secure-code-agent 0.12.0__tar.gz → 0.12.2__tar.gz

{secure_code_agent-0.12.0/src/secure_code_agent.egg-info → secure_code_agent-0.12.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: secure-code-agent
-Version: 0.12.0
+Version: 0.12.2
 Summary: Deterministic security gate + bounded AI remediation prompt generator. NIST SSDF / OWASP ASVS / CWE Top 25 anchored.
 Author: Marshall Guillory
 License: MIT
@@ -489,9 +489,11 @@ secure-code-agent --sarif-import codeql-results.sarif \
                    --sarif-import snyk-results.sarif
 ```
 
-`--changed-only` is reserved but not yet safely implemented. Passing it fails
-with exit code 2 so a caller cannot accidentally treat an unscoped audit as a
-changed-file audit.
+`--changed-only REF` scopes the **report** to files changed since `REF`. The
+whole tree is still scanned — scanners read trees, not diffs — and **no grade
+is issued**, because a run that looks at less must not score better. A ref git
+cannot resolve is an error rather than an empty diff, since "nothing changed"
+and "your ref is wrong" otherwise produce the same finding count.
 
 The current orchestrator accepts one repository root per invocation. Multiple
 positional roots fail with exit code 2 instead of silently ignoring coverage.
@@ -509,7 +511,7 @@ For agents that support invokable skills, this repo ships a portable skill under
 ## GitHub Action
 
 ```yaml
-- uses: marshallguillory86/secure-code-agent@v0.12.0
+- uses: marshallguillory86/secure-code-agent@v0.12.2
   with:
     config: secure-code-agent.json
     fail-on-gate: true

{secure_code_agent-0.12.0 → secure_code_agent-0.12.2}/README.md

@@ -441,9 +441,11 @@ secure-code-agent --sarif-import codeql-results.sarif \
                    --sarif-import snyk-results.sarif
 ```
 
-`--changed-only` is reserved but not yet safely implemented. Passing it fails
-with exit code 2 so a caller cannot accidentally treat an unscoped audit as a
-changed-file audit.
+`--changed-only REF` scopes the **report** to files changed since `REF`. The
+whole tree is still scanned — scanners read trees, not diffs — and **no grade
+is issued**, because a run that looks at less must not score better. A ref git
+cannot resolve is an error rather than an empty diff, since "nothing changed"
+and "your ref is wrong" otherwise produce the same finding count.
 
 The current orchestrator accepts one repository root per invocation. Multiple
 positional roots fail with exit code 2 instead of silently ignoring coverage.
@@ -461,7 +463,7 @@ For agents that support invokable skills, this repo ships a portable skill under
 ## GitHub Action
 
 ```yaml
-- uses: marshallguillory86/secure-code-agent@v0.12.0
+- uses: marshallguillory86/secure-code-agent@v0.12.2
   with:
     config: secure-code-agent.json
     fail-on-gate: true

{secure_code_agent-0.12.0 → secure_code_agent-0.12.2/src/secure_code_agent.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: secure-code-agent
-Version: 0.12.0
+Version: 0.12.2
 Summary: Deterministic security gate + bounded AI remediation prompt generator. NIST SSDF / OWASP ASVS / CWE Top 25 anchored.
 Author: Marshall Guillory
 License: MIT
@@ -489,9 +489,11 @@ secure-code-agent --sarif-import codeql-results.sarif \
                    --sarif-import snyk-results.sarif
 ```
 
-`--changed-only` is reserved but not yet safely implemented. Passing it fails
-with exit code 2 so a caller cannot accidentally treat an unscoped audit as a
-changed-file audit.
+`--changed-only REF` scopes the **report** to files changed since `REF`. The
+whole tree is still scanned — scanners read trees, not diffs — and **no grade
+is issued**, because a run that looks at less must not score better. A ref git
+cannot resolve is an error rather than an empty diff, since "nothing changed"
+and "your ref is wrong" otherwise produce the same finding count.
 
 The current orchestrator accepts one repository root per invocation. Multiple
 positional roots fail with exit code 2 instead of silently ignoring coverage.
@@ -509,7 +511,7 @@ For agents that support invokable skills, this repo ships a portable skill under
 ## GitHub Action
 
 ```yaml
-- uses: marshallguillory86/secure-code-agent@v0.12.0
+- uses: marshallguillory86/secure-code-agent@v0.12.2
   with:
     config: secure-code-agent.json
     fail-on-gate: true

