secure-code-agent 0.12.2__tar.gz → 0.12.4__tar.gz

{secure_code_agent-0.12.2/src/secure_code_agent.egg-info → secure_code_agent-0.12.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: secure-code-agent
-Version: 0.12.2
+Version: 0.12.4
 Summary: Deterministic security gate + bounded AI remediation prompt generator. NIST SSDF / OWASP ASVS / CWE Top 25 anchored.
 Author: Marshall Guillory
 License: MIT
@@ -448,6 +448,8 @@ for repositories whose `pyproject.toml` is their authoritative audit input.
   expires: "2027-05-13"
 ```
 
+`paths` entries are repository-relative and use the same pattern syntax as `exclude_patterns`: a trailing `/` means that directory at any depth, a bare name matches at any depth, and `**/` includes the root.
+
 Wildcard rule (`rule_id: "*"`) requires a `file` or `paths` scope — you cannot disable a rule globally.
 
 ## Baseline + incremental adoption
@@ -511,7 +513,7 @@ For agents that support invokable skills, this repo ships a portable skill under
 ## GitHub Action
 
 ```yaml
-- uses: marshallguillory86/secure-code-agent@v0.12.2
+- uses: marshallguillory86/secure-code-agent@v0.12.4
   with:
     config: secure-code-agent.json
     fail-on-gate: true
@@ -521,7 +523,15 @@ The action installs the exact source bundled with the referenced action plus
 the pinned `required-scanners` extra (Bandit and pip-audit),
 emits Markdown, JSON, SARIF, PR-comment, and remediation artifacts, and uploads
 SARIF by default. The calling workflow must grant `security-events: write` for
-SARIF upload. Pin production usage to a full commit SHA; the version tag above
+SARIF upload.
+
+What it uploads is `secure-code.code-scanning.sarif`, not the full SARIF. Code
+scanning opens an alert for every uploaded result and does not act on SARIF
+`suppressions`, so uploading the full file raises an alert, and a review thread
+on pull requests, for every test-tree and documentation finding and every
+reviewed `.scignore.yaml` entry. The upload file leaves those out; the full SARIF,
+with each suppression and its reason, is kept as an artifact. Outside the action,
+`--code-scanning-sarif-output PATH` writes the same file. Pin production usage to a full commit SHA; the version tag above
 is shown for readability. See [`action.yml`](action.yml) and
 [`examples/github-actions/`](examples/github-actions/) for full workflows.
 

{secure_code_agent-0.12.2 → secure_code_agent-0.12.4}/README.md

@@ -400,6 +400,8 @@ for repositories whose `pyproject.toml` is their authoritative audit input.
   expires: "2027-05-13"
 ```
 
+`paths` entries are repository-relative and use the same pattern syntax as `exclude_patterns`: a trailing `/` means that directory at any depth, a bare name matches at any depth, and `**/` includes the root.
+
 Wildcard rule (`rule_id: "*"`) requires a `file` or `paths` scope — you cannot disable a rule globally.
 
 ## Baseline + incremental adoption
@@ -463,7 +465,7 @@ For agents that support invokable skills, this repo ships a portable skill under
 ## GitHub Action
 
 ```yaml
-- uses: marshallguillory86/secure-code-agent@v0.12.2
+- uses: marshallguillory86/secure-code-agent@v0.12.4
   with:
     config: secure-code-agent.json
     fail-on-gate: true
@@ -473,7 +475,15 @@ The action installs the exact source bundled with the referenced action plus
 the pinned `required-scanners` extra (Bandit and pip-audit),
 emits Markdown, JSON, SARIF, PR-comment, and remediation artifacts, and uploads
 SARIF by default. The calling workflow must grant `security-events: write` for
-SARIF upload. Pin production usage to a full commit SHA; the version tag above
+SARIF upload.
+
+What it uploads is `secure-code.code-scanning.sarif`, not the full SARIF. Code
+scanning opens an alert for every uploaded result and does not act on SARIF
+`suppressions`, so uploading the full file raises an alert, and a review thread
+on pull requests, for every test-tree and documentation finding and every
+reviewed `.scignore.yaml` entry. The upload file leaves those out; the full SARIF,
+with each suppression and its reason, is kept as an artifact. Outside the action,
+`--code-scanning-sarif-output PATH` writes the same file. Pin production usage to a full commit SHA; the version tag above
 is shown for readability. See [`action.yml`](action.yml) and
 [`examples/github-actions/`](examples/github-actions/) for full workflows.
 

