mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
The 4095 candidates are not an in-scan artifact: push/runner.py:345 discovers head_regions across the whole head tree, then runner.py:397 passes them wholesale to scan_repository with change_context threaded in but unused for scoping. The scan enumerates all regions x families (scan.py:167/364) and, with order_by_evidence=True, evidence-tiers every pair before analysis -> the ~236s from increment 0 -> deadline at query_seconds=0. Fix locus (increment 2): scope the analyzed region set to context.changed_paths + dataflow neighbourhood (regions.py:279 primitive exists; compare_targeted_base is precedent). Keep the CPG whole-repo so taint can trace into the change from unchanged code; only the question set is change-scoped. Co-Authored-By: Claude Opus 4.8 <[email protected]>