{secure_code_agent-0.12.0 → secure_code_agent-0.12.2}/src/secure_code_audit/__init__.py

@@ -12,4 +12,4 @@
 #:
 #: PyPI is immutable, so 0.4.0 stays wrong. 0.5.0 is the first build whose
 #: artifacts name their own producer correctly.
-__version__ = "0.12.0"
+__version__ = "0.12.2"

{secure_code_agent-0.12.0 → secure_code_agent-0.12.2}/src/secure_code_audit/baseline.py

@@ -85,9 +85,18 @@ def load(path: Path) -> dict[str, BaselineEntry]:
     return entries
 
 
-def write(path: Path, findings: Iterable[Finding], existing: dict[str, BaselineEntry]) -> None:
+def write(
+    path: Path,
+    findings: Iterable[Finding],
+    existing: dict[str, BaselineEntry],
+    root: Path | None = None,
+) -> None:
     """Rewrite the baseline file. Existing entries' first_seen + bumped_by
-    are preserved so a baseline bump only mutates net-new entries."""
+    are preserved so a baseline bump only mutates net-new entries.
+
+    Entries are written under the repository-relative fingerprint. An entry
+    an earlier release recorded under the absolute-path fingerprint keeps its
+    history and is rewritten in the portable form."""
     now_iso = datetime.datetime.now(datetime.timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
     operator = _git_user_email()
 
@@ -95,7 +104,7 @@ def write(path: Path, findings: Iterable[Finding], existing: dict[str, BaselineE
     for f in findings:
         if f.suppressed:
             continue
-        prev = existing.get(f.fingerprint)
+        prev = _entry_for(f, existing, root)
         entries[f.fingerprint] = {
             "rule_id": f.rule_id,
             "severity": f.severity.value,
@@ -121,18 +130,36 @@ def write(path: Path, findings: Iterable[Finding], existing: dict[str, BaselineE
     )
 
 
-def mark_new(findings: list[Finding], baseline: dict[str, BaselineEntry]) -> list[Finding]:
+def mark_new(
+    findings: list[Finding], baseline: dict[str, BaselineEntry], root: Path | None = None
+) -> list[Finding]:
     """Set is_new=True on findings whose fingerprint is not in the baseline.
     Returns a new list with mutated Finding objects (frozen dataclass →
-    replace)."""
+    replace).
+
+    **A baseline from 0.12.1 or earlier still matches.** Those releases
+    fingerprinted absolute paths, and an upgrade must not report every
+    acknowledged finding as new and trip `fail_on_new` on a tree nobody
+    changed. With `root`, the fingerprint those releases would have recorded
+    is accepted too. It only ever matched a checkout at that same path, so it
+    matches nothing it did not match before."""
     from dataclasses import replace
 
     out: list[Finding] = []
     for f in findings:
-        out.append(replace(f, is_new=f.fingerprint not in baseline))
+        out.append(replace(f, is_new=_entry_for(f, baseline, root) is None))
     return out
 
 
+def _entry_for(
+    finding: Finding, baseline: dict[str, BaselineEntry], root: Path | None
+) -> BaselineEntry | None:
+    entry = baseline.get(finding.fingerprint)
+    if entry is None and root is not None:
+        entry = baseline.get(finding.legacy_fingerprint(root))
+    return entry
+
+
 def _git_user_email() -> str:
     git = shutil.which("git")
     if git is None:

{secure_code_agent-0.12.0 → secure_code_agent-0.12.2}/src/secure_code_audit/cli.py

@@ -35,6 +35,7 @@ from secure_code_audit.findings import (
     Confidence,
     Finding,
     Severity,
+    anchor,
     merge_corroborating,
 )
 from secure_code_audit.git_tools import find_repo_root, is_excluded, is_test_path, loc_under
@@ -349,9 +350,16 @@ def _do_audit(args: argparse.Namespace) -> int:
     all_findings.extend(imported)
     executions.extend(imported_executions)
 
