MFA. "
-                                'Consider using {"Bool": {"aws:MultiFactorAuthPresent": "true"}} in an Allow statement instead.'
+                                'Consider using `{"Bool": {"aws:MultiFactorAuthPresent": "true"}}` in an Allow statement instead.'
                             ),
                             statement_sid=statement_sid,
                             statement_index=statement_idx,

iam_validator/checks/principal_validation.py

@@ -112,12 +112,12 @@ class PrincipalValidationCheck(PolicyCheck):
                     ValidationIssue(
                         severity=self.get_severity(config),
                         issue_type="blocked_principal",
-                        message=f"Blocked principal detected: {principal}. "
+                        message=f"Blocked principal detected: `{principal}`. "
                         f"This principal is explicitly blocked by your security policy.",
                         statement_index=statement_idx,
                         statement_sid=statement.sid,
                         line_number=statement.line_number,
-                        suggestion=f"Remove the principal '{principal}' or add appropriate conditions to restrict access. "
+                        suggestion=f"Remove the principal `{principal}` or add appropriate conditions to restrict access. "
                         "Consider using more specific principals instead of wildcards.",
                     )
                 )
@@ -131,8 +131,8 @@ class PrincipalValidationCheck(PolicyCheck):
                     ValidationIssue(
                         severity=self.get_severity(config),
                         issue_type="unauthorized_principal",
-                        message=f"Principal not in allowed list: {principal}. "
-                        f"Only principals in the allowed_principals whitelist are permitted.",
+                        message=f"Principal not in allowed list: `{principal}`. "
+                        f"Only principals in the `allowed_principals` whitelist are permitted.",
                         statement_index=statement_idx,
                         statement_sid=statement.sid,
                         line_number=statement.line_number,
@@ -151,7 +151,7 @@ class PrincipalValidationCheck(PolicyCheck):
                         ValidationIssue(
                             severity=self.get_severity(config),
                             issue_type="missing_principal_conditions",
-                            message=f"Principal '{principal}' requires conditions: {', '.join(missing_conditions)}. "
+                            message=f"Principal `{principal}` requires conditions: {', '.join(f'`{c}`' for c in missing_conditions)}. "
                             f"This principal must have these condition keys to restrict access.",
                             statement_index=statement_idx,
                             statement_sid=statement.sid,
@@ -169,7 +169,11 @@ class PrincipalValidationCheck(PolicyCheck):
         # Check advanced format: principal_condition_requirements
         if principal_condition_requirements:
             condition_issues = self._validate_principal_condition_requirements(
-                statement, statement_idx, principals, principal_condition_requirements, config
+                statement,
+                statement_idx,
+                principals,
+                principal_condition_requirements,
+                config,
             )
             issues.extend(condition_issues)
 
@@ -629,15 +633,18 @@ class PrincipalValidationCheck(PolicyCheck):
             or self.get_severity(config)
         )
 
+        suggestion_text, example_code = self._build_condition_suggestion(
+            condition_key, description, example, expected_value, operator
+        )
+
         return ValidationIssue(
             severity=severity,
             statement_sid=statement.sid,
             statement_index=statement_idx,
             issue_type="missing_principal_condition",
             message=f"{message_prefix} Principal(s) {matching_principals} require condition '{condition_key}'",
-            suggestion=self._build_condition_suggestion(
-                condition_key, description, example, expected_value, operator
-            ),
+            suggestion=suggestion_text,
+            example=example_code,
             line_number=statement.line_number,
         )
 
@@ -648,8 +655,8 @@ class PrincipalValidationCheck(PolicyCheck):
         example: str,
         expected_value: Any = None,
         operator: str = "StringEquals",
-    ) -> str:
-        """Build a helpful suggestion for adding the missing condition.
+    ) -> tuple[str, str]:
+        """Build suggestion and example for adding the missing condition.
 
