feat: preserve cross-scan finding relationships - #574
Conversation
|
Codex Review: Didn't find any major issues. You're on a roll. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review The description now includes the final QA results and merge order. Please review the current head, |
|
Codex Review: Didn't find any major issues. 🎉 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
@codex review Please review the current head, |
|
Codex Review: Didn't find any major issues. Already looking forward to the next diff. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review Please review the current head, |
|
Codex Review: Didn't find any major issues. Delightful! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Keep legacy repositories separate when preparing matching inputs, simplify finding alias bookkeeping, and retain the shared workbench stdin API. Use platform-aware Python probes and exercise comparison payloads larger than command-line limits.
|
@codex review Please review exact head |
|
Codex Review: Didn't find any major issues. Another round soon, please! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
mldangelo-oai
changed the title
|
Codex Review: Something went wrong. Try again later by commenting “@codex review”. ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Codex Review: Didn't find any major issues. Breezy! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review Please review current head |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d7bca7f46e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 49aeb31796
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review Please review exact head 2c87c8a, including transitive confirmed finding identities, mandatory stable-identity matches, independent component findings, previous and development custom-plugin compatibility, append-only history migration, and managed plugin upgrades. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2c87c8a476
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review Please review exact head 4a3ef77, including transitive confirmed finding identities and forced matching, mandatory stable-identity matches, independent component findings, explicitly advertised custom-plugin comparison capabilities, append-only history migration, and managed plugin upgrades. |
There was a problem hiding this comment.
💡 Codex Review
Return every transitive linked finding
For a confirmed chain A↔B↔C, this new recursive traversal correctly includes all three scans when computing knownScanIds, but the matches returned by the function still come from the preceding one-hop query, so finding_matches(A) contains only B. Consequently scans show --show-linked-findings, whose help promises findings linked across previous scans, omits C even though the same result advertises C as part of the finding's confirmed history. Project the recursive component into the returned linked findings as well as the endpoint metadata.
AGENTS.md reference: sdk/typescript/AGENTS.md:L16-L16
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review Please review exact head 710ab32, including canonical transitive confirmed finding identities across matcher entrypoints and forced matching, mandatory stable-identity matches, independent component findings, line-wrap-tolerant explicit custom-plugin comparison capabilities, append-only history migration, and managed plugin upgrades. |
|
Codex Review: Didn't find any major issues. Already looking forward to the next diff. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review Please review current head |
|
@codex review Please review current head |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6606adae86
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Approval follow-up on current head The blockers from my earlier review are addressed. The scan-history migration is now append-only at version 40, the changes are applied to the canonical plugin source with synchronized bundle metadata, the updated history fixtures cover the reconciled schema, and current-head CI plus the security review are green. I do not have any further code changes to request before approval. This PR is ready for approval once GitHub finishes recomputing its mergeability state. |
|
@codex review Please review current head |
|
Codex Review: Didn't find any major issues. 🎉 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
kmbroai
left a comment
kmbroai
left a comment
There was a problem hiding this comment.
Approved at 69a7ff409e1ed0ec4f4a512f18ce0bdbb0a09f82. The migration reconciliation, canonical plugin integration, linked-history follow-up, and exact-head CI/security review are complete.
|
@codex review Please review current head |
3 participants
Summary
Preserve confirmed finding identities across scan history while keeping uncertain and related findings separate. This remains the storage and compatibility base for #575.
Changes
Testing
Current main integration on
a3c110fa03ed162f68ab3a2b4c9b6646dc8bb9e5:Local full-suite and installed-package checks were not repeated after this merge because the validation host repeatedly exhausted disk space. Fresh CI is requested for the new head; its outcome is separate from human approval.
Risk and rollout
No new public commands, flags, or defaults. The schema update adds indexes and normalizes only the known preview migration record; existing findings and released migrations are preserved. Related findings remain separate from confirmed identities. Merge this base before #575.
Public disclosure review
Existing commit metadata and automated comments contain author contact metadata and account-specific links, so the second attestation remains unchecked. They are left intact. The new commits use GitHub noreply author and committer addresses; fixtures and examples are synthetic.