+    # ----- one path convention, before anything reads a path -----
+    # Repository-relative from here on, whichever tool reported the finding.
+    # Suppressions, the baseline and every written output compare or publish
+    # this path, and none of them may depend on where the checkout lives.
+    scanned = target if target.is_dir() else target.parent
+    all_findings = anchor(all_findings, scanned=scanned, root=root)
+
     # ----- scan scope, enforced once -----
     own_artifacts = _own_artifacts(paths, cfg, root)
-    all_findings = _drop_excluded(all_findings, target, cfg, own_artifacts)
+    all_findings = _drop_excluded(all_findings, target, cfg, own_artifacts, root)
 
     # ----- one weakness, one finding -----
     # Before overrides and suppressions, so an operator writing either one
@@ -384,8 +392,14 @@ def _do_audit(args: argparse.Namespace) -> int:
             "report results that silently ignore it.\n"
         )
         return 1
-    all_findings = suppressions.apply(all_findings, sup_rules)
-    all_findings.extend(suppressions.expired_findings(sup_rules, suppression_path))
+    all_findings = suppressions.apply(all_findings, sup_rules, root)
+    all_findings.extend(
+        anchor(
+            suppressions.expired_findings(sup_rules, suppression_path),
+            scanned=scanned,
+            root=root,
+        )
+    )
 
     # ----- severity threshold filter -----
     threshold = Severity.from_string(args.severity_threshold)
@@ -395,7 +409,7 @@ def _do_audit(args: argparse.Namespace) -> int:
     baseline_path = _under_root(root, args.baseline or cfg.outputs["baseline_path"])
     baseline = baseline_mod.load(baseline_path)
     baseline_state = baseline_mod.state(baseline_path)
-    all_findings = baseline_mod.mark_new(all_findings, baseline)
+    all_findings = baseline_mod.mark_new(all_findings, baseline, root)
 
     # ----- scoring -----
     # The test tree is reported, not scored. A project graded on its test
@@ -423,9 +437,13 @@ def _do_audit(args: argparse.Namespace) -> int:
         # so this changes where a finding is *reported*, not the grade.
         if finding.category is Category.DEPENDENCIES:
             return "primary"
-        if is_test_path(finding.file_path, root_for_tests, cfg.test_patterns):
+        # Joined onto the repository root: the patterns are relative to the
+        # scan target, which is not the repository root for a subdirectory
+        # audit.
+        located = root / finding.file_path
+        if is_test_path(located, root_for_tests, cfg.test_patterns):
             return "test tree"
-        if is_test_path(finding.file_path, root_for_tests, cfg.docs_patterns):
+        if is_test_path(located, root_for_tests, cfg.docs_patterns):
             return "documentation"
         return "primary"
 
@@ -516,7 +534,7 @@ def _do_audit(args: argparse.Namespace) -> int:
     # forever.
     untriaged = 0
     if baseline_state is baseline_mod.State.ABSENT:
-        tiers = triage.partition(all_findings, lambda f: renderers.axis_of(f, axes))
+        tiers = triage.partition(all_findings, lambda f: renderers.axis_of(f, axes), root)
         untriaged = len(tiers[triage.Tier.FIX]) + len(tiers[triage.Tier.REVIEW])
     verdict = build_verdict(score, cfg.gates, coverage, untriaged)
     if changed_note is not None:
@@ -549,7 +567,7 @@ def _do_audit(args: argparse.Namespace) -> int:
         root,
     )
     if args.bump_baseline:
-        baseline_mod.write(baseline_path, all_findings, baseline)
+        baseline_mod.write(baseline_path, all_findings, baseline, root)
 
     # ----- trend -----
     # Appended before the verification branch returns, so a verify run is
@@ -798,6 +816,7 @@ def _drop_excluded(
     target: Path,
     cfg: config_mod.Config,
     own_artifacts: frozenset[Path] = frozenset(),
+    repository: Path | None = None,
 ) -> list[Finding]:
     """Enforce `paths.exclude_patterns` on findings, not just on file discovery.
 