         Args:
             condition_key: The condition key
@@ -659,19 +666,16 @@ class PrincipalValidationCheck(PolicyCheck):
             operator: Condition operator
 
         Returns:
-            Suggestion string
+            Tuple of (suggestion_text, example_code)
         """
-        parts = []
-
-        if description:
-            parts.append(description)
+        suggestion = description if description else f"Add condition: {condition_key}"
 
         # Build example based on condition key type
         if example:
-            parts.append(f"Example:\n```json\n{example}\n```")
+            example_code = example
         else:
             # Auto-generate example
-            example_lines = ['Add to "Condition" block:', f'  "{operator}": {{']
+            example_lines = [f'  "{operator}": {{']
 
             if isinstance(expected_value, list):
                 value_str = (
@@ -698,9 +702,9 @@ class PrincipalValidationCheck(PolicyCheck):
             example_lines.append(f'    "{condition_key}": {value_str}')
             example_lines.append("  }")
 
-            parts.append("\n".join(example_lines))
+            example_code = "\n".join(example_lines)
 
-        return ". ".join(parts) if parts else f"Add condition: {condition_key}"
+        return suggestion, example_code
 
     def _build_any_of_suggestion(self, any_of_conditions: list[dict[str, Any]]) -> str:
         """Build suggestion for any_of conditions.

iam_validator/checks/sensitive_action.py

@@ -85,7 +85,7 @@ class SensitiveActionCheck(PolicyCheck):
         # Generic ABAC fallback for uncategorized actions
         return (
             "Add IAM conditions to limit when this action can be used. Use ABAC for scalability:\n"
-            "• Match principal tags to resource tags (aws:PrincipalTag/X = aws:ResourceTag/X)\n"
+            "• Match principal tags to resource tags (aws:PrincipalTag/<tag-name> = aws:ResourceTag/<tag-name>)\n"
             "• Require MFA (aws:MultiFactorAuthPresent = true)\n"
             "• Restrict by IP (aws:SourceIp) or VPC (aws:SourceVpc)",
             '"Condition": {\n'
@@ -142,13 +142,6 @@ class SensitiveActionCheck(PolicyCheck):
                 matched_actions[0], config
             )
 
-            # Combine suggestion + example
-            suggestion = (
-                f"{suggestion_text}\n\nExample:\n```json\n{example}\n```"
-                if example
-                else suggestion_text
-            )
-
             # Determine severity based on the highest severity action in the list
             # If single action, use its category severity
             # If multiple actions, use the highest severity among them
@@ -165,7 +158,8 @@ class SensitiveActionCheck(PolicyCheck):
                     issue_type="missing_condition",
                     message=message,
                     action=(matched_actions[0] if len(matched_actions) == 1 else None),
-                    suggestion=suggestion,
+                    suggestion=suggestion_text,
+                    example=example if example else None,
                     line_number=statement.line_number,
                 )
             )

iam_validator/checks/service_wildcard.py

@@ -60,20 +60,13 @@ class ServiceWildcardCheck(PolicyCheck):
                     example_template = config.config.get("example", "")
 
                     message = message_template.format(action=action, service=service)
-                    suggestion_text = suggestion_template.format(action=action, service=service)
+                    suggestion = suggestion_template.format(action=action, service=service)
                     example = (
                         example_template.format(action=action, service=service)
                         if example_template
                         else ""
                     )
 
-                    # Combine suggestion + example
-                    suggestion = (
-                        f"{suggestion_text}\nExample:\n```json\n{example}\n```"
-                        if example
-                        else suggestion_text
-                    )
-
                     issues.append(
                         ValidationIssue(
                             severity=self.get_severity(config),
@@ -83,6 +76,7 @@ class ServiceWildcardCheck(PolicyCheck):
                             message=message,
                             action=action,
                             suggestion=suggestion,
+                            example=example if example else None,
                             line_number=statement.line_number,
                         )
                     )

iam_validator/checks/sid_uniqueness.py

@@ -91,7 +91,7 @@ def _check_sid_uniqueness_impl(policy: IAMPolicy, severity: str) -> list[Validat
                     statement_sid=duplicate_sid,
                     statement_index=idx,
                     issue_type="duplicate_sid",
-                    message=f"Statement ID '{duplicate_sid}' is used {count} times in this policy (found in statements {statement_numbers})",
+                    message=f"Statement ID `{duplicate_sid}` is used **{count} times** in this policy (found in statements {statement_numbers})",
                     suggestion="Change this SID to a unique value. Statement IDs help identify and reference specific statements, so duplicates can cause confusion.",
                     line_number=statement.line_number,
                 )

