fix(cli): send the CI gate the filters the findings endpoints implement

The gate sent `severity=critical` lower-case and `status=open` to all
seven scanner endpoints. /cspm/findings binds severity straight into
`severity_label = $N::severity_level` and the Postgres severity_level
enum labels are upper-case, so every CSPM request 500'd and the
pre-existing `apiErrors > 0` branch returned ExitNetworkError before the
gate could reach a verdict. `status` is implemented by no endpoint, so
resolved, fixed, false-positive and allowlisted findings were counted.

Build the query per endpoint from a capability table: upper-case
severity, send it only to /sast/findings and /cspm/findings, and send
isResolved=false where the endpoint implements it. Endpoints with no
server-side severity filter are queried once instead of once per
severity, and say so in their FAIL line rather than implying the
threshold was applied. `nullify status` drops its finding count, which
limit=1 capped at 1.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: tim-thacker-nullify

cmd/cli/cmd/ci.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"fmt"
 	"os"
+	"strings"
 	"sync"
 	"sync/atomic"
 
@@ -88,19 +89,15 @@ Exit codes:
 		g, gctx := errgroup.WithContext(ctx)
 
 		for _, ep := range endpoints {
-			for _, sev := range severities {
+			for _, sev := range scannerSeverities(ep, severities) {
 				ep, sev := ep, sev
 				g.Go(func() error {
-					params := []string{"severity", sev, "status", "open", "limit", "1"}
-					if repo != "" {
-						params = append(params, "repository", repo)
-					}
-					qs := lib.BuildQueryString(queryParams, params...)
+					qs := lib.BuildQueryString(queryParams, scannerQueryParams(ep, sev, repo, "1")...)
 
 					body, err := lib.DoGet(gctx, nullifyClient.HttpClient, nullifyClient.BaseURL, ep.path+qs)
 					if err != nil {
 						mu.Lock()
-						fmt.Fprintf(os.Stderr, "Warning: failed to query %s (%s): %v\n", ep.name, sev, err)
+						fmt.Fprintf(os.Stderr, "Warning: failed to query %s: %v\n", scannerLabel(ep, sev), err)
 						mu.Unlock()
 						atomic.AddInt64(&apiErrors, 1)
 						return nil
@@ -109,7 +106,7 @@ Exit codes:
 					count, err := countFindings(body)
 					if err != nil {
 						mu.Lock()
-						fmt.Fprintf(os.Stderr, "Error: unreadable response from %s (%s): %v\n", ep.name, sev, err)
+						fmt.Fprintf(os.Stderr, "Error: unreadable response from %s: %v\n", scannerLabel(ep, sev), err)
 						mu.Unlock()
 						atomic.AddInt64(&unreadable, 1)
 						return nil
@@ -118,7 +115,7 @@ Exit codes:
 					if count > 0 {
 						atomic.AddInt64(&findingsFound, 1)
 						mu.Lock()
-						fmt.Printf("FAIL: %s has open %s findings\n", ep.name, sev)
+						fmt.Println(gateFailLine(ep, sev))
 						mu.Unlock()
 					}
 					return nil
@@ -200,25 +197,21 @@ format emits a SARIF v2.1.0 document for upload to code-scanning tools.`,
 			for j, sev := range severities {
 				i, j, ep, sev := i, j, ep, sev
 				g.Go(func() error {
-					params := []string{"severity", sev, "status", "open", "limit", "1000"}
-					if repo != "" {
-						params = append(params, "repository", repo)
-					}
-					qs := lib.BuildQueryString(queryParams, params...)
+					qs := lib.BuildQueryString(queryParams, scannerQueryParams(ep, sev, repo, "1000")...)
 
 					body, err := lib.DoGet(gctx, nullifyClient.HttpClient, nullifyClient.BaseURL, ep.path+qs)
 					if err != nil {
 						atomic.AddInt64(&apiErrors, 1)
 						mu.Lock()
-						fmt.Fprintf(os.Stderr, "Warning: failed to query %s (%s): %v\n", ep.name, sev, err)
+						fmt.Fprintf(os.Stderr, "Warning: failed to query %s: %v\n", scannerLabel(ep, sev), err)
 						mu.Unlock()
 						return nil
 					}
 					count, err := countFindings(body)
 					if err != nil {
 						atomic.AddInt64(&apiErrors, 1)
 						mu.Lock()
-						fmt.Fprintf(os.Stderr, "Warning: unreadable response from %s (%s): %v\n", ep.name, sev, err)
+						fmt.Fprintf(os.Stderr, "Warning: unreadable response from %s: %v\n", scannerLabel(ep, sev), err)
 						mu.Unlock()
 						return nil
 					}
@@ -298,6 +291,58 @@ func severitiesAboveThreshold(threshold string) []string {
 	return []string{"critical", "high"}
 }
 