@@ -820,14 +839,19 @@ def _drop_excluded(
     dropping "bandit could not run" because the root matched a pattern would
     turn a failed scanner back into a silent one — the defect this whole
     project exists to prevent.
+
+    Finding paths are repository-relative (`findings.anchor`), so each is
+    joined onto `repository` before it is compared with anything on disk.
+    Resolving it bare would anchor it to the process working directory.
     """
     if not cfg.exclude_patterns and not own_artifacts:
         return findings
 
     root = target if target.is_dir() else target.parent
+    repository = repository or root
     kept: list[Finding] = []
     for finding in findings:
-        path = finding.file_path
+        path = repository / finding.file_path
         is_control = path in (target, root)
         if is_control:
             kept.append(finding)
@@ -1297,7 +1321,7 @@ def _restrict_to_changed(
 
     def touched(finding: Finding) -> bool:
         try:
-            return finding.file_path.resolve() in absolute
+            return (root / finding.file_path).resolve() in absolute
         except OSError:
             return False
 

{secure_code_agent-0.12.0 → secure_code_agent-0.12.2}/src/secure_code_audit/findings.py

@@ -14,9 +14,11 @@ from __future__ import annotations
 
 import enum
 import hashlib
+import os
 from collections.abc import Iterable
 from dataclasses import dataclass, field, replace
 from pathlib import Path
+from urllib.parse import unquote, urlparse
 
 
 class Severity(str, enum.Enum):
@@ -166,7 +168,9 @@ class Finding:
         Inputs:
           - canonical_cwe falls back to rule_id when no CWE is mapped (so
             unmapped findings still remain distinct per rule).
-          - file_path is POSIX-normalized for cross-platform stability.
+          - file_path is POSIX-normalized for cross-platform stability, and
+            repository-relative once `anchor` has run, so the id does not
+            depend on where the checkout lives.
           - code_snippet is normalized (whitespace collapsed, max 512 chars)
             so a reformat-only edit doesn't break the fingerprint.
         """
@@ -176,6 +180,105 @@ class Finding:
         material = f"{key}|{path}|{snippet_norm}".encode()
         return hashlib.sha256(material).hexdigest()[:16]
 
+    def legacy_fingerprint(self, root: Path) -> str:
+        """The id 0.12.1 and earlier gave this finding, when paths were absolute.
+
+        Those releases fingerprinted the absolute path, so a baseline or a
+        `fingerprint:` suppression written by one of them holds this value.
+        Read, never written: accepting it keeps an existing baseline matching
+        where it matched before, and `--bump-baseline` rewrites it in the
+        portable form.
+        """
+        return Finding.make_fingerprint(
+            canonical_cwe=self.canonical_cwe,
+            rule_id=self.rule_id,
+            file_path=root / self.file_path,
+            code_snippet=self.code_snippet,
+        )
+
+
+# ---------------------------------------------------------------------------
+# Location
+# ---------------------------------------------------------------------------
+
+
+def repository_path(path: Path, *, scanned: Path, root: Path) -> Path:
+    """Where a scanner-reported path is, relative to the repository root.
+
+    Scanners do not agree. Bandit, Semgrep and gitleaks' `dir` pass report
+    absolute paths; gitleaks' `git` pass and the SARIF-ingesting adapters
+    report paths relative to the tree they were given; an imported SARIF may
+    spell a location as a `file://` URI. A relative report is taken as
+    relative to `scanned`, the directory the scanner was pointed at.
+
+    A location outside `root` keeps its absolute path. An imported SARIF may
+    legitimately name another machine's checkout, and inventing a relative
+    path for it would place a finding at a file that is not there.
+    """
+    text = str(path)
+    if text.startswith("file:"):
+        path = Path(unquote(urlparse(text).path))
+    absolute = path if path.is_absolute() else scanned / path
+    for base, candidate in (
+        (root, Path(os.path.normpath(absolute))),
+        (root.resolve(), absolute.resolve()),
+    ):
+        try:
+            return Path(candidate.relative_to(base).as_posix())
+        except ValueError:
+            continue
+    return absolute
+
+
+def anchor(findings: Iterable[Finding], *, scanned: Path, root: Path) -> list[Finding]:
+    """Make every finding's path repository-relative. The one place that does.
+
+    **The invariant:** after this, `Finding.file_path` is a POSIX path
+    relative to the repository root, or an absolute path for a location
+    outside it. A consumer that reads the file joins it back onto the root;
+    nothing resolves it against the process working directory.
+
+    It used to be absolute, set by `Scanner._rooted` inside the adapter
+    constructor (D5), because consumers resolved relative paths against the
+    working directory. That left two defects. The adapters that build
+    findings through SARIF ingest never passed through `_rooted`, so
+    `file_path` had two conventions depending on the tool. And an absolute
+    path is the wrong identity for anything compared across machines:
+    `SuppressionRule.matches` ran a repository-relative `paths:` glob against
+    `/Users/.../.github/workflows/x.yml`, which cannot match, so reviewed
+    suppressions were silently ignored; and the fingerprint hashed the same
+    absolute path, so a baseline made on a laptop matched nothing in CI.
+
+    Called by the CLI on everything scanners and SARIF imports return, before
+    any consumer sees it. The fingerprint is recomputed only when it was
+    derived from the path being replaced; control findings carry ids of their
+    own, such as `unavailable.bandit`, and keep them.
+    """
+    out: list[Finding] = []
+    for finding in findings:
+        located = repository_path(finding.file_path, scanned=scanned, root=root)
+        if located == finding.file_path:
+            out.append(finding)
+            continue
+        derived = finding.fingerprint == Finding.make_fingerprint(
+            canonical_cwe=finding.canonical_cwe,
+            rule_id=finding.rule_id,
+            file_path=finding.file_path,
+            code_snippet=finding.code_snippet,
+        )
+        fingerprint = (
+            Finding.make_fingerprint(
+                canonical_cwe=finding.canonical_cwe,
+                rule_id=finding.rule_id,
+                file_path=located,
+                code_snippet=finding.code_snippet,
+            )
+            if derived
+            else finding.fingerprint
+        )
+        out.append(replace(finding, file_path=located, fingerprint=fingerprint))
+    return out
+
 
