secure-code-agent 0.12.2__tar.gz → 0.12.3__tar.gz

{secure_code_agent-0.12.2/src/secure_code_agent.egg-info → secure_code_agent-0.12.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: secure-code-agent
-Version: 0.12.2
+Version: 0.12.3
 Summary: Deterministic security gate + bounded AI remediation prompt generator. NIST SSDF / OWASP ASVS / CWE Top 25 anchored.
 Author: Marshall Guillory
 License: MIT
@@ -448,6 +448,8 @@ for repositories whose `pyproject.toml` is their authoritative audit input.
   expires: "2027-05-13"
 ```
 
+`paths` entries are repository-relative and use the same pattern syntax as `exclude_patterns`: a trailing `/` means that directory at any depth, a bare name matches at any depth, and `**/` includes the root.
+
 Wildcard rule (`rule_id: "*"`) requires a `file` or `paths` scope — you cannot disable a rule globally.
 
 ## Baseline + incremental adoption
@@ -511,7 +513,7 @@ For agents that support invokable skills, this repo ships a portable skill under
 ## GitHub Action
 
 ```yaml
-- uses: marshallguillory86/secure-code-agent@v0.12.2
+- uses: marshallguillory86/secure-code-agent@v0.12.3
   with:
     config: secure-code-agent.json
     fail-on-gate: true

{secure_code_agent-0.12.2 → secure_code_agent-0.12.3}/README.md

@@ -400,6 +400,8 @@ for repositories whose `pyproject.toml` is their authoritative audit input.
   expires: "2027-05-13"
 ```
 
+`paths` entries are repository-relative and use the same pattern syntax as `exclude_patterns`: a trailing `/` means that directory at any depth, a bare name matches at any depth, and `**/` includes the root.
+
 Wildcard rule (`rule_id: "*"`) requires a `file` or `paths` scope — you cannot disable a rule globally.
 
 ## Baseline + incremental adoption
@@ -463,7 +465,7 @@ For agents that support invokable skills, this repo ships a portable skill under
 ## GitHub Action
 
 ```yaml
-- uses: marshallguillory86/secure-code-agent@v0.12.2
+- uses: marshallguillory86/secure-code-agent@v0.12.3
   with:
     config: secure-code-agent.json
     fail-on-gate: true

{secure_code_agent-0.12.2 → secure_code_agent-0.12.3/src/secure_code_agent.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: secure-code-agent
-Version: 0.12.2
+Version: 0.12.3
 Summary: Deterministic security gate + bounded AI remediation prompt generator. NIST SSDF / OWASP ASVS / CWE Top 25 anchored.
 Author: Marshall Guillory
 License: MIT
@@ -448,6 +448,8 @@ for repositories whose `pyproject.toml` is their authoritative audit input.
   expires: "2027-05-13"
 ```
 
+`paths` entries are repository-relative and use the same pattern syntax as `exclude_patterns`: a trailing `/` means that directory at any depth, a bare name matches at any depth, and `**/` includes the root.
+
 Wildcard rule (`rule_id: "*"`) requires a `file` or `paths` scope — you cannot disable a rule globally.
 
 ## Baseline + incremental adoption
@@ -511,7 +513,7 @@ For agents that support invokable skills, this repo ships a portable skill under
 ## GitHub Action
 
 ```yaml
-- uses: marshallguillory86/secure-code-agent@v0.12.2
+- uses: marshallguillory86/secure-code-agent@v0.12.3
   with:
     config: secure-code-agent.json
     fail-on-gate: true

{secure_code_agent-0.12.2 → secure_code_agent-0.12.3}/src/secure_code_audit/__init__.py

@@ -12,4 +12,4 @@
 #:
 #: PyPI is immutable, so 0.4.0 stays wrong. 0.5.0 is the first build whose
 #: artifacts name their own producer correctly.
-__version__ = "0.12.2"
+__version__ = "0.12.3"

{secure_code_agent-0.12.2 → secure_code_agent-0.12.3}/src/secure_code_audit/git_tools.py

@@ -48,6 +48,17 @@ def is_excluded(path: Path, root: Path, patterns: Iterable[str]) -> bool:
     return any(_matches(rel, path.name, pat) for pat in patterns)
 
 
+def matches_pattern(rel: str, pattern: str) -> bool:
+    """One configured path pattern against one repository-relative POSIX path.
+
+    The pattern language every path setting shares: `exclude_patterns`,
+    `test_patterns`, `docs_patterns`, and `.scignore.yaml` `paths:`. There is
+    one of it so the same string cannot mean two things in one configuration
+    (D21).
+    """
+    return _matches(rel, rel.rsplit("/", 1)[-1], pattern)
+
+
 def _matches(rel: str, name: str, pat: str) -> bool:
     """One glob against one path, already made relative to the root.
 

{secure_code_agent-0.12.2 → secure_code_agent-0.12.3}/src/secure_code_audit/suppressions.py

@@ -17,7 +17,7 @@ Entry schema (.scignore.yaml)::
         ...
       expires: 2027-08-01                  # required; max 365 days out
       file: api/tests/x.py                 # optional path (suffix match)
-      paths: ["api/**"]                    # optional fnmatch patterns, repository-relative
+      paths: ["api/"]                      # optional; exclude_patterns syntax, repository-relative
       fingerprint: 0aaa689f8a967d8c        # optional; 16 hex chars, from the report
       line: 18                             # optional; positive integer
 
@@ -37,6 +37,7 @@ from dataclasses import dataclass, field
 from pathlib import Path
 
 from secure_code_audit.findings import Category, Confidence, Finding, Severity
+from secure_code_audit.git_tools import matches_pattern
 
 _DATE_RE = re.compile(r"^\d{4}-\d{2}-\d{2}$")
 _MAX_TTL_DAYS = 365
@@ -77,6 +78,13 @@ class SuppressionRule:
         against the path with a leading `/`, and `*/src/app.py` matches
         `/src/app.py`. `root` lets an absolute `file:` and a fingerprint
         recorded by an earlier release keep matching the finding they named.
+
+        **A `paths:` glob is an exclude pattern (D21).** It is matched by
+        `git_tools.matches_pattern`, the matcher `exclude_patterns` uses, so a
+        trailing slash means "this directory, at any depth" and a bare name
+        matches at any depth. Through 0.12.2 it was bare `fnmatch`, under which
+        `paths: ["tests/"]` — the example README, `design.md` and the skill all
+        show — matched nothing.
         """
         if self.rule_id != "*" and self.rule_id != finding.rule_id:
             return False
@@ -88,7 +96,7 @@ class SuppressionRule:
         if self.line is not None and self.line != finding.line_start:
             return False
         return not self.paths or any(
-            fnmatch.fnmatch(rel, p) or fnmatch.fnmatch(f"/{rel}", p) for p in self.paths
+            matches_pattern(rel, p) or fnmatch.fnmatch(f"/{rel}", p) for p in self.paths
         )
 
     def _names_file(self, rel: str, finding: Finding, root: Path | None) -> bool: