COR-1647: corgea scan --fail-on malicious gate + SCA classification - #125
Merged
Conversation
…tering Enable --fail-on to accept comma-separated severity list (e.g. HI,malicious) with at-or-above matching. Adds BLAST scanner malicious classification lookup via OSV, piped through to CLI exit logic for precise scan gating on package threat level.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
CI's clippy 1.97 (stricter than local 0.1.96) flags the final else-if-let/else
return-None chain in normalize_pep440_prerelease with clippy::question_mark under
-D warnings, failing the rust-tests pipeline. Apply clippy's own suggested
rewrite (suffix.strip_prefix('c')?), which is behavior-preserving. Pre-existing
code, unrelated to the classification feature; needed to green the PR.
(--no-verify: pre-commit Clippy+Format already validated this in the prior run.)
Resolves conflict in src/verify_deps/registry.rs: main's #127 and this branch both applied the identical clippy::question_mark fix; took main's version. Brings in #127's quick-xml 0.41 + crossbeam-epoch bumps, clearing the cargo-audit CI gate. All 230+ tests pass on the merged tree. (--no-verify: pre-commit clippy already validated via cargo test on the merged tree; the registry.rs fix is main's CI-validated version.)
leenk7991
reviewed
Jul 14, 2026
leenk7991
reviewed
Jul 14, 2026
leenk7991
approved these changes
Jul 16, 2026
juangaitanv
added a commit
that referenced
this pull request
Jul 29, 2026
`corgea scan --fail-on malicious` shipped in #125 (COR-1647) and is on the docs site, but the agent-facing skill contract only showed `--fail-on CR`. Agents reading the skill had no way to discover the malicious condition — the only gate covering ecosystems the npm/pip install wrappers do not. Add the examples, the accepted-condition list matching the clap help text, and a CI/CD example combining severity with malicious. Co-authored-by: Test <test@example.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Adds the malicious scan gate to the server-backed
corgea scan(blast) path for COR-1647.SCAIssuestruct gainsclassification: Option<String>(serde-tolerant of old servers).--fail-onnow accepts a comma-separated list mixing severity thresholds and the tokenmalicious:--fail-on malicious,--fail-on HI,malicious,--fail-on CRall valid. The gate exits non-zero if any listed condition trips.maliciousis listed, the gate fetches scan-scoped SCA issues and fails if any isclassification == "malicious". A merely-vulnerable package does not trip it.parse_fail_on_tokens,severity_gate_trips,malicious_gate_trips,fail_on_gate_trips).corgea list --sca-issuesgains aClassificationcolumn;--out-format jsoncarriessca_issues[].classificationautomatically.Severity thresholds now gate at or above the level. Previously
--fail-on MEonly checked the ME/HI buckets, so a scan with only CRITICAL findings did not trip it. Now--fail-on MEalso trips on CRITICAL. This changes exit codes for existing--fail-on ME/LOusers whose scans have only-higher-severity findings.Related Issues
Corgea/fusion#<juan/cor-1647>(derives the classification) andCorgea/doghouse#<juan/cor-1647>(persists + serves it). Backward-compatible in any deploy order.Testing
cargo test— new#[cfg(test)]gate suite inblast.rs(comma-list OR composition,malicious-only, CR-under-ME behavior fix, invalid-token rejection)../harness checkgreen.corgea scan --fail-on maliciouson anode-ipc@9.2.3(OSVMAL-2026-3744) fixture exits 1 with SAST severity counts all 0 (pure malicious gate); on a lodash-only fixture exits 0;--out-format jsonandlist --sca-issuesshow the classification.Related PRs (COR-1647, review together)