Repository navigation
Tool hub: verify snyk-agent-scan, keep it route-only with a never-run test - #2379
Open
remigiusz-antczak wants to merge 5 commits into
Open
remigiusz-antczak wants to merge 5 commits into
remigiusz-antczak wants to merge 5 commits into
Conversation
… test Upstream (PyPI and GitHub, fetched 2026-11-15): Apache-2.0, 0.6.11, requires SNYK_TOKEN, sends component information to the Agent Scan API, no offline mode documented, and can start stdio MCP servers. A key and the network are required, so the registry row stays route-only. tool-hub.md now states the verified reason, standards-index.md logs the sources, and a new offline test asserts the tool is never invoked and emits no finding rows even with SNYK_TOKEN set and uvx on PATH. No-Mechanism-Reason: the new scripts/test-review-checks-hub-snyk-agent-scan.sh is the mechanism for the tool-hub.md wording change. size-budget-raise: .claude/skills/deep-code-review/references/tool-hub.md 59805→59884 snyk-agent-scan row states the verified key and network requirement Tests: 111/111 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
review_checks.sh already prints NOT CHECKED rows, a "skipped (not installed)" list and a "not run" ran/wired line for matching tools that are missing, and prints no clean verdict. Add the missing regression test: a diff touching .tf, .py and a Dockerfile with only a bandit stub on PATH must list checkov and hadolint in all three places. Tests: 5/5 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Add templates/semgrep-taint/defaults.yml with six rules: py debug-enabled, py cors-credentials-wildcard, py and js jwt-unverified (signature check off or alg none), py and js auth-fails-open (auth helper returns True / next() from its exception handler). Secret-env-fallback, TLS-verify-off and the JS CORS-with-credentials check already exist in py.yml and js.yml, so they are not repeated. scripts/test_semgrep_defaults.py runs seeded bad fixtures (17 annotated findings, recall 100%) and clean twins plus test-path copies (0 hits); it prints SKIP without semgrep, like the sibling semgrep tests. Registered in scripts/ci-tests.d, changelog.d entry added. Tests: 1/1 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
scripts/test_semgrep_defaults.py printed SKIP when semgrep was not on PATH, and CI never put it there for that script, so the new rules were never checked in CI. The real-hub job now runs the script with the hash-locked semgrep venv first on PATH, tees the output, and fails if SKIP appears. Tests: 1/1 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…rated row review_checks.sh now merges rows that several tools report on the same file and line into one row that names every tool (corroborated by: ...) and keeps the highest severity named in the message prefix, first row on a tie. Rows carry no category field, so the key is file:line. Different lines, a tool's own extra rules on a line, not-checked rows and summary rows never fold. Tests: 10/10 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Upstream (PyPI and GitHub, fetched 2026-11-15): Apache-2.0, 0.6.11, requires SNYK_TOKEN, sends
component information to the Agent Scan API, no offline mode documented, and can start stdio MCP
servers. A key and the network are required, so the registry row stays route-only. tool-hub.md now
states the verified reason, standards-index.md logs the sources, and a new offline test asserts the
tool is never invoked and emits no finding rows even with SNYK_TOKEN set and uvx on PATH.
No-Mechanism-Reason: the new scripts/test-review-checks-hub-snyk-agent-scan.sh is the mechanism for the tool-hub.md wording change.
size-budget-raise: .claude/skills/deep-code-review/references/tool-hub.md 59805→59884 snyk-agent-scan row states the verified key and network requirement
Tests: 111/111
🤖 Generated with Claude Code