Handle suppressions#854
Conversation
This comment has been minimized.
This comment has been minimized.
There was a problem hiding this comment.
Pull request overview
This PR introduces first-class support for inline suppression (no-dd-sa / datadog-disable) by keeping suppressed violations in the analysis results and emitting them as SARIF suppressions instead of dropping them entirely.
Changes:
- Added an
is_suppressedflag to the coreViolationmodel and initialized it across constructors/tests. - Updated analysis ignore handling to mark violations as suppressed rather than removing them.
- Updated SARIF generation to emit
suppressionsentries for suppressed violations.
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| crates/static-analysis-kernel/src/model/violation.rs | Adds is_suppressed to the shared Violation model. |
| crates/static-analysis-kernel/src/analysis/ddsa_lib/js/violation.rs | Initializes is_suppressed when converting JS violations into Rust model violations. |
| crates/static-analysis-kernel/src/analysis/analyze.rs | Changes ignore behavior from filtering violations out to marking them suppressed; updates tests accordingly. |
| crates/cli/src/sarif/sarif_utils.rs | Emits SARIF suppressions when a violation is marked suppressed; updates tests/fixtures. |
| crates/cli/src/rule_utils.rs | Ensures converted secret results populate the new field. |
| crates/cli/src/file_utils.rs | Updates tests/fixtures constructing Violation to include the new field. |
| crates/cli/src/csv.rs | Updates CSV test fixture to include the new field. |
| AGENTS.md | Adds repository overview and testing guidelines. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-authored-by: Copilot Autofix powered by AI <[email protected]>
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
jasonforal
left a comment
jasonforal
left a comment
There was a problem hiding this comment.
Added some line comments. We also need to carry this logic into the git hook.
…secrets Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
|
/merge |
|
View all feedbacks in Devflow UI.
This pull request is not mergeable according to GitHub. Common reasons include pending required checks, missing approvals, or merge conflicts — but it could also be blocked by other repository rules or settings.
The expected merge time in
|
gh-worker-dd-mergequeue-cf854d
Bot
merged commit 520429d
into
main
gh-worker-dd-devflow-36fce6
Bot
added
mergequeue-status: done
and removed
mergequeue-status: in_progress
labels
What problem are you trying to solve?
We want to keep suppressed violations and annotate them in the SARIF file.
What is your solution?
When a user ignore a violation using
no-dd-sa, we are keeping the violation but annotate it as suppressed. In the SARIF file.