feat: add configurable scan artifacts#48
Conversation
8c49714 to
005be60
Compare
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8c49714798
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| ) | ||
| jsonl_sink.write(findings) | ||
| if output_is_default: | ||
| output = write_scan_artifact(path, fmt, cfg, "".join(f"{finding.to_jsonl()}\n" for finding in findings)) |
There was a problem hiding this comment.
Default JSONL scans now write through write_scan_artifact() under [wardline.artifacts].dir, but doctor still validates only root/findings.jsonl in _check_scan_output_path. In a repo where .wardline or a configured artifact dir is a symlink/blocked path, wardline doctor can report scan.output_path as ok even though this default scan exits 2; conversely it can flag a findings.jsonl directory that scans no longer use.
Useful? React with 👍 / 👎.
| ) | ||
| from wardline.core.safe_paths import safe_read_text_if_regular | ||
|
|
||
| DEFAULT_ARTIFACT_DIR = ".wardline" |
There was a problem hiding this comment.
Switching the default from findings.jsonl to .wardline/... means existing projects that already ignored the old default path will start getting untracked Wardline artifacts from a plain wardline scan unless install/doctor also adds [wardline.artifacts].dir to their ignore rules. This is especially visible for the generated pre-commit hook and for signed legis handoffs, where Wardline's own untracked artifacts make git status --porcelain dirty and can cause signing to be refused.
Useful? React with 👍 / 👎.
1 participant
Why
Default
wardline scanoutput previously wrote fixed filenames in the scan root, which made repeat scans overwrite each other and left artifact retention entirely manual. This adds a config-driven artifact directory with timestamped filenames and built-in retention while preserving exact explicit--outputbehavior.What Changed
[wardline.artifacts]config withdir = ".wardline"andretain = 20defaults..gitignore, changelog, and bumped Wardline to1.0.6.Verification
uv run pytest tests/unit/core/test_config.py tests/unit/cli/test_cli.py tests/unit/cli/test_agent_summary_cmd.py tests/unit/security/test_symlink_toctou_hardening.py -q-> 188 passeduv run pytest --cov=wardline --cov-report=term-missing --cov-fail-under=90-> 4200 passed, 18 deselected, coverage 92.32%uv run ruff check src tests-> passeduv run ruff format --check src tests-> passeduv run mypy-> passeduv run wardline scan . --fail-on ERROR-> passed, 0 activeuv build-> builtwardline-1.0.6sdist/wheeluv run --with twine twine check dist/*-> passed