 # ---------------------------------------------------------------------------
 # Helpers

{secure_code_agent-0.12.0 → secure_code_agent-0.12.2}/src/secure_code_audit/remediation.py

@@ -181,7 +181,7 @@ def generate(
     name-match the same billing, so an agent working top-to-bottom spent its
     care on noise. See `triage.py` for what lands where and why.
     """
-    tiers = triage.partition(findings, axis_of)
+    tiers = triage.partition(findings, axis_of, root)
     if not any(tiers.values()):
         return (
             "# Security remediation — no actionable findings\n\n"
@@ -229,7 +229,8 @@ def generate(
         listed = review[:_MAX_REVIEW_LINES]
         parts.append(
             "\n".join(
-                _review_line(i, f, root, triage.reason_for(f)) for i, f in enumerate(listed, 1)
+                _review_line(i, f, root, triage.reason_for(f, root))
+                for i, f in enumerate(listed, 1)
             )
             + "\n"
         )
@@ -307,11 +308,11 @@ def _footer() -> str:
 def _display_path(path: Path, root: Path | None) -> str:
     """Repository-relative, because a work order gets pasted somewhere else.
 
-    Finding paths are absolute by design — every consumer that asks "where
-    is this?" needs them anchored to the audited tree. But an absolute path
-    is the wrong thing to hand a person or an agent: it names one machine's
-    checkout, and `/private/tmp/.../scratchpad/wo/src/app.py:13` is not a
-    location anyone can act on.
+    Finding paths are repository-relative already (`findings.anchor`), and
+    pass straight through. An absolute one is relativized where it can be:
+    an absolute path is the wrong thing to hand a person or an agent, since
+    `/private/tmp/.../scratchpad/wo/src/app.py:13` names one machine's
+    checkout rather than a location anyone can act on.
     """
     if root is None or not path.is_absolute():
         return path.as_posix()

{secure_code_agent-0.12.0 → secure_code_agent-0.12.2}/src/secure_code_audit/renderers.py

@@ -297,7 +297,17 @@ def _summary_section(
     # No verdict means nobody decided this run could claim a grade, so it
     # cannot. Falling back to a locally-invented condition here is what put a
     # second decision rule in the codebase in the first place.
-    if verdict is None or not verdict.is_verified:
+    if verdict is not None and verdict.untriaged:
+        # An untriaged run leads with the work, on every surface. The terminal
+        # did this from the day it shipped and the Markdown report did not, so
+        # the same audit said two different things depending on where it was
+        # read — and the report is the one a reviewer opens.
+        out.append(f"- **{verdict.headline()}**")
+        out.append(
+            "    - The number is in the JSON and the trend. It is not the first "
+            "thing to say about a repository nobody has triaged yet."
+        )
+    elif verdict is None or not verdict.is_verified:
         if score.overall is None:
             out.append(
                 "- **No score:** nothing measurable was scanned. This is not a "
@@ -541,11 +551,15 @@ def _pr_comment(
     # never caveat on its own terms.
     unverified = verdict is None or not verdict.is_verified
     score_label = "finding score, not a verified grade" if unverified else "verified grade"
-    headline = (
-        "no score — nothing measurable was scanned"
-        if score.overall is None
-        else f"{score_label} **{score.letter}** ({score.overall:.2f}/5.00)"
-    )
+    if verdict is not None and verdict.untriaged:
+        # Same rule as the Markdown report and the terminal. A PR comment is
+        # the most widely read artifact this tool produces, so it is the worst
+        # place for a letter nobody has triaged to be the headline.
+        headline = verdict.headline()
+    elif score.overall is None:
+        headline = "no score — nothing measurable was scanned"
+    else:
+        headline = f"{score_label} **{score.letter}** ({score.overall:.2f}/5.00)"
     out = [
         f"### secure-code-agent {status} — {headline}",
         "",

