From 878c19bd7838e8b4c2215f73f972c10d6ff77434 Mon Sep 17 00:00:00 2001 From: Vichitra Attri Date: Sat, 17 Oct 2026 05:45:15 +0000 Subject: [PATCH 1/9] research: let batch replay the corpus with Bandit or Semgrep `batch --analyzer bandit|semgrep` passes the analyzer to each replay, so the shipped tools' identity methods can be measured on their own tools' findings across the whole corpus, not only on Flask and DefectDojo. Bandit reads Python only, so its batch leaves out the JavaScript repositories. Results go to results/corpus-/ unless --out is given. A result directory now counts as done only for the analyzer named in its analyzer.json (CodeGuard when the file is missing, as in replays from before it existed), so runs of different analyzers never satisfy each other's resume check. Signed-off-by: Vichitra Attri --- research/finding_identity/README.md | 11 +++++ research/finding_identity/batch.py | 29 ++++++++++++- research/finding_identity/commands.py | 35 +++++++++++++++- research/finding_identity/tests/test_batch.py | 42 +++++++++++++++++++ 4 files changed, 113 insertions(+), 4 deletions(-) diff --git a/research/finding_identity/README.md b/research/finding_identity/README.md index 5b8e0bb..d7896dc 100644 --- a/research/finding_identity/README.md +++ b/research/finding_identity/README.md @@ -432,6 +432,17 @@ repository). Failures do not stop the batch: each attempt is appended to `results/_logs/