Repository navigation
Conversation
…ng the engines
Coverage never reads complete for something CodeInspectus did not analyse:
- Languages and inputs no bundled rule or engine reads are named as stable
gap ids (php-sast, vue-sast, deno-lock, no-lockfile-npm, wordpress-plugins,
actions-unchecked, dev-deps-unscanned, sast-parse-errors, ...). Coverage is
partial and CI exits 2 unless the user accepts specific ids with
--accept-gaps / accept_gaps / acceptGaps; accepted ids are recorded in the
export and in history comparisons only where that stays sound.
- Opengrep timeouts, internal errors and parse failures, Trivy inline ignore
comments and Gitleaks ignore entries that can hide findings now lower
coverage instead of being silent.
A scanned repository or the host environment can no longer narrow a scan:
- Opengrep ignores the repo's .semgrepignore (managed default ignore list),
runs under a UTF-8 locale and with --no-git-ignore; Trivy and Gitleaks run
from an empty managed directory with explicit empty configs; inherited
SEMGREP_*, OPENGREP_*, TRIVY_* and GITLEAKS_* variables are stripped.
Also:
- Development dependencies are analysed (npm, Yarn, pnpm, Bun, Composer);
Maven scopes Trivy drops are named as a gap.
- Trivy findings name the package and the fixed version.
- Three bundled Opengrep rules no longer raise internal matching errors.
- Native JS/TS lexer hardening; its remaining limits are documented in
docs/CI-POLICY.md ("Native pack limits").
Existing finding ids and fingerprints are unchanged. See CHANGELOG
"Upgrading / CI impact".
Signed-off-by: Synvoya <support@synvoya.com>
- Opengrep runs under en_US.UTF-8 on macOS (the runner ships no C.UTF-8) and C.UTF-8 elsewhere; a missing locale still fails closed. - The managed Opengrep ignore list is written with LF line endings even from a CRLF (Windows) checkout. - Tests that assumed POSIX (chmod-based read denial, symlink privileges, path separators, the managed Gitleaks link that Windows never uses) now assert the correct behaviour per platform. Signed-off-by: Synvoya <support@synvoya.com>
…list disclosure on Windows Signed-off-by: Synvoya <support@synvoya.com>
Owner
Author
|
Folded into #14, the single CodeInspectus 4.0 PR (this change is included there). |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
CodeInspectus no longer reports coverage it did not achieve, and a scanned repository (or the host environment) can no longer make an engine scan less while coverage reads complete.
php-sast,vue-sast,deno-lock,no-lockfile-npm,wordpress-plugins,actions-unchecked,dev-deps-unscanned,sast-parse-errors) are named. Coverage ispartialand CI exits 2 unless the user accepts specific ids (--accept-gaps, MCPaccept_gaps, SDKacceptGaps). Accepted ids are recorded in the export..semgrepignore,.trivyignore,trivy.yaml, inheritedSEMGREP_*/TRIVY_*/GITLEAKS_*variables and parent-folder names no longer narrow a scan; Opengrep runs under UTF-8 and--no-git-ignore.docs/CI-POLICY.md→ "Native pack limits" (known-limitation tests included).Existing finding ids and fingerprints are unchanged. CI impact: repositories with undeclared gaps now exit 2 — see CHANGELOG "Upgrading / CI impact".
Verification
Stacked on #11 (base
agent/engine-bumps-2026-10).