Add per-language bench fixtures and CI gate for all 16 languages - #20
Merged
Conversation
…16 languages Previously only 7 languages (Go, JS, Python, Java, PHP, Ruby, C) had bench fixtures. A PR breaking taint analysis for Kotlin or regex detection for Zig would pass CI silently. This adds: - 27 new bench fixtures (3 per language) for C++, Kotlin, Swift, Rust, C#, Perl, Lua, Groovy, and Zig covering injection, memory safety, traversal, and secrets patterns - TestLanguageCoverage_Minimum: hard CI gate requiring 2+ detections per language across all 16 supported languages - TestLayerAttribution_PerLanguage: hard CI gate verifying taint analysis fires for 8 languages with taint-triggering fixtures - Fix parseHeader() to handle Perl (#) and Lua (--) comment prefixes - Register all language-specific rule packages and AST analyzers in bench test imports for full detection coverage Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Pipeline fixes (P0-P2): - Swap suppress/dedup order so suppressed findings can't boost winners - Add fileIndex for O(1) NodesInFile lookups in call graph - Fix lockfile to error on active lock instead of silently overwriting - Add 500ms read timeout for cross-file caller loading - Scope reSQLConcatGo to Go/Java/JS/TS/C#/Kotlin (was LangAny) - Cache buildLineOffsets and comment ranges lazily on AST Tree - Binary search over comment ranges for O(log n) IsInComment - Add ConfidencePreset flag for taint/interproc pre-set scores - Broaden astflow param seeding for exported function entry points AST analyzer false-positive fixes: - JSAST-006: Only match SQL keywords inside string literals, not method names - PHPAST-002: Add sanitizer detection + lower confidence for concat args - PHPAST-003: Skip subscript expressions (allowlist) + lower confidence for variables - CS-AST-004: Lower confidence for Process.Start with single identifier args Detection coverage improvements: - Add WeakHashing rules for Kotlin, Groovy (MessageDigest), C# (MD5.Create) - Add general Perl SQL interpolation regex for variable-in-string patterns - Update bench fixture Expected headers to accept AST-level detections Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Change tagline from "Code guard for your AI agents" to "Generation-time SAST for Claude Code" in install.sh, CLAUDE.md - Fix quick test JSON: use semicolon instead of \n to avoid invalid JSON character error Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
TestLanguageCoverage_Minimum— hard CI gate requiring 2+ detections per language across all 16 supported languagesTestLayerAttribution_PerLanguage— hard CI gate verifying taint analysis fires for 8 languages with taint-triggering fixturesparseHeader()to handle Perl (#) and Lua (--) comment prefixesPreviously only 7/16 languages had bench fixtures. A PR breaking taint analysis for Kotlin or regex detection for Zig would pass CI silently. Now every language is covered.
Test plan
TestLanguageCoverage_Minimumpasses — all 16 languages detected at 2+ fixturesTestLayerAttribution_PerLanguagepasses — taint fires for 8 languages (cpp, csharp, go, java, javascript, kotlin, php, python)TestDetectionBenchdetection matrix shows all new languagesgo build ./...compiles clean🤖 Generated with Claude Code