fix: MCP Server, config validation and cli#339
Merged
Conversation
…y-without-glob patterns Add validation to both `ash config validate` and `ash config lint` that warns when an ignore_path or suppression path points to an existing directory but lacks a `**` glob suffix. Without `**`, the pattern silently fails to match any files inside the directory. Only warns when the path actually exists as a directory in the repo, avoiding false positives for virtual environments that haven't been initialized. Adds IGNORE_PATH_ISSUE lint category and comprehensive test coverage.
… silently dropped
Two related bugs fixed:
1. Nested .gitignore scope pollution: .gitignore files inside ignored
directories (e.g., .venv/.gitignore containing '*') were being collected
and their rules applied globally, causing the entire project to have 0
scannable files. Fixed by:
- Pruning ignored directories during os.walk (skips .venv/, etc.)
- Scoping rules in get_ash_ignorespec to their parent directory via
base_path instead of applying all rules at root level
2. --exclude key validation too strict: The _VALID_FLAG_KEY_PATTERN regex
rejected --key=value syntax used by bandit (--exclude="...") and
checkov (--skip-path="..."), silently dropping exclude paths. Fixed by
allowing optional =value suffix in the regex.
When --source-dir points to a different project and --output-dir is not specified, the output directory now defaults to source_dir/.ash/ash_output instead of CWD/.ash/ash_output. This ensures the correct config file is discovered and output is written to the expected location.
When using get_scan_results with actionable_only=true, the response now includes a flat findings list with severity, file path, and message for each actionable finding, instead of only returning scanner metadata without finding details.
Contributor
ASH Security Scan Report
Scan Metadata
SummaryScanner ResultsThe table below shows findings by scanner, with status based on severity thresholds and dependencies:
Report generated by Automated Security Helper (ASH) at 2026-05-12T12:58:34+00:00 |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
…data level
GitLab's CycloneDX parser resolves the report-level source exclusively
from metadata.properties. Per-component gitlab:dependency_scanning:*
properties alone are insufficient — the parser returns nil for the source
and fires 'Required GitLab CycloneDX properties are missing'.
Fix: derive the dominant ecosystem from component PURLs/syft types and
inject gitlab:dependency_scanning:{category,package_manager:name,
language:name,input_file:path} at the metadata.properties level in
addition to per-component enrichment.
Adds _resolve_dominant_type, _dominant_input_file helper methods and
_DEFAULT_LOCKFILES fallback mapping.
Replace bare 'except Exception: pass' with specific exception types (OSError, ValueError, TypeError, IndexError, re.error) that igittigitt can reasonably throw. Adds debug logging when the root .gitignore cannot be parsed. Resolves GHAS code scanning alert.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue #, if available:
N/A
Description of changes:
fix(config): Validate ignore_paths/suppression paths for directory-without-glob patterns
fix(scan): Resolve scan set returning 0 files and --exclude arg being silently dropped
fix(cli): Default output-dir relative to source-dir instead of CWD
fix(mcp): Return flat findings list when actionable_only is requested
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.