{secure_code_agent-0.12.0 → secure_code_agent-0.12.2}/src/secure_code_audit/scanners/base.py

@@ -62,7 +62,6 @@ class Scanner(ABC):
         root = containment_root(target)
         self._allow_target_executables = target_executables_allowed(config, target)
         self._resolved_command = self._resolve_command(root, self.cfg(config))
-        self._target_root = root
 
     @property
     def command(self) -> tuple[str, ...]:
@@ -274,8 +273,9 @@ class Scanner(ABC):
         short_desc = entry.short_desc if entry else None
         fix_hint = entry.fix_hint if entry else None
 
-        file_path = self._rooted(file_path)
-
+        # The path is kept as the tool reported it. `findings.anchor` makes it
+        # repository-relative for every adapter and every SARIF import at once;
+        # doing it here as well was how two conventions came to coexist.
         fingerprint = Finding.make_fingerprint(
             canonical_cwe=canonical_cwe,
             rule_id=rule_id,
@@ -304,36 +304,6 @@ class Scanner(ABC):
             cwe_top25=is_top25(canonical_cwe),
         )
 
-    def _rooted(self, file_path: Path) -> Path:
-        """Anchor a scanner-reported path to the audited tree.
-
-        Adapters do not agree on this. Bandit, Semgrep, RuboCop and the rest
-        report absolute paths; gitleaks reports paths relative to the
-        repository it scanned. Both are reasonable and neither is negotiable
-        from here, so the difference is absorbed at the one boundary every
-        adapter passes through.
-
-        Leaving it unabsorbed was not cosmetic. Every consumer that answers
-        "where is this?" — `is_excluded`, `is_test_path`, the axis split —
-        resolves a relative path against the *process* working directory,
-        which is wherever the operator happened to invoke the CLI. From there
-        `relative_to(root)` raises and the answer comes back "no". So
-        `exclude_patterns` silently did not apply to gitleaks findings at all:
-        an operator excluding `vendor/` still had vendor secrets scored, and
-        the calibration corpus scored four `tests/certs/*.key` files in
-        `requests` and six documentation examples in `flask` as production
-        secrets, holding both at F.
-
-        A path that is already absolute is returned untouched, including one
-        outside the target — an imported SARIF may legitimately name another
-        machine's tree, and inventing a root for it would be worse than
-        leaving it where it is.
-        """
-        if file_path.is_absolute():
-            return file_path
-        root = getattr(self, "_target_root", None)
-        return root / file_path if root is not None else file_path
-
     def _findings_exit_contradiction(
         self,
         target: Path,

{secure_code_agent-0.12.0 → secure_code_agent-0.12.2}/src/secure_code_audit/suppressions.py

@@ -17,7 +17,7 @@ Entry schema (.scignore.yaml)::
         ...
       expires: 2027-08-01                  # required; max 365 days out
       file: api/tests/x.py                 # optional path (suffix match)
-      paths: ["api/**"]                    # optional fnmatch patterns
+      paths: ["api/**"]                    # optional fnmatch patterns, repository-relative
       fingerprint: 0aaa689f8a967d8c        # optional; 16 hex chars, from the report
       line: 18                             # optional; positive integer
 
@@ -66,17 +66,36 @@ class SuppressionRule:
     fingerprint: str | None = None
     line: int | None = None
 
