marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-16 03:49:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(scan): add initial SAST pipeline

Browse Source
This commit is contained in:
Marius Ciepluch
2026-06-17 21:13:51 +02:00
parent 43a41b5e78
commit e7df721d16
26 changed files with 2164 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.kiro/specs/openrouter-sast-harness/decisions.md
+29
View File
@@ -0,0 +1,29 @@
# Decisions: OpenRouter SAST Harness
## Approved Initial Slice
The first implementation slice is approved for Phase 0 and Phase 1 only:
- Python package skeleton with `ousast` CLI.
- Local configuration loading.
- Scan run directory creation under `.openultrasast/runs/<scan-id>/`.
- Repository snapshot collection.
- Source file enumeration with basic ignore handling.
- Language, LOC, and static tag heuristics.
- `preprocess/file_targets.json` artifact.
## Current Decisions
| Decision | Value | Scope |
| --- | --- | --- |
| Runtime | Python 3.11+ | Initial implementation |
| Harness dependency | Minimal HarnessX-compatible core first | Avoid direct dependency until contracts are proven |
| Vector store | Deferred to Phase 4 bakeoff | Not needed for Phase 0/1 |
| OpenRouter chat models | Deferred until ranker implementation | Not needed for Phase 0/1 |
| OpenRouter embedding model | Deferred until embeddings implementation | Not needed for Phase 0/1 |
| Fixtures | Synthetic fixture repositories first | Keeps tests deterministic |
| MCP | Defer until CLI and artifacts stabilize | Phase 12 |
## Rationale
The first milestone should prove the local artifact contract before adding model calls, embeddings, Docker, MCP, or fusion. Later decisions must be recorded here before their implementation phases begin.