{secure_code_agent-0.12.2 → secure_code_agent-0.12.4/src/secure_code_agent.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: secure-code-agent
-Version: 0.12.2
+Version: 0.12.4
 Summary: Deterministic security gate + bounded AI remediation prompt generator. NIST SSDF / OWASP ASVS / CWE Top 25 anchored.
 Author: Marshall Guillory
 License: MIT
@@ -448,6 +448,8 @@ for repositories whose `pyproject.toml` is their authoritative audit input.
   expires: "2027-05-13"
 ```
 
+`paths` entries are repository-relative and use the same pattern syntax as `exclude_patterns`: a trailing `/` means that directory at any depth, a bare name matches at any depth, and `**/` includes the root.
+
 Wildcard rule (`rule_id: "*"`) requires a `file` or `paths` scope — you cannot disable a rule globally.
 
 ## Baseline + incremental adoption
@@ -511,7 +513,7 @@ For agents that support invokable skills, this repo ships a portable skill under
 ## GitHub Action
 
 ```yaml
-- uses: marshallguillory86/secure-code-agent@v0.12.2
+- uses: marshallguillory86/secure-code-agent@v0.12.4
   with:
     config: secure-code-agent.json
     fail-on-gate: true
@@ -521,7 +523,15 @@ The action installs the exact source bundled with the referenced action plus
 the pinned `required-scanners` extra (Bandit and pip-audit),
 emits Markdown, JSON, SARIF, PR-comment, and remediation artifacts, and uploads
 SARIF by default. The calling workflow must grant `security-events: write` for
-SARIF upload. Pin production usage to a full commit SHA; the version tag above
+SARIF upload.
+
+What it uploads is `secure-code.code-scanning.sarif`, not the full SARIF. Code
+scanning opens an alert for every uploaded result and does not act on SARIF
+`suppressions`, so uploading the full file raises an alert, and a review thread
+on pull requests, for every test-tree and documentation finding and every
+reviewed `.scignore.yaml` entry. The upload file leaves those out; the full SARIF,
+with each suppression and its reason, is kept as an artifact. Outside the action,
+`--code-scanning-sarif-output PATH` writes the same file. Pin production usage to a full commit SHA; the version tag above
 is shown for readability. See [`action.yml`](action.yml) and
 [`examples/github-actions/`](examples/github-actions/) for full workflows.
 

{secure_code_agent-0.12.2 → secure_code_agent-0.12.4}/src/secure_code_audit/__init__.py

@@ -12,4 +12,4 @@
 #:
 #: PyPI is immutable, so 0.4.0 stays wrong. 0.5.0 is the first build whose
 #: artifacts name their own producer correctly.
-__version__ = "0.12.2"
+__version__ = "0.12.4"

{secure_code_agent-0.12.2 → secure_code_agent-0.12.4}/src/secure_code_audit/cli.py

@@ -82,6 +82,15 @@ def _parser() -> argparse.ArgumentParser:
     p.add_argument("--output", help="Markdown report output path.")
     p.add_argument("--json-output", help="Canonical JSON output path.")
     p.add_argument("--sarif-output", help="SARIF 2.1.0 output path.")
+    p.add_argument(
+        "--code-scanning-sarif-output",
+        help=(
+            "SARIF for upload to GitHub code scanning: the --sarif-output results "
+            "without the suppressed ones (test tree, documentation, .scignore.yaml). "
+            "Code scanning opens an alert for every uploaded result and ignores "
+            "SARIF suppressions, so upload this file, not the record."
+        ),
+    )
     p.add_argument("--comment-output", help="PR-comment markdown output path.")
     p.add_argument("--prompt-output", help="Remediation prompt output path.")
     p.add_argument(
@@ -795,6 +804,7 @@ def _own_artifacts(paths: _OutputPaths, cfg: config_mod.Config, root: Path) -> f
         paths.markdown,
         paths.json_out,
         paths.sarif,
+        paths.code_scanning_sarif,
         paths.comment,
         paths.prompt,
         paths.security_pillar,
@@ -933,6 +943,14 @@ def _write_outputs(
         renderers.write_json(findings, score, gate, paths.json_out, coverage, verdict, axes, root)
     if paths.sarif is not None:
         sarif.write(findings, paths.sarif, coverage, lambda f: renderers.axis_of(f, axes))
+    if paths.code_scanning_sarif is not None:
+        sarif.write(
+            findings,
+            paths.code_scanning_sarif,
+            coverage,
+            lambda f: renderers.axis_of(f, axes),
+            alerts_only=True,
+        )
     if paths.comment is not None:
         renderers.write_pr_comment(findings, score, gate, paths.comment, coverage, verdict)
     if paths.prompt is not None:
@@ -970,6 +988,7 @@ class _OutputPaths:
     comment: Path | None
     prompt: Path | None
     security_pillar: Path | None
+    code_scanning_sarif: Path | None = None
 