+// scannerSeverities returns the severity values to query an endpoint with. An
+// endpoint with no server-side severity filter is queried once with an empty
+// severity: fanning out over the threshold list there would issue identical
+// requests and attribute the same findings to every severity.
+func scannerSeverities(ep scannerEndpoint, severities []string) []string {
+	if !ep.supportsSeverity {
+		return []string{""}
+	}
+	return severities
+}
+
+// scannerQueryParams builds the query string arguments for a findings request,
+// sending only the filters the endpoint implements.
+//
+// Severity is upper-cased because /cspm/findings binds it straight into
+// "severity_label = $N::severity_level" and the Postgres severity_level enum
+// labels are upper-case, so a lower-case value is a 500 rather than a filter.
+// /sast/findings case-folds via database.StringToNullSeverityLevel and accepts
+// either.
+func scannerQueryParams(ep scannerEndpoint, severity, repo, limit string) []string {
+	params := []string{"limit", limit}
+	if ep.supportsSeverity && severity != "" {
+		params = append(params, "severity", strings.ToUpper(severity))
+	}
+	if ep.supportsIsResolved {
+		params = append(params, "isResolved", "false")
+	}
+	if repo != "" {
+		params = append(params, "repository", repo)
+	}
+	return params
+}
+
+// scannerLabel names a scanner/severity pair in diagnostic output. A scanner
+// queried without a severity filter is named alone.
+func scannerLabel(ep scannerEndpoint, severity string) string {
+	if severity == "" {
+		return ep.name
+	}
+	return fmt.Sprintf("%s (%s)", ep.name, severity)
+}
+
+// gateFailLine reports a scanner that returned findings. Scanners with no
+// server-side severity filter say so rather than implying the threshold was
+// applied to their result.
+func gateFailLine(ep scannerEndpoint, severity string) string {
+	if severity == "" {
+		return fmt.Sprintf("FAIL: %s has open findings (no server-side severity filter, threshold not applied)", ep.name)
+	}
+	return fmt.Sprintf("FAIL: %s has open %s findings", ep.name, severity)
+}
+
 // errUnreadableFindings reports a findings response that does not carry the
 // scanner envelope. It is never reported as a count of zero: a gate that cannot
 // read the response must block the build rather than declare the repo clean.

cmd/cli/cmd/ci_test.go

@@ -26,6 +26,83 @@ func TestSeveritiesAboveThreshold(t *testing.T) {
 	}
 }
 
+// TestScannerQueryParamsMatchEndpointFilters pins the gate's query parameters to
+// the filters each endpoint actually implements. Severity must go out
+// upper-case: /cspm/findings casts it into the Postgres severity_level enum,
+// whose labels are upper-case, so "critical" is a 500 and not a filter.
+func TestScannerQueryParamsMatchEndpointFilters(t *testing.T) {
+	byName := map[string]scannerEndpoint{}
+	for _, ep := range allScannerEndpoints() {
+		byName[ep.name] = ep
+	}
+
+	tests := []struct {
+		scanner  string
+		expected []string
+	}{
+		{
+			scanner:  "sast",
+			expected: []string{"limit", "1", "severity", "CRITICAL", "isResolved", "false", "repository", "org/repo"},
+		},
+		{
+			scanner:  "cspm",
+			expected: []string{"limit", "1", "severity", "CRITICAL", "repository", "org/repo"},
+		},
+		{
+			scanner:  "sca_dependencies",
+			expected: []string{"limit", "1", "isResolved", "false", "repository", "org/repo"},
+		},
+		{
+			scanner:  "sca_containers",
+			expected: []string{"limit", "1", "isResolved", "false", "repository", "org/repo"},
+		},
+		{
+			scanner:  "secrets",
+			expected: []string{"limit", "1", "isResolved", "false", "repository", "org/repo"},
+		},
+		{
+			scanner:  "pentest",
+			expected: []string{"limit", "1", "isResolved", "false", "repository", "org/repo"},
+		},
+		{
+			scanner:  "bughunt",
+			expected: []string{"limit", "1", "repository", "org/repo"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.scanner, func(t *testing.T) {
+			ep, ok := byName[tt.scanner]
+			require.True(t, ok)
+
+			severities := scannerSeverities(ep, []string{"critical", "high"})
+			params := scannerQueryParams(ep, severities[0], "org/repo", "1")
+			require.Equal(t, tt.expected, params)
+			require.NotContains(t, params, "status")
+		})
+	}
+}
+
+func TestScannerSeveritiesCollapseWithoutServerSideFilter(t *testing.T) {
+	byName := map[string]scannerEndpoint{}
+	for _, ep := range allScannerEndpoints() {
+		byName[ep.name] = ep
+	}
+
+	threshold := []string{"critical", "high"}
+
+	require.Equal(t, threshold, scannerSeverities(byName["sast"], threshold))
+	require.Equal(t, threshold, scannerSeverities(byName["cspm"], threshold))
+	require.Equal(t, []string{""}, scannerSeverities(byName["secrets"], threshold))
+	require.Equal(t, []string{""}, scannerSeverities(byName["bughunt"], threshold))
+
+	require.Equal(t,
+		"FAIL: secrets has open findings (no server-side severity filter, threshold not applied)",
+		gateFailLine(byName["secrets"], ""),
+	)
+	require.Equal(t, "FAIL: sast has open critical findings", gateFailLine(byName["sast"], "critical"))
+}
+
 func TestCountFindings(t *testing.T) {
 	tests := []struct {
 		name     string