-    def matches(self, finding: Finding) -> bool:
+    def matches(self, finding: Finding, root: Path | None = None) -> bool:
+        """Does this entry cover `finding`?
+
+        `finding.file_path` is repository-relative (`findings.anchor`), which is
+        what an entry names. Through 0.12.1 it was absolute for most scanners, so
+        a `paths:` glob written relative never matched and entries grew a `*/`
+        prefix to swallow the checkout directory. Those entries keep working
+        without depending on where the checkout lives: a glob is also tried
+        against the path with a leading `/`, and `*/src/app.py` matches
+        `/src/app.py`. `root` lets an absolute `file:` and a fingerprint
+        recorded by an earlier release keep matching the finding they named.
+        """
         if self.rule_id != "*" and self.rule_id != finding.rule_id:
             return False
         rel = finding.file_path.as_posix()
-        if self.file is not None and self.file != rel and not rel.endswith(self.file):
+        if self.file is not None and not self._names_file(rel, finding, root):
             return False
-        if self.fingerprint is not None and self.fingerprint != finding.fingerprint:
+        if self.fingerprint is not None and self.fingerprint not in _identities(finding, root):
             return False
         if self.line is not None and self.line != finding.line_start:
             return False
-        return not self.paths or any(fnmatch.fnmatch(rel, p) for p in self.paths)
+        return not self.paths or any(
+            fnmatch.fnmatch(rel, p) or fnmatch.fnmatch(f"/{rel}", p) for p in self.paths
+        )
+
+    def _names_file(self, rel: str, finding: Finding, root: Path | None) -> bool:
+        if self.file == rel or rel.endswith(self.file):
+            return True
+        named = Path(self.file)
+        return root is not None and named.is_absolute() and named == root / finding.file_path
 
     @property
     def expired(self) -> bool:
@@ -182,15 +201,26 @@ def load(path: Path) -> tuple[list[SuppressionRule], list[str]]:
     return rules, errors
 
 
-def apply(findings: list[Finding], rules: list[SuppressionRule]) -> list[Finding]:
+def _identities(finding: Finding, root: Path | None) -> set[str]:
+    """The fingerprint, plus the one 0.12.1 and earlier recorded for it."""
+    if root is None:
+        return {finding.fingerprint}
+    return {finding.fingerprint, finding.legacy_fingerprint(root)}
+
+
+def apply(
+    findings: list[Finding], rules: list[SuppressionRule], root: Path | None = None
+) -> list[Finding]:
     """Mark matching findings as suppressed (set suppressed=True + note).
     Expired rules do NOT suppress — but generate their own findings via
-    `expired_findings()`. Returns a new list (frozen dataclass replace)."""
+    `expired_findings()`. Returns a new list (frozen dataclass replace).
+
+    `root` is the repository root the finding paths are relative to."""
     from dataclasses import replace
 
     out: list[Finding] = []
     for f in findings:
-        active = next((r for r in rules if not r.expired and r.matches(f)), None)
+        active = next((r for r in rules if not r.expired and r.matches(f, root)), None)
         if active is not None:
             out.append(
                 replace(

{secure_code_agent-0.12.0 → secure_code_agent-0.12.2}/src/secure_code_audit/triage.py

@@ -28,6 +28,7 @@ from __future__ import annotations
 import enum
 import re
 from collections.abc import Iterable
+from pathlib import Path
 
 from secure_code_audit.findings import Category, Confidence, Finding, Severity
 
@@ -156,7 +157,7 @@ def _contains_a_literal_credential(text: str) -> bool:
     return False
 
 
-def _line_of(finding: Finding) -> str | None:
+def _line_of(finding: Finding, root: Path | None = None) -> str | None:
     """Read back the source line a secrets finding points at.
 
     Gitleaks is run with `--redact`, so the matched text never reaches the
@@ -168,10 +169,14 @@ def _line_of(finding: Finding) -> str | None:
     is gone, the path is a directory, the line number is out of range, or the
     finding came out of git history and the working tree has moved on. Every
     one of those must leave the finding where it was.
+
+    `root` is the repository root the finding's path is relative to. Without
+    it a relative path would be read from the process working directory, and
+    the demotion would depend on where the CLI was invoked.
     """
-    path = finding.file_path
-    if path is None or finding.line_start is None or finding.line_start < 1:
+    if finding.file_path is None or finding.line_start is None or finding.line_start < 1:
         return None
+    path = root / finding.file_path if root is not None else finding.file_path
     try:
         if not path.is_file():
             return None
@@ -186,7 +191,7 @@ def _line_of(finding: Finding) -> str | None:
     return None
 
 
-def _is_a_reference_not_a_value(finding: Finding) -> bool:
+def _is_a_reference_not_a_value(finding: Finding, root: Path | None = None) -> bool:
     """Is the flagged credential a variable name rather than a credential?
 
