From 04d9703b68c6cfd78092f2c6122754c7740ccb24 Mon Sep 17 00:00:00 2001 From: team-humaki Date: Fri, 11 Sep 2026 22:49:21 -0700 Subject: [PATCH 1/2] chore: share one SeverityRank between scanner and cli Fixes #37. --- internal/cli/check.go | 4 ++-- internal/cli/scan.go | 18 ++---------------- internal/scanner/finding.go | 19 ++++++++++++++++++- internal/scanner/scanner.go | 17 +---------------- internal/scanner/scanner_test.go | 21 +++++++++++++++++++++ 5 files changed, 44 insertions(+), 35 deletions(-) diff --git a/internal/cli/check.go b/internal/cli/check.go index 5a40c41..fea796b 100644 --- a/internal/cli/check.go +++ b/internal/cli/check.go @@ -69,10 +69,10 @@ func runCheckCommand(args []string, stdout, stderr io.Writer, scannerInstance *s result.Version = Version if minSev != "" { - minRank := severityRank(minSev) + minRank := scanner.SeverityRank(minSev) filtered := make([]scanner.Finding, 0, len(result.Findings)) for _, f := range result.Findings { - if severityRank(f.EffectiveSeverity()) >= minRank { + if scanner.SeverityRank(f.EffectiveSeverity()) >= minRank { filtered = append(filtered, f) } } diff --git a/internal/cli/scan.go b/internal/cli/scan.go index ad370a6..bb6c6ab 100644 --- a/internal/cli/scan.go +++ b/internal/cli/scan.go @@ -37,20 +37,6 @@ func parseSeverity(s string) (scanner.Severity, bool) { } } -func severityRank(sev scanner.Severity) int { - switch sev { - case scanner.SeverityInfo: - return 0 - case scanner.SeverityWarning: - return 1 - case scanner.SeverityHigh: - return 2 - case scanner.SeverityCritical: - return 3 - default: - return 0 - } -} func runScanCommand(args []string, stdout, stderr io.Writer, scannerInstance *scanner.Scanner) int { fs := flag.NewFlagSet("scan", flag.ContinueOnError) @@ -112,10 +98,10 @@ func runScanCommand(args []string, stdout, stderr io.Writer, scannerInstance *sc // Filter by minimum severity if specified if minSev != "" { - minRank := severityRank(minSev) + minRank := scanner.SeverityRank(minSev) filtered := make([]scanner.Finding, 0, len(result.Findings)) for _, f := range result.Findings { - if severityRank(f.EffectiveSeverity()) >= minRank { + if scanner.SeverityRank(f.EffectiveSeverity()) >= minRank { filtered = append(filtered, f) } } diff --git a/internal/scanner/finding.go b/internal/scanner/finding.go index 2493861..eba50d8 100644 --- a/internal/scanner/finding.go +++ b/internal/scanner/finding.go @@ -20,6 +20,23 @@ const ( SeverityInfo Severity = "info" ) +// SeverityRank orders severities from least (0) to most (3) severe. +// Shared by the scanner and CLI so ranking cannot diverge. +func SeverityRank(sev Severity) int { + switch sev { + case SeverityInfo: + return 0 + case SeverityWarning: + return 1 + case SeverityHigh: + return 2 + case SeverityCritical: + return 3 + default: + return 0 + } +} + // SecretMatch represents a single detected secret instance within a Finding's file. // Its Severity is independent of the parent Finding's severity. type SecretMatch struct { @@ -68,7 +85,7 @@ type Result struct { func (f Finding) EffectiveSeverity() Severity { max := f.Severity for _, m := range f.SecretMatches { - if severityRank(m.Severity) > severityRank(max) { + if SeverityRank(m.Severity) > SeverityRank(max) { max = m.Severity } } diff --git a/internal/scanner/scanner.go b/internal/scanner/scanner.go index 5b24555..673c955 100644 --- a/internal/scanner/scanner.go +++ b/internal/scanner/scanner.go @@ -250,21 +250,6 @@ func (s *Scanner) matchSeverityOverride(relPath string) (Severity, bool) { return "", false } -// severityRank orders severities from least (0) to most (3) severe. -func severityRank(sev Severity) int { - switch sev { - case SeverityInfo: - return 0 - case SeverityWarning: - return 1 - case SeverityHigh: - return 2 - case SeverityCritical: - return 3 - default: - return 0 - } -} // scanSecrets inspects relPath's content for embedded secrets and returns the // resulting SecretMatches, with severity floored by git status and capped by @@ -290,7 +275,7 @@ func (s *Scanner) scanSecrets(absDir, relPath string, status git.FileStatus) ([] floor = SeverityCritical } - if override, ok := s.matchSeverityOverride(relPath); ok && severityRank(override) < severityRank(floor) { + if override, ok := s.matchSeverityOverride(relPath); ok && SeverityRank(override) < SeverityRank(floor) { floor = override } diff --git a/internal/scanner/scanner_test.go b/internal/scanner/scanner_test.go index 56b0daa..20f9d1d 100644 --- a/internal/scanner/scanner_test.go +++ b/internal/scanner/scanner_test.go @@ -814,3 +814,24 @@ func TestScannerWithConfig(t *testing.T) { t.Errorf("expected .env.test to be overridden to Critical, got %+v", f) } } + +func TestSeverityRank(t *testing.T) { + cases := []struct { + sev Severity + rank int + }{ + {SeverityInfo, 0}, + {SeverityWarning, 1}, + {SeverityHigh, 2}, + {SeverityCritical, 3}, + {Severity("unknown"), 0}, + } + for _, tc := range cases { + if got := SeverityRank(tc.sev); got != tc.rank { + t.Errorf("SeverityRank(%q) = %d, want %d", tc.sev, got, tc.rank) + } + } + if SeverityRank(SeverityCritical) <= SeverityRank(SeverityHigh) { + t.Fatal("critical should rank above high") + } +} From 28a8d83b81e62c644480594ec154fb98f7665729 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jo=C3=A3o=20Vitor=20R=2E=20da=20Silva?= Date: Sat, 12 Sep 2026 20:21:37 -0300 Subject: [PATCH 2/2] style: gofmt after severityRank consolidation Removes stray double blank lines left in scan.go and scanner.go after deleting the duplicate severityRank functions, which failed CI's gofmt check. --- internal/cli/scan.go | 1 - internal/scanner/scanner.go | 1 - 2 files changed, 2 deletions(-) diff --git a/internal/cli/scan.go b/internal/cli/scan.go index bb6c6ab..f75f8ac 100644 --- a/internal/cli/scan.go +++ b/internal/cli/scan.go @@ -37,7 +37,6 @@ func parseSeverity(s string) (scanner.Severity, bool) { } } - func runScanCommand(args []string, stdout, stderr io.Writer, scannerInstance *scanner.Scanner) int { fs := flag.NewFlagSet("scan", flag.ContinueOnError) fs.SetOutput(stderr) diff --git a/internal/scanner/scanner.go b/internal/scanner/scanner.go index 673c955..948d61d 100644 --- a/internal/scanner/scanner.go +++ b/internal/scanner/scanner.go @@ -250,7 +250,6 @@ func (s *Scanner) matchSeverityOverride(relPath string) (Severity, bool) { return "", false } - // scanSecrets inspects relPath's content for embedded secrets and returns the // resulting SecretMatches, with severity floored by git status and capped by // any configured Severity Override for the file.