cmd/cli/cmd/scanners.go

@@ -12,22 +12,31 @@ var findingTypeToAPI = map[string]string{
 	"cspm":             "Cloud",
 }
 
-// scannerEndpoint represents a scanner type and its API path.
+// scannerEndpoint represents a scanner type, its API path, and the server-side
+// filters that endpoint implements. An unimplemented query parameter is dropped
+// without error, so a gate that sends one reports a filter it never applied.
 type scannerEndpoint struct {
-	name string
-	path string
+	name               string
+	path               string
+	supportsSeverity   bool
+	supportsIsResolved bool
 }
 
 // allScannerEndpoints returns the canonical list of all scanner endpoints.
+//
+// Only /sast/findings and /cspm/findings implement a severity filter. Every
+// endpoint except /cspm/findings and /dast/bughunt/findings implements
+// isResolved: /cspm/findings declares a status parameter its handler never
+// copies into CSPMFindingFilters, and /dast/bughunt/findings takes no filters.
 func allScannerEndpoints() []scannerEndpoint {
 	return []scannerEndpoint{
-		{"sast", "/sast/findings"},
-		{"sca_dependencies", "/sca/dependencies/findings"},
-		{"sca_containers", "/sca/containers/findings"},
-		{"secrets", "/secrets/findings"},
-		{"pentest", "/dast/pentest/findings"},
-		{"bughunt", "/dast/bughunt/findings"},
-		{"cspm", "/cspm/findings"},
+		{name: "sast", path: "/sast/findings", supportsSeverity: true, supportsIsResolved: true},
+		{name: "sca_dependencies", path: "/sca/dependencies/findings", supportsIsResolved: true},
+		{name: "sca_containers", path: "/sca/containers/findings", supportsIsResolved: true},
+		{name: "secrets", path: "/secrets/findings", supportsIsResolved: true},
+		{name: "pentest", path: "/dast/pentest/findings", supportsIsResolved: true},
+		{name: "bughunt", path: "/dast/bughunt/findings"},
+		{name: "cspm", path: "/cspm/findings", supportsSeverity: true},
 	}
 }
 

cmd/cli/cmd/status.go

@@ -111,16 +111,19 @@ func init() {
 	rootCmd.AddCommand(securityStatusCmd)
 }
 
-// summarizeFindingsResponse extracts a human-readable summary from a findings API response.
+// summarizeFindingsResponse extracts a human-readable summary from a findings
+// API response. The count is not reported: status requests limit=1, so
+// countFindings is capped at 1 and any number printed here would understate a
+// tenant's real backlog by orders of magnitude.
 func summarizeFindingsResponse(body string) string {
 	count, err := countFindings(body)
 	if err != nil {
 		return "unreadable response"
 	}
-	if count == 1 {
-		return "1 finding returned"
+	if count > 0 {
+		return "findings present"
 	}
-	return fmt.Sprintf("%d findings returned", count)
+	return "no findings"
 }
 
 type securityStatusOutput struct {

cmd/cli/cmd/status_test.go

@@ -16,22 +16,22 @@ func TestSummarizeFindingsResponse(t *testing.T) {
 		{
 			name:     "scanner envelope with findings",
 			body:     `{"findings":[{"id":"f1"},{"id":"f2"}],"numItems":2,"nextToken":""}`,
-			expected: "2 findings returned",
+			expected: "findings present",
 		},
 		{
 			name:     "scanner envelope with one finding",
 			body:     `{"findings":[{"id":"f1"}],"numItems":1,"nextToken":""}`,
-			expected: "1 finding returned",
+			expected: "findings present",
 		},
 		{
 			name:     "bughunt envelope omits numItems",
 			body:     `{"findings":[{"id":"f1"},{"id":"f2"},{"id":"f3"}]}`,
-			expected: "3 findings returned",
+			expected: "findings present",
 		},
 		{
 			name:     "empty scanner envelope",
 			body:     `{"findings":[],"numItems":0,"nextToken":""}`,
-			expected: "0 findings returned",
+			expected: "no findings",
 		},
 		{
 			name:     "empty object",