     `gitleaks.curl-auth-user` fires CRITICAL on
@@ -210,7 +215,7 @@ def _is_a_reference_not_a_value(finding: Finding) -> bool:
     """
     if finding.category is not Category.SECRETS:
         return False
-    line = _line_of(finding)
+    line = _line_of(finding, root)
     if line is None:
         return False
     if not _VARIABLE_REFERENCE.search(line):
@@ -221,7 +226,7 @@ def _is_a_reference_not_a_value(finding: Finding) -> bool:
     return not _contains_a_literal_credential(without_references)
 
 
-def tier_of(finding: Finding, axis: str = "primary") -> Tier:
+def tier_of(finding: Finding, axis: str = "primary", root: Path | None = None) -> Tier:
     """Classify one finding.
 
     Order matters. Where a finding *lives* outweighs what rule found it: a
@@ -235,19 +240,19 @@ def tier_of(finding: Finding, axis: str = "primary") -> Tier:
         if _looks_like_a_credential(finding.message):
             return Tier.FIX
         return Tier.REVIEW
-    if _is_a_reference_not_a_value(finding):
+    if _is_a_reference_not_a_value(finding, root):
         return Tier.REVIEW
     if finding.confidence is Confidence.LOW:
         return Tier.REVIEW
     return Tier.FIX
 
 
-def reason_for(finding: Finding) -> str | None:
+def reason_for(finding: Finding, root: Path | None = None) -> str | None:
     """Why a finding was demoted, in words the reader can check."""
     measured = LOW_PRECISION.get(finding.rule_id)
     if measured:
         return measured
-    if _is_a_reference_not_a_value(finding):
+    if _is_a_reference_not_a_value(finding, root):
         return (
             "The line holds a variable reference, not a credential — a name "
             "standing in for a value kept elsewhere, which is the recommended "
@@ -265,7 +270,7 @@ def reason_for(finding: Finding) -> str | None:
 
 
 def partition(
-    findings: Iterable[Finding], axis_of=lambda _f: "primary"
+    findings: Iterable[Finding], axis_of=lambda _f: "primary", root: Path | None = None
 ) -> dict[Tier, list[Finding]]:
     """Group actionable findings by tier, worst-first within each.
 
@@ -277,7 +282,7 @@ def partition(
     for finding in findings:
         if finding.suppressed or finding.severity is Severity.INFORMATIONAL:
             continue
-        out[tier_of(finding, axis_of(finding))].append(finding)
+        out[tier_of(finding, axis_of(finding), root)].append(finding)
     for group in out.values():
         group.sort(key=lambda f: (-f.severity.rank, f.file_path.as_posix(), f.line_start))
     return out

{secure_code_agent-0.12.0 → secure_code_agent-0.12.2}/src/secure_code_audit/verify.py

@@ -114,8 +114,14 @@ def measure_scope(
 
     cited: set[str] = set()
     for finding in before:
+        # Joined onto the root first. A repository-relative path resolved bare
+        # is anchored to the working directory, which names the wrong file
+        # whenever the CLI runs from a subdirectory. A before-report from
+        # 0.12.1 or earlier holds absolute paths, and joining leaves those as
+        # they are.
         try:
-            cited.add(finding.file_path.resolve().relative_to(root.resolve()).as_posix())
+            located = (root / finding.file_path).resolve()
+            cited.add(located.relative_to(root.resolve()).as_posix())
         except (ValueError, OSError):
             cited.add(finding.file_path.as_posix())
 
@@ -323,7 +329,7 @@ def compare(
     suppressed_now |= silenced_inline
 
     def _asked_about(finding: Finding) -> bool:
-        return triage.tier_of(finding, axis_of(finding)) is not triage.Tier.ACCEPT
+        return triage.tier_of(finding, axis_of(finding), root) is not triage.Tier.ACCEPT
 
     fixed = [f for fp, f in old.items() if fp not in new and fp not in suppressed_now]
     still_open = [f for fp, f in old.items() if fp in new]