marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-17 12:09:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(pre-push-safety-net): compare targeted base and head evidence

Browse Source
This commit is contained in:
Marius Ciepluch
2026-09-13 12:42:15 +02:00
parent 6ba2b06353
commit eb320730b6
11 changed files with 2077 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ops/README.md
+17
View File
@@ -197,3 +197,20 @@ unshipped test-path records. Runtime origin remains unspecified without declarat
readable Python graph and exercises the production taint, dominance and configuration
batch queries. Each must return the actual source filename in its census. This
checks query compilation and census transport, not security-property coverage.
## Targeted novelty comparison smoke
After rebuilding the image, run a declared JavaScript guard-removal comparison:
```bash
docker run --rm -i --network none --entrypoint python openultrasast:dev - --case guard < ops/smoke_delta.py
```
Use `--case movement` for unchanged JavaScript backlog shifted by comments, or
`--case connection` for a PHP input newly reaching an unchanged operation. Every
case verifies immutable base/head bytes, runs the existing driver and targeted
comparison under one 900-second lab budget, and checks that dirty checkout/index
state survives. Output contains an evidence JSON object followed by a completion
JSON object; success requires exit zero and `verified: true` in that final object.
These declared regions exercise comparison mechanics; full replay, normal alert
admission and hook latency are separate evaluation work.