Repository navigation
feat(cli): scan fixes for 4.50, upload consent and skylos feedback - #1006
Merged
Merged
Conversation
- fix(cli): exit on what was analysed, not on every unparseable file - fix(sca): name unread dependency files, inherit monorepo config, run on merge queues - fix(dead-code): framework entry points, calibrated confidence, quieter defaults - fix(security): remove false CRITICALs and keep bare noqa off security findings - fix(mcp): charge Enterprise credits like every plan - feat(cli): add skylos feedback and GitHub issue forms - fix(cli): upload agent runs only with --upload and never send the OS user name - fix(cicd): edit one PR summary comment in place on every push - docs(privacy): list every network request the CLI makes - build(go): ship platform wheels with the Go engine Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
duriantaco
force-pushed
the
feat/scan-fixes-4.50
branch
from
October 15, 2026 00:14
b228889 to
4ec73af
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
# noqano longer hides security findings..execcalls count as command execution.skylos.tomlis supported.merge_group.agent scan/verify/cleanup/remediatesend a run summary only with--upload, and never send the OS user name.--no-uploadalways wins over--upload.docs/privacy-and-network.mdlists every request the CLI makes.cicd review: one summary comment per PR, edited in place on every push. Inline comments are not repeated, and--max-commentsis a cap per PR.skylos feedback: opens a prefilled form (or the GitHub issue form with--github). New GitHub issue forms are added.-trimpath -ldflags=-s -w).sk_live_/sk_test_prefixes are joined at runtime, so push protection doesn't read the binary as holding a key.Verification
-n 2): 20,561 passed, 44 skipped, 0 failed, on the multi-commit integration branch.test/test_secrets.py(371 passed),analyzer.goand the engine binary (275 Go-related Python tests andgo test ./internal/analyzerpassed).--upload, checked with a local capture server and a refusing proxy.--upload, each sends exactly 1POST /api/agent-runs.cicd review: checked against a fakeghover 5 pushes. One summary edited in place; new inline comments only for new findings.skylos .exits 2 on 0 of 8 (4 of 8 on 4.49.0).-astill exits 2 on 3 of 8 because of lockfile parsing; a follow-up PR fixes that, along with generic-entropy secret noise and more dead-code false positives.Note
Code is done with Claude Opus. Manually checked and verified by me
🤖 Generated with Claude Code