secure-code-agent 0.12.0__tar.gz → 0.12.1__tar.gz

{secure_code_agent-0.12.0/src/secure_code_agent.egg-info → secure_code_agent-0.12.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: secure-code-agent
-Version: 0.12.0
+Version: 0.12.1
 Summary: Deterministic security gate + bounded AI remediation prompt generator. NIST SSDF / OWASP ASVS / CWE Top 25 anchored.
 Author: Marshall Guillory
 License: MIT
@@ -489,9 +489,11 @@ secure-code-agent --sarif-import codeql-results.sarif \
                    --sarif-import snyk-results.sarif
 ```
 
-`--changed-only` is reserved but not yet safely implemented. Passing it fails
-with exit code 2 so a caller cannot accidentally treat an unscoped audit as a
-changed-file audit.
+`--changed-only REF` scopes the **report** to files changed since `REF`. The
+whole tree is still scanned — scanners read trees, not diffs — and **no grade
+is issued**, because a run that looks at less must not score better. A ref git
+cannot resolve is an error rather than an empty diff, since "nothing changed"
+and "your ref is wrong" otherwise produce the same finding count.
 
 The current orchestrator accepts one repository root per invocation. Multiple
 positional roots fail with exit code 2 instead of silently ignoring coverage.
@@ -509,7 +511,7 @@ For agents that support invokable skills, this repo ships a portable skill under
 ## GitHub Action
 
 ```yaml
-- uses: marshallguillory86/secure-code-agent@v0.12.0
+- uses: marshallguillory86/secure-code-agent@v0.12.1
   with:
     config: secure-code-agent.json
     fail-on-gate: true

{secure_code_agent-0.12.0 → secure_code_agent-0.12.1}/README.md

@@ -441,9 +441,11 @@ secure-code-agent --sarif-import codeql-results.sarif \
                    --sarif-import snyk-results.sarif
 ```
 
-`--changed-only` is reserved but not yet safely implemented. Passing it fails
-with exit code 2 so a caller cannot accidentally treat an unscoped audit as a
-changed-file audit.
+`--changed-only REF` scopes the **report** to files changed since `REF`. The
+whole tree is still scanned — scanners read trees, not diffs — and **no grade
+is issued**, because a run that looks at less must not score better. A ref git
+cannot resolve is an error rather than an empty diff, since "nothing changed"
+and "your ref is wrong" otherwise produce the same finding count.
 
 The current orchestrator accepts one repository root per invocation. Multiple
 positional roots fail with exit code 2 instead of silently ignoring coverage.
@@ -461,7 +463,7 @@ For agents that support invokable skills, this repo ships a portable skill under
 ## GitHub Action
 
 ```yaml
-- uses: marshallguillory86/secure-code-agent@v0.12.0
+- uses: marshallguillory86/secure-code-agent@v0.12.1
   with:
     config: secure-code-agent.json
     fail-on-gate: true

{secure_code_agent-0.12.0 → secure_code_agent-0.12.1/src/secure_code_agent.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: secure-code-agent
-Version: 0.12.0
+Version: 0.12.1
 Summary: Deterministic security gate + bounded AI remediation prompt generator. NIST SSDF / OWASP ASVS / CWE Top 25 anchored.
 Author: Marshall Guillory
 License: MIT
@@ -489,9 +489,11 @@ secure-code-agent --sarif-import codeql-results.sarif \
                    --sarif-import snyk-results.sarif
 ```
 
-`--changed-only` is reserved but not yet safely implemented. Passing it fails
-with exit code 2 so a caller cannot accidentally treat an unscoped audit as a
-changed-file audit.
+`--changed-only REF` scopes the **report** to files changed since `REF`. The
+whole tree is still scanned — scanners read trees, not diffs — and **no grade
+is issued**, because a run that looks at less must not score better. A ref git
+cannot resolve is an error rather than an empty diff, since "nothing changed"
+and "your ref is wrong" otherwise produce the same finding count.
 
 The current orchestrator accepts one repository root per invocation. Multiple
 positional roots fail with exit code 2 instead of silently ignoring coverage.
@@ -509,7 +511,7 @@ For agents that support invokable skills, this repo ships a portable skill under
 ## GitHub Action
 
 ```yaml
-- uses: marshallguillory86/secure-code-agent@v0.12.0
+- uses: marshallguillory86/secure-code-agent@v0.12.1
   with:
     config: secure-code-agent.json
     fail-on-gate: true

{secure_code_agent-0.12.0 → secure_code_agent-0.12.1}/src/secure_code_audit/__init__.py

@@ -12,4 +12,4 @@
 #:
 #: PyPI is immutable, so 0.4.0 stays wrong. 0.5.0 is the first build whose
 #: artifacts name their own producer correctly.
-__version__ = "0.12.0"
+__version__ = "0.12.1"

{secure_code_agent-0.12.0 → secure_code_agent-0.12.1}/src/secure_code_audit/renderers.py

@@ -297,7 +297,17 @@ def _summary_section(
     # No verdict means nobody decided this run could claim a grade, so it
     # cannot. Falling back to a locally-invented condition here is what put a
     # second decision rule in the codebase in the first place.
-    if verdict is None or not verdict.is_verified:
+    if verdict is not None and verdict.untriaged:
+        # An untriaged run leads with the work, on every surface. The terminal
+        # did this from the day it shipped and the Markdown report did not, so
+        # the same audit said two different things depending on where it was
+        # read — and the report is the one a reviewer opens.
+        out.append(f"- **{verdict.headline()}**")
+        out.append(
+            "    - The number is in the JSON and the trend. It is not the first "
+            "thing to say about a repository nobody has triaged yet."
+        )
+    elif verdict is None or not verdict.is_verified:
         if score.overall is None:
             out.append(
                 "- **No score:** nothing measurable was scanned. This is not a "
@@ -541,11 +551,15 @@ def _pr_comment(
     # never caveat on its own terms.
     unverified = verdict is None or not verdict.is_verified
     score_label = "finding score, not a verified grade" if unverified else "verified grade"
-    headline = (
-        "no score — nothing measurable was scanned"
-        if score.overall is None
-        else f"{score_label} **{score.letter}** ({score.overall:.2f}/5.00)"
-    )
+    if verdict is not None and verdict.untriaged:
+        # Same rule as the Markdown report and the terminal. A PR comment is
+        # the most widely read artifact this tool produces, so it is the worst
+        # place for a letter nobody has triaged to be the headline.
+        headline = verdict.headline()
+    elif score.overall is None:
+        headline = "no score — nothing measurable was scanned"
+    else:
+        headline = f"{score_label} **{score.letter}** ({score.overall:.2f}/5.00)"
     out = [
         f"### secure-code-agent {status} — {headline}",
         "",