iam_validator/checks/utils/sensitive_action_matcher.py

@@ -11,7 +11,6 @@ Performance optimizations:
 
 import re
 from functools import lru_cache
-from re import Pattern
 
 from iam_validator.core.check_registry import CheckConfig
 from iam_validator.core.config.sensitive_actions import get_sensitive_actions
@@ -69,7 +68,7 @@ DEFAULT_SENSITIVE_ACTIONS = _get_default_sensitive_actions()
 
 # Global regex pattern cache for performance
 @lru_cache(maxsize=256)
-def compile_pattern(pattern: str) -> Pattern[str] | None:
+def compile_pattern(pattern: str) -> re.Pattern[str] | None:
     """Compile and cache regex patterns.
 
     Args:

iam_validator/checks/utils/wildcard_expansion.py

@@ -6,7 +6,6 @@ to their actual action names using the AWS Service Reference API.
 
 import re
 from functools import lru_cache
-from re import Pattern
 
 from iam_validator.core.aws_fetcher import AWSServiceFetcher
 
@@ -14,7 +13,7 @@ from iam_validator.core.aws_fetcher import AWSServiceFetcher
 # Global cache for compiled wildcard patterns (shared across checks)
 # Using lru_cache for O(1) pattern reuse and 20-30x performance improvement
 @lru_cache(maxsize=512)
-def compile_wildcard_pattern(pattern: str) -> Pattern[str]:
+def compile_wildcard_pattern(pattern: str) -> re.Pattern[str]:
     """Compile and cache wildcard patterns for O(1) reuse.
 
     Args:

iam_validator/checks/wildcard_action.py

@@ -39,19 +39,12 @@ class WildcardActionCheck(PolicyCheck):
         # Check for wildcard action (Action: "*")
         if "*" in actions:
             message = config.config.get("message", "Statement allows all actions (*)")
-            suggestion_text = config.config.get(
+            suggestion = config.config.get(
                 "suggestion",
                 "Replace wildcard with specific actions needed for your use case",
             )
             example = config.config.get("example", "")
 
-            # Combine suggestion + example
-            suggestion = (
-                f"{suggestion_text}\nExample:\n```json\n{example}\n```"
-                if example
-                else suggestion_text
-            )
-
             issues.append(
                 ValidationIssue(
                     severity=self.get_severity(config),
@@ -60,6 +53,7 @@ class WildcardActionCheck(PolicyCheck):
                     issue_type="overly_permissive",
                     message=message,
                     suggestion=suggestion,
+                    example=example if example else None,
                     line_number=statement.line_number,
                 )
             )

iam_validator/checks/wildcard_resource.py

@@ -63,18 +63,11 @@ class WildcardResourceCheck(PolicyCheck):
 
             # Flag the issue if actions are not all allowed or no allowed_wildcards configured
             message = config.config.get("message", "Statement applies to all resources (*)")
-            suggestion_text = config.config.get(
+            suggestion = config.config.get(
                 "suggestion", "Replace wildcard with specific resource ARNs"
             )
             example = config.config.get("example", "")
 
-            # Combine suggestion + example
-            suggestion = (
-                f"{suggestion_text}\nExample:\n```json\n{example}\n```"
-                if example
-                else suggestion_text
-            )
-
             issues.append(
                 ValidationIssue(
                     severity=self.get_severity(config),
@@ -83,6 +76,7 @@ class WildcardResourceCheck(PolicyCheck):
                     issue_type="overly_permissive",
                     message=message,
                     suggestion=suggestion,
+                    example=example if example else None,
                     line_number=statement.line_number,
                 )
             )

iam_validator/commands/validate.py

@@ -254,9 +254,9 @@ Examples:
             policy_type=policy_type,
         )
 
-        # Generate report
+        # Generate report (include parsing errors if any)
         generator = ReportGenerator()
-        report = generator.generate_report(results)
+        report = generator.generate_report(results, parsing_errors=loader.parsing_errors)
 
         # Output results
         if args.format is None: