Skip to content

Commit 48ac7b4

Browse files
pranavcodeantpranavcodeant
committed
scans
1 parent 72533bc commit 48ac7b4

7 files changed

Lines changed: 36 additions & 69 deletions

File tree

‎src/commands/scans/index.js‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,8 @@ export default function registerScansCommands(program, { runCmd }) {
7171
.option('--severity <list>', 'Filter by severity (e.g. critical,high)')
7272
.option('--path <glob>', 'Filter by file path glob')
7373
.option('--check <regex>', 'Filter by check ID or name (regex)')
74-
.option('--include-dismissed', 'Include dismissed findings (excluded by default)')
74+
.option('--filter-dismissed', 'Exclude dismissed findings (default: false)')
75+
.option('--no-false-positives', 'Exclude false positives (default: included)')
7576
.option('--format <fmt>', 'Output format: json|sarif|csv|md|table (default: json)', 'json')
7677
.option('--output <path>', 'Write output to file instead of stdout')
7778
.option('--fields <list>', 'Project findings to subset of fields (comma-separated)')
@@ -96,7 +97,8 @@ export default function registerScansCommands(program, { runCmd }) {
9697
severity: opts.severity,
9798
path: opts.path,
9899
check: opts.check,
99-
includeDismissed: opts.includeDismissed || false,
100+
filterDismissed: opts.filterDismissed || false,
101+
includeFalsePositives: opts.falsePositives ?? true,
100102
format: opts.format,
101103
output: opts.output,
102104
fields: opts.fields,

‎src/commands/scans/lib/filters.js‎

Lines changed: 5 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,22 @@
11
import { minimatch } from 'minimatch';
2-
import { isDismissed, findDismissMatch } from './dismissMatch.js';
32
import { normalizeSeverity } from './normalize.js';
43

5-
const SEV_RANK = { critical: 5, high: 4, medium: 3, low: 2, info: 1, unknown: 0 };
6-
74
/**
8-
* Apply all filters to findings in-place (returns new array).
5+
* Apply client-side filters to findings (returns new array).
6+
* Dismissed / false-positive filtering is handled exclusively by the backend.
97
*
108
* @param {Array} findings - NormalizedFinding[]
119
* @param {object} opts
12-
* @param {string[]|null} opts.severity - allowed severity levels (e.g. ['critical','high'])
13-
* @param {string|null} opts.pathGlob - minimatch glob for file_path
10+
* @param {string[]|null} opts.severity - allowed severity levels (e.g. ['critical','high'])
11+
* @param {string|null} opts.pathGlob - minimatch glob for file_path
1412
* @param {string|null} opts.checkRegex - regex applied to check_id + check_name
15-
* @param {Array} opts.dismissedAlerts - from fetchDismissedAlerts()
16-
* @param {boolean} opts.includeDismissed
17-
* @returns {Array} filtered NormalizedFinding[] (dismissed field annotated)
13+
* @returns {Array} filtered NormalizedFinding[]
1814
*/
1915
export function applyFilters(findings, {
2016
severity = null,
2117
pathGlob = null,
2218
checkRegex = null,
23-
dismissedAlerts = [],
24-
includeDismissed = false,
2519
} = {}) {
26-
// Pre-compile regex — strip Python/PCRE inline flag (?i) and fold into JS flag
2720
let checkRe = null;
2821
if (checkRegex) {
2922
try {
@@ -37,35 +30,15 @@ export function applyFilters(findings, {
3730
}
3831
}
3932

40-
// Severity set
4133
const sevSet = severity && severity.length > 0
4234
? new Set(severity.map((s) => normalizeSeverity(s)))
4335
: null;
4436

4537
const result = [];
4638
for (const f of findings) {
47-
// Annotate dismiss status
48-
const match = findDismissMatch(f, dismissedAlerts);
49-
f.dismissed = match !== null;
50-
if (match) {
51-
f.dismiss_info = {
52-
reason: match.reason_for_dismiss || null,
53-
comment: match.comment_for_dismiss || null,
54-
};
55-
}
56-
57-
// Filter dismissed
58-
if (f.dismissed && !includeDismissed) continue;
59-
60-
// Filter by severity
6139
if (sevSet && !sevSet.has(f.severity)) continue;
62-
63-
// Filter by path glob
6440
if (pathGlob && !minimatch(f.file_path, pathGlob, { matchBase: true })) continue;
65-
66-
// Filter by check regex
6741
if (checkRe && !checkRe.test(f.check_id) && !checkRe.test(f.check_name)) continue;
68-
6942
result.push(f);
7043
}
7144
return result;

‎src/commands/scans/lib/normalize.js‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -106,8 +106,6 @@ export function normalizeIssue(issue, category) {
106106
cve: cve ? String(cve) : null,
107107
package: packageInfo,
108108
metadata,
109-
dismissed: false,
110-
dismiss_info: null,
111109
};
112110
}
113111

‎src/commands/scans/results.js‎

Lines changed: 9 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,6 @@ import { paginate } from './lib/paginate.js';
77
import { emit } from './lib/emit.js';
88
import { progress, logError } from './lib/log.js';
99
import { FORMATTERS } from './formatters/index.js';
10-
import { fetchDismissedAlerts } from '../../scans/fetchDismissedAlerts.js';
1110

1211
/**
1312
* codeant scans results — full orchestration.
@@ -23,7 +22,8 @@ export async function runResults(opts = {}) {
2322
severity,
2423
path: pathGlob,
2524
check: checkRegex,
26-
includeDismissed = false,
25+
filterDismissed = false,
26+
includeFalsePositives = true,
2727
format = 'json',
2828
output: outputPath = null,
2929
fields = null,
@@ -53,16 +53,12 @@ export async function runResults(opts = {}) {
5353
// 2. Parse types
5454
const categories = parseTypes(types);
5555

56-
// 3. Fetch in parallel + dismissed alerts
56+
// 3. Fetch in parallel
5757
progress(`fetching ${categories.map((c) => c.key).join(', ')}…`);
58-
const [settled, dismissedResult] = await Promise.all([
59-
Promise.allSettled(categories.map((c) => c.fetcher(repo, scanMeta.commit_id))),
60-
includeDismissed
61-
? Promise.resolve({ success: true, dismissedAlerts: [] })
62-
: fetchDismissedAlerts(repo, 'security'),
63-
]);
64-
65-
const dismissedAlerts = dismissedResult.success ? (dismissedResult.dismissedAlerts ?? []) : [];
58+
const fetchOpts = { filterDismissed, includeFalsePositives };
59+
const settled = await Promise.allSettled(
60+
categories.map((c) => c.fetcher(repo, scanMeta.commit_id, fetchOpts))
61+
);
6662

6763
// 4. Collect findings + errors
6864
const allFindings = [];
@@ -100,8 +96,6 @@ export async function runResults(opts = {}) {
10096
severity: severityList,
10197
pathGlob: pathGlob || null,
10298
checkRegex: checkRegex || null,
103-
dismissedAlerts,
104-
includeDismissed,
10599
});
106100

107101
// 6. Sort
@@ -115,7 +109,8 @@ export async function runResults(opts = {}) {
115109
severity: severityList,
116110
path: pathGlob || null,
117111
check: checkRegex || null,
118-
include_dismissed: includeDismissed,
112+
filter_dismissed: filterDismissed,
113+
include_false_positives: includeFalsePositives,
119114
};
120115

121116
// Rebuild summary from all filtered (pre-page) findings

‎src/scans/fetchAdvancedScanResults.js‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -314,17 +314,17 @@ export async function fetchAdvancedScanResults(repo, commitId, resultType, opts
314314
}
315315
}
316316

