Repository navigation
Record repository, commit and rule-source provenance in results (#67) - #98
Merged
Merged
Conversation
Results now say which repository, commit and branch were analysed, and which rule sources (and rules-cache commit) were used, so a report can be reproduced. JSON (validation-report.v1, additive optional fields, schemaVersion stays 1.0): repository, commit, branch, ruleSources[] (kind, location, commit). Omitted when unknown. SARIF: tool.driver.version is the CodeGuard version, run.versionControlProvenance carries repository/commit/branch when the repository URI is known, and rule sources are in the run property bag. Gathering lives in the CLI (ValidationProvenanceGatherer): CI variables for GitHub Actions, GitLab CI and Azure Pipelines win per field, and git fills the rest. Repository access and environment lookup are injected for tests. Remote URLs are normalised so credentials never reach a report. Reporters receive a ValidationProvenance and never shell out. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
# Conflicts: # docs/architecture/IMPLEMENTATION_STATUS.md
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Results now record which repository, commit and branch were analysed, and which rule sources (and rules-cache commit) were used, so a report can be reproduced.
JSON (
validation-report.v1)Additive optional fields.
schemaVersionstays1.0, and fields are omitted when unknown.repository: normalised remote URL. Userinfo, query and fragment are removed, and.gitis dropped. scp-style remotes becomessh://host/path.commit,branchruleSources[]:kind(gitordirectory),location, andcommit(rules-cache HEAD, git only)The schema,
ValidationReportV1, the mapper anddocs/architecture/RESULT_CONTRACT.mdare updated.SARIF
tool.driver.versionis the CodeGuard version.run.versionControlProvenancecarries repository, commit and branch. It is written only when the repository URI is known, because SARIF requiresrepositoryUri.ruleSources.Gathering and layering
ValidationProvenanceGatherer(CLI) gathers values. CI variables win per field for GitHub Actions, GitLab CI and Azure Pipelines. Git fills the rest.GITHUB_HEAD_REFis preferred overGITHUB_REF_NAMEso PRs report their source branch.IGitCommandRunner) and the environment lookup are injected, so precedence is unit-tested.ValidationProvenancethrough their constructors and never shell out. Reporting depends only on Core.GitRuleSourceSync.RunCoreis nowinternaland shared with the provenance runner, so there is one process helper.Tests
RepositoryUrlNormalizercasesversionControlProvenance, driver version and rule-source propertyVerification
dotnet build: 0 warnings, 0 errorsdotnet test: all test projects passdotnet format --verify-no-changes: cleanCloses #67
🤖 Generated with Claude Code