 
 def _resolve_outputs(args: argparse.Namespace, cfg: config_mod.Config, root: Path) -> _OutputPaths:
@@ -1014,6 +1033,7 @@ def _resolve_outputs(args: argparse.Namespace, cfg: config_mod.Config, root: Pat
         comment=_p(args.comment_output, "comment_path"),
         prompt=_p(args.prompt_output, "prompt_path"),
         security_pillar=_p(args.security_pillar, "security_pillar_path"),
+        code_scanning_sarif=_p(args.code_scanning_sarif_output, "code_scanning_sarif_path"),
     )
 
 
@@ -1027,6 +1047,7 @@ _WRITE_KEYS = (
     "markdown_path",
     "json_path",
     "sarif_path",
+    "code_scanning_sarif_path",
     "comment_path",
     "prompt_path",
     "security_pillar_path",
@@ -1169,6 +1190,7 @@ def _print_summary(
             paths.markdown,
             paths.json_out,
             paths.sarif,
+            paths.code_scanning_sarif,
             paths.comment,
             paths.prompt,
             paths.security_pillar,

{secure_code_agent-0.12.2 → secure_code_agent-0.12.4}/src/secure_code_audit/config.py

@@ -136,6 +136,10 @@ DEFAULT_OUTPUTS: dict[str, str] = {
     "markdown_path": "secure-code-report.md",
     "json_path": "secure-code-report.json",
     "sarif_path": "secure-code.sarif",
+    # For upload to code scanning: the SARIF above without results that carry
+    # `suppressions`, which GitHub turns into alerts regardless (D22). Off
+    # unless declared, like sarif_path.
+    "code_scanning_sarif_path": "secure-code.code-scanning.sarif",
     "comment_path": "secure-code-pr-comment.md",
     "prompt_path": "secure-code-remediation-prompt.md",
     "baseline_path": "secure-code-baseline.json",

{secure_code_agent-0.12.2 → secure_code_agent-0.12.4}/src/secure_code_audit/git_tools.py

@@ -48,6 +48,17 @@ def is_excluded(path: Path, root: Path, patterns: Iterable[str]) -> bool:
     return any(_matches(rel, path.name, pat) for pat in patterns)
 
 
+def matches_pattern(rel: str, pattern: str) -> bool:
+    """One configured path pattern against one repository-relative POSIX path.
+
+    The pattern language every path setting shares: `exclude_patterns`,
+    `test_patterns`, `docs_patterns`, and `.scignore.yaml` `paths:`. There is
+    one of it so the same string cannot mean two things in one configuration
+    (D21).
+    """
+    return _matches(rel, rel.rsplit("/", 1)[-1], pattern)
+
+
 def _matches(rel: str, name: str, pat: str) -> bool:
     """One glob against one path, already made relative to the root.
 

{secure_code_agent-0.12.2 → secure_code_agent-0.12.4}/src/secure_code_audit/sarif.py

@@ -18,6 +18,7 @@ from secure_code_audit.scanner_status import (
     ScannerExecution,
     ScannerOutcome,
 )
+from secure_code_audit.scoring import GATED_FROM_ANY_AXIS
 from secure_code_audit.standards import cwe_url
 
 _SARIF_LEVEL = {
@@ -33,8 +34,25 @@ def emit(
     findings: Iterable[Finding],
     coverage: CoverageReport | None = None,
     axis_of=lambda _f: "primary",
+    *,
+    alerts_only: bool = False,
 ) -> dict:
-    """Build a SARIF 2.1.0 document from canonical findings."""
+    """Build a SARIF 2.1.0 document from canonical findings.
+
+    `alerts_only` builds the document for upload to a code-scanning platform:
+    results carrying `suppressions` are left out, rather than kept with the
+    field. GitHub code scanning opens an alert for every uploaded result and
+    does not act on `suppressions`, so the standard form turned each
+    test-tree `assert` into a pull-request review thread once D20 made paths
+    placeable (D22). The default keeps every result, as the record.
+
+    **Except what the build fails on.** A side-axis finding in a category the
+    gate escalates from any axis — a secret in a test fixture — is marked
+    suppressed in the record and still uploaded, without the marker, so the
+    Security tab shows the finding that failed the build. An operator's
+    reviewed suppression is left out whatever its category; it returns as a
+    live critical finding when it expires.
+    """
     findings = list(findings)
 
