Pular para conteúdo

AUR-556: analysis findings count toward the policy gate

Design

  • internal/config.GateConfig.Sources is the closed list (skills, analysis, sast); ValidateSources runs in Validate at load time and SourceEnabled answers which origins count (empty = all).
  • Precedence is the existing one for gate: the central policy's Gate replaces the repository's wholesale, so repository sources never apply under a policy.
  • cmd/aurumcode/gate_sources.go holds the adapter: foldGateSources, called once by runReview and runPRReview right after evaluateGate, folds the SAST decision (applySASTGate, unchanged, SAST issues withheld when sast is excluded) and applyAnalysisGate. evaluateGate skips skill rules when skills is excluded; its signature is unchanged.
  • Analysis findings come from a fresh analysis.Runner.Analyze(diff) plus config.ApplyRuleConfig, not from result.Issues, so a model reply can neither forge nor drop them. They honor AUR-520 exceptions.
  • Origin is named in the gate line (origem analysis), therefore in the parecer, stderr and the audit record's reason. It is also a typed field: each render.AuditFinding counted by the gate carries Origin (skills|analysis|sast, JSON origin, omitted when empty), set where the finding is counted. The SARIF writer derives each result's origin from BlockingFindings and writes it as properties.origin; the message has no origin suffix. gateDecision.FindingOrigins no longer exists.

Compatibility

No gate: no behavior change. Existing tests that declare a gate over a fixture containing a hardcoded secret now pin sources: [skills] to keep isolating the skill origin.

Corpus

tests/benchmark/out/multilang-report.* regenerated with -update-aur523: approved-with-defect total 3 -> 1 (java 1 -> 0, python 1 -> 0); the remaining one is the php case no rule detects; recall unchanged.

Limits

properties.origin and blocking_findings[].origin exist only for findings the gate counted; non-blocking findings carry no origin.