Skip to content

Commit a36046b

Browse files
cassiodevelopercassiodeveloper
committed
release: v0.3.0
- Multi-SARIF nativo com dedup por (ruleId, path, line) - Diff-aware ativo por padrão com degradação segura - Supressões por fingerprint (deny_fingerprints) - Fix: NoneType crash em asset.path ausente - Fix: critical de properties.severity downgraded para high - Fix: SyntaxError no bloco Python inline do action.yml - Fix: base_ref sem validação no diff_filter (injeção) - Fix: paginação ausente no Checkmarx provider - Fix: diff-aware com changed_ranges vazio zerava findings - Novo: policy_validator com erros descritivos - Licença corrigida para PolyForm Noncommercial nos docs
1 parent 3bad827 commit a36046b

15 files changed

Lines changed: 1219 additions & 499 deletions

‎CHANGELOG.md‎

Lines changed: 43 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,44 @@ The format is based on semantic versioning and follows a simple chronological re
66

77
---
88

9+
## v0.3.0 — 2026-03
10+
11+
### Added
12+
13+
* **Multi-SARIF support**: `--sarif` now accepts multiple files as a comma-separated list
14+
(`--sarif semgrep.sarif,trivy.sarif`) or multiple flags. GitHub Action updated accordingly.
15+
Findings are deduplicated across files by `(ruleId, path, line)`.
16+
* **Diff-aware filtering enabled by default** in PR mode. SecScore now automatically filters
17+
findings to only those touching lines changed in the PR. Use `--no-diff-aware` to opt out.
18+
Gracefully degrades (warning, no abort) when not running inside a git repository or when
19+
the diff returns no changed files.
20+
* **Suppressions by fingerprint**: policy `suppressions.deny_fingerprints` list allows
21+
suppressing specific known false positives by their finding fingerprint — traceable and
22+
reviewable in version control.
23+
* `action.yml` new inputs: `no_diff_aware`, `base_ref`.
24+
* `policy_validator.py` now validates `suppressions.deny_fingerprints` entries.
25+
* Policy version bumped to `1.1` in default policy files.
26+
27+
### Fixed
28+
29+
* `engine.py`: `NoneType` crash when `asset.path` was absent in a finding.
30+
* `sarif.py`: `critical` severity from `properties.severity` (Semgrep, Snyk) was silently
31+
downgraded to `high`. Now correctly propagated.
32+
* `action.yml`: Python inline block had incorrect indentation causing `SyntaxError` on the
33+
GitHub Actions runner.
34+
* `diff_filter.py`: `base_ref` argument was passed unsanitized to `subprocess`. Now validated
35+
against an allowlist regex before use.
36+
* `checkmarx_provider.py`: `get_results` used a hard-coded `limit=1000` with no pagination,
37+
silently dropping findings beyond the first 1000. Replaced with a paginated loop.
38+
* `policy_validator.py` (new): policy YAML is now validated before reaching the engine.
39+
Structural errors, unknown severity names, and misconfigured thresholds produce clear
40+
error messages instead of silently incorrect scores.
41+
* `main.py`: diff-aware with empty `changed_ranges` was silently discarding all findings,
42+
causing every run to score 100 and return PASS. Now skips filtering when diff is empty
43+
and warns the user.
44+
45+
---
46+
947
## v0.2.0 — 2026-03
1048

1149
### Added
@@ -39,4 +77,8 @@ The format is based on semantic versioning and follows a simple chronological re
3977

4078
## Notes
4179

42-
SecScore aims to reduce **security scanner noise** and provide **objective merge decisions** in CI/CD pipelines by introducing a policy-driven security score between scanners and Pull Requests.
80+
SecScore aims to reduce **security scanner noise** and provide **objective merge decisions**
81+
in CI/CD pipelines by introducing a policy-driven security score between scanners and Pull Requests.
82+
83+
This project is licensed under the [PolyForm Noncommercial License 1.0.0](LICENSE).
84+
Commercial use requires explicit permission from the author.