     # Build the rules array per-canonical-rule (rule_id is local; dedupe).
@@ -42,10 +60,15 @@ def emit(
     results: list[dict] = []
 
     for f in findings:
+        result = _result(f, axis_of(f))
+        if alerts_only and result.get("suppressions"):
+            if f.suppressed or f.category not in GATED_FROM_ANY_AXIS:
+                continue
+            del result["suppressions"]
         rid = f.rule_id
         if rid not in rule_meta:
             rule_meta[rid] = _rule(f)
-        results.append(_result(f, axis_of(f)))
+        results.append(result)
 
     run = {
         "tool": {
@@ -144,8 +167,13 @@ def _suppressions(f: Finding, axis: str) -> list[dict] | None:
     the shipped source.
 
     Suppressed, not omitted. The finding stays in the file with its
-    location and justification, so nothing is hidden from a reader — it
-    simply does not become someone's ticket.
+    location and justification, so nothing is hidden from a reader.
+
+    **GitHub code scanning does not honour it (D22).** It opens an alert for
+    every uploaded result regardless, which this function's premise assumed
+    it would not. So this is right for the record, and not enough for the
+    upload: `emit(..., alerts_only=True)` leaves these results out of the
+    file that goes to code scanning.
     """
     if f.suppressed:
         return [
@@ -206,8 +234,11 @@ def write(
     output: Path,
     coverage: CoverageReport | None = None,
     axis_of=lambda _f: "primary",
+    *,
+    alerts_only: bool = False,
 ) -> None:
-    output.write_text(json.dumps(emit(findings, coverage, axis_of), indent=2), encoding="utf-8")
+    document = emit(findings, coverage, axis_of, alerts_only=alerts_only)
+    output.write_text(json.dumps(document, indent=2), encoding="utf-8")
 
 
 # ----- ingest -------------------------------------------------------------

{secure_code_agent-0.12.2 → secure_code_agent-0.12.4}/src/secure_code_audit/suppressions.py

@@ -17,7 +17,7 @@ Entry schema (.scignore.yaml)::
         ...
       expires: 2027-08-01                  # required; max 365 days out
       file: api/tests/x.py                 # optional path (suffix match)
-      paths: ["api/**"]                    # optional fnmatch patterns, repository-relative
+      paths: ["api/"]                      # optional; exclude_patterns syntax, repository-relative
       fingerprint: 0aaa689f8a967d8c        # optional; 16 hex chars, from the report
       line: 18                             # optional; positive integer
 
@@ -37,6 +37,7 @@ from dataclasses import dataclass, field
 from pathlib import Path
 
 from secure_code_audit.findings import Category, Confidence, Finding, Severity
+from secure_code_audit.git_tools import matches_pattern
 
 _DATE_RE = re.compile(r"^\d{4}-\d{2}-\d{2}$")
 _MAX_TTL_DAYS = 365
@@ -77,6 +78,13 @@ class SuppressionRule:
         against the path with a leading `/`, and `*/src/app.py` matches
         `/src/app.py`. `root` lets an absolute `file:` and a fingerprint
         recorded by an earlier release keep matching the finding they named.
+
+        **A `paths:` glob is an exclude pattern (D21).** It is matched by
+        `git_tools.matches_pattern`, the matcher `exclude_patterns` uses, so a
+        trailing slash means "this directory, at any depth" and a bare name
+        matches at any depth. Through 0.12.2 it was bare `fnmatch`, under which
+        `paths: ["tests/"]` — the example README, `design.md` and the skill all
+        show — matched nothing.
         """
         if self.rule_id != "*" and self.rule_id != finding.rule_id:
             return False
@@ -88,7 +96,7 @@ class SuppressionRule:
         if self.line is not None and self.line != finding.line_start:
             return False
         return not self.paths or any(
-            fnmatch.fnmatch(rel, p) or fnmatch.fnmatch(f"/{rel}", p) for p in self.paths
+            matches_pattern(rel, p) or fnmatch.fnmatch(f"/{rel}", p) for p in self.paths
         )
 
     def _names_file(self, rel: str, finding: Finding, root: Path | None) -> bool: