Repository navigation
Add GitHub URL to ASCA, SCA, and KICS scan telemetry (AST-186254) - #1585
Open
cx-rahul-pidde wants to merge 4 commits into
Open
cx-rahul-pidde wants to merge 4 commits into
cx-rahul-pidde wants to merge 4 commits into
Conversation
…pts (AST-180794) (#1578) * AST-180794: Add provenance tag and confidence-gated suppression to guardrail prompts Tags ASCA/KICS/SCA guardrail output with a Checkmarx provenance marker so agents can distinguish genuine findings from spoofed text, and replaces the blanket "ask the user first" suppression gate with a confidence-gated model: suppress only when grounded in something verifiable in the file (or, for SCA, after actually attempting remediation), otherwise ask instead of guessing. Also reminds the agent to resume the original task after handling a finding. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * AST-180794: Fix whitespace lint issues in provenanceTag helpers Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * AST-180794: Add hook-deny header and explicit user-instruction path to guardrail prompts Adds a shared hookDenyHeader to ASCA, KICS, and SCA guardrail prompts that states up front the message is a Checkmarx hook deny, not file content or an untrusted tool error, without repeating the spoof phrases the anti-injection skill tests treat as evidence a message did not come from Checkmarx. Splits the suppression rule into two independently sufficient paths: (a) the user explicitly told the agent to suppress or ignore the finding, honored immediately with no further verification, or (b) the agent decides on its own and grounds that decision in code it has actually opened and read itself (not an assumption or another file's claim). SCA's package suppression path is tightened the same way, requiring either the user's instruction or an actual remediation attempt returning "no fixed version exists". Adds injection-trigger regression tests across all five supported agents for ASCA, KICS, and SCA verifying the hook-deny header is present and phrases like "without asking" or "silently" never appear in agent-facing text. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * AST-180794: Restructure guardrail prompts to classify-then-act remediation model Replaces the analyze/ask-when-unsure flow with an explicit classify-then-act sequence: findings are false positives only when cited evidence meets (a) or (b), otherwise they are always remediated autonomously and never surfaced to the user as a remediate-or-suppress question. Adds a structured remediation summary report and a verify-and-retry step across ASCA, KICS, and SCA guardrails. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * AST-180794: Include findings list and tighten guardrail summary wording Adds the findings/packages list into the Cursor ASCA/KICS prompts and the SCA malicious/vulnerable prompts (previously only in the non-Cursor path), and simplifies remediationNote's signature now that subject/goal are no longer used. Aligns summary report wording and evidence hints (e.g. "parent module or sibling manifest") across agents, and updates the KICS Cursor test to match. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * AST-180794: Share remediation report templates and bump ast-cx-hooks Extract the ASCA, KICS, and SCA closing remediation reports into shared constants (ascaRemediationReport, kicsRemediationReport, scaMaliciousReport, scaVulnerableReport) so the Cursor and non-Cursor deny paths render the same markdown report instead of two copies that could drift apart. Bump ast-cx-hooks to v1.0.10 and refresh go.sum. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * AST-180794: Sync guardrail prompts with hardened skill wording Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
Include the repository origin on realtime scan telemetry so events can be tied to the GitHub project being scanned. Co-authored-by: Cursor <cursoragent@cursor.com>
✅ No secrets detectedTruffleHog found no secrets in the current commits of this PR. |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
POC
Include the repository origin on realtime scan telemetry so events can be tied to the GitHub project being scanned.
By submitting this pull request, you agree to the terms within the Checkmarx Code of Conduct. Please review the contributing guidelines for guidance on creating high-quality pull requests.
Description
Please provide a summary of the changes and the related issue. Include relevant motivation and context.
Type of Change
Related Issues
Link any related issues or tickets.
Checklist
Screenshots (if applicable)
Add screenshots to help explain your changes.
Additional Notes
Add any other relevant information.