‎LICENSE‎

Lines changed: 127 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,133 @@
1-
PolyForm Noncommercial License 1.0.0
1+
# PolyForm Noncommercial License 1.0.0
22

3-
Copyright (c) 2026 Cássio
3+
[Full license text here](https://polyformproject.org/licenses/noncommercial/1.0.0/)
44

5-
The Software may be used, modified, and redistributed for non-commercial purposes only.
5+
## Acceptance
66

7-
Commercial use of this software, including incorporation into a paid product,
8-
service, or platform, requires explicit permission from the copyright holder.
7+
In order to get any license under these terms, you must agree
8+
to them as both strict obligations and conditions to all
9+
your licenses.
910

10-
For commercial licensing inquiries, please contact the project author.
11+
## Copyright License
1112

12-
Full license text:
13+
The licensor grants you a copyright license for the
14+
software to do everything you might do with the software
15+
that would otherwise infringe the licensor's copyright
16+
in it for any permitted purpose. However, you may
17+
only distribute the software according to [Distribution
18+
License](#distribution-license) and make changes or new works
19+
based on the software according to [Changes and New Works
20+
License](#changes-and-new-works-license).
1321

14-
https://polyformproject.org/licenses/noncommercial/1.0.0/
22+
## Distribution License
23+
24+
The licensor grants you an additional copyright license
25+
to distribute copies of the software. Your license
26+
to distribute covers distributing the software with
27+
changes and new works permitted by [Changes and New Works
28+
License](#changes-and-new-works-license).
29+
30+
## Notices
31+
32+
You must ensure that anyone who gets a copy of any part of
33+
the software from you also gets a copy of these terms or the
34+
URL for them above, as well as copies of any plain-text lines
35+
beginning with `Required Notice:` that the licensor provided
36+
with the software. For example:
37+
38+
> Required Notice: Copyright Yoyodyne, Inc. (http://example.com)
39+
40+
## Changes and New Works License
41+
42+
The licensor grants you an additional copyright license to
43+
make changes and new works based on the software for any
44+
permitted purpose.
45+
46+
## Patent License
47+
48+
The licensor grants you a patent license for the software that
49+
covers patent claims the licensor can license, or becomes able
50+
to license, that you would infringe by using the software.
51+
52+
## Noncommercial Purposes
53+
54+
Any noncommercial purpose is a permitted purpose.
55+
56+
## Personal Uses
57+
58+
Personal use for research, experiment, and testing for
59+
the benefit of public knowledge, personal study, private
60+
entertainment, hobby projects, amateur pursuits, or religious
61+
observance, without any anticipated commercial application,
62+
is use for a permitted purpose.
63+
64+
## Noncommercial Organizations
65+
66+
Use by any charitable organization, educational institution,
67+
public research organization, public safety or health
68+
organization, environmental protection organization,
69+
or government institution is use for a permitted purpose
70+
regardless of the source of funding or obligations resulting
71+
from the funding.
72+
73+
## Fair Use
74+
75+
You may have "fair use" rights for the software under the
76+
law. These terms do not limit them.
77+
78+
## No Other Rights
79+
80+
These terms do not allow you to sublicense or transfer any of
81+
your licenses to anyone else, or prevent the licensor from
82+
granting licenses to anyone else. These terms do not imply
83+
any other licenses.
84+
85+
## Patent Defense
86+
87+
If you make any written claim that the software infringes or
88+
contributes to infringement of any patent, your patent license
89+
for the software granted under these terms ends immediately. If
90+
your company makes such a claim, your patent license ends
91+
immediately for work on behalf of your company.
92+
93+
## Violations
94+
95+
The first time you are notified in writing that you have
96+
violated any of these terms, or done anything with the software
97+
not covered by your licenses, your licenses can nonetheless
98+
continue if you come into full compliance with these terms,
99+
and take practical steps to correct past violations, within
100+
32 days of receiving notice. Otherwise, all your licenses
101+
end immediately.
102+
103+
## No Liability
104+
105+
***As far as the law allows, the software comes as is, without
106+
any warranty or condition, and the licensor will not be liable
107+
to you for any damages arising out of these terms or the use
108+
or nature of the software, under any kind of legal claim.***
109+
110+
## Definitions
111+
112+
The **licensor** is the individual or entity offering these
113+
terms, and the **software** is the software the licensor makes
114+
available under these terms.
115+
116+
**You** refers to the individual or entity agreeing to these
117+
terms.
118+
119+
**Your company** is any legal entity, sole proprietorship,
120+
or other kind of organization that you work for, plus all
121+
organizations that have control over, are under the control of,
122+
or are under common control with that organization. **Control**
123+
means ownership of substantially all the assets of an entity,
124+
or the power to direct its management and policies by vote,
125+
contract, or otherwise. Control can be direct or indirect.
126+
127+
**Your licenses** are all the licenses granted to you for the
128+
software under these terms.
129+
130+
**Use** means anything you do with the software requiring one
131+
of your licenses.
132+
133+
[Full license text here](https://polyformproject.org/licenses/noncommercial/1.0.0/)

0 commit comments

Comments
 (0)