CalvinBackup/shannon
1
0
Fork 0
mirror of https://github.com/KeygraphHQ/shannon.git synced 2026-08-14 23:40:21 +02:00
Code Issues Packages Projects Releases Wiki Activity

docs(worker): correct stale rationale on the SARIF analysis-mode gate

Browse Source 
The comment claimed analysis-only findings carry no severity. Since
v2.2.0 (#413) severity is recorded in both modes, so the technical
justification no longer holds. Record the actual remaining reason:
an analysis severity is assessed, not measured.

Comment only, no behavior change.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
george-keygraph
2026-08-13 15:38:20 -07:00
co-authored by Claude Opus 5
parent bcc8c3279c
commit 3f7d38de8f
1 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/worker/src/temporal/activities.ts
+5 -3
View File
@@ -452,9 +452,11 @@ export async function runAuthzExploitAgent(input: ActivityInput): Promise<AgentM
/**
* Write report.sarif when the run is exploitative and the operator asked for it.
*
* Skipped entirely for analysis-only runs: those findings carry no severity, so every
* `result.level` would be invented. Failures are logged and swallowed — the SARIF log is a
* secondary artifact and must not fail a run whose report is already written.
* Skipped entirely for analysis-only runs. The original reason was that those findings carried
* no severity, so every `result.level` would have been invented; since severity is recorded in
* both modes an analysis run could now populate `level`, but it would report an assessed
* severity as a measured one, so the gate stays. Failures are logged and swallowed — the SARIF
* log is a secondary artifact and must not fail a run whose report is already written.
*/
async function writeSarifIfEnabled(
input: ActivityInput,