317-
export const fetchScaResults = (repo, commitId) =>
318-
fetchAdvancedScanResults(repo, commitId, ADVANCED_RESULT_TYPES.SCA);
317+
export const fetchScaResults = (repo, commitId, opts) =>
318+
fetchAdvancedScanResults(repo, commitId, ADVANCED_RESULT_TYPES.SCA, opts);
319319

320-
export const fetchSbomResults = (repo, commitId) =>
321-
fetchAdvancedScanResults(repo, commitId, ADVANCED_RESULT_TYPES.SBOM);
320+
export const fetchSbomResults = (repo, commitId, opts) =>
321+
fetchAdvancedScanResults(repo, commitId, ADVANCED_RESULT_TYPES.SBOM, opts);
322322

323-
export const fetchSecretsResults = (repo, commitId) =>
324-
fetchAdvancedScanResults(repo, commitId, ADVANCED_RESULT_TYPES.SECRETS);
323+
export const fetchSecretsResults = (repo, commitId, opts) =>
324+
fetchAdvancedScanResults(repo, commitId, ADVANCED_RESULT_TYPES.SECRETS, opts);
325325

326-
export const fetchIacResults = (repo, commitId) =>
327-
fetchAdvancedScanResults(repo, commitId, ADVANCED_RESULT_TYPES.IAC);
326+
export const fetchIacResults = (repo, commitId, opts) =>
327+
fetchAdvancedScanResults(repo, commitId, ADVANCED_RESULT_TYPES.IAC, opts);
328328

329-
export const fetchDeadCodeResults = (repo, commitId) =>
330-
fetchAdvancedScanResults(repo, commitId, ADVANCED_RESULT_TYPES.DEAD_CODE);
329+
export const fetchDeadCodeResults = (repo, commitId, opts) =>
330+
fetchAdvancedScanResults(repo, commitId, ADVANCED_RESULT_TYPES.DEAD_CODE, opts);

‎src/scans/fetchScanResults.js‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -107,14 +107,14 @@ export async function fetchScanResults(repo, commitId, resultType, opts = {}) {
107107
}
108108
}
109109

110-
export const fetchSastResults = (repo, commitId) =>
111-
fetchScanResults(repo, commitId, VALID_RESULT_TYPES.SECURITY_ISSUES);
110+
export const fetchSastResults = (repo, commitId, opts) =>
111+
fetchScanResults(repo, commitId, VALID_RESULT_TYPES.SECURITY_ISSUES, opts);
112112

113-
export const fetchAntiPatternsResults = (repo, commitId) =>
114-
fetchScanResults(repo, commitId, VALID_RESULT_TYPES.ANTI_PATTERNS);
113+
export const fetchAntiPatternsResults = (repo, commitId, opts) =>
114+
fetchScanResults(repo, commitId, VALID_RESULT_TYPES.ANTI_PATTERNS, opts);
115115

116-
export const fetchDocstringResults = (repo, commitId) =>
117-
fetchScanResults(repo, commitId, VALID_RESULT_TYPES.DOCSTRING);
116+
export const fetchDocstringResults = (repo, commitId, opts) =>
117+
fetchScanResults(repo, commitId, VALID_RESULT_TYPES.DOCSTRING, opts);
118118

119-
export const fetchComplexFunctionsResults = (repo, commitId) =>
120-
fetchScanResults(repo, commitId, VALID_RESULT_TYPES.COMPLEX_FUNCTIONS);
119+
export const fetchComplexFunctionsResults = (repo, commitId, opts) =>
120+
fetchScanResults(repo, commitId, VALID_RESULT_TYPES.COMPLEX_FUNCTIONS, opts);

‎src/utils/fetchApi.js‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,6 @@ const fetchApi = async (endpoint, method = 'GET', body = null) => {
2222
}
2323

2424
try {
25-
console.error(`API Request: ${url} ${method} ${JSON.stringify(body)}`);
2625
const response = await fetch(url, options);
2726

2827
if (response.status === 403) {

0 commit comments

Comments
 (0)