fix(cli): Add hidden --entry-points flag to scan - #395
Merged
Merged
Conversation
Expose the analyzer's entry-point selector on `opentaint scan`, bound to the existing DebugRunAnalysisOnSelectedEntryPoints config field. The flag is hidden, since it is a debugging aid rather than part of the normal scan surface. Registered on scanCmd only, not in the shared addScanFlags, so it does not collide with the `test rule reachability` flag of the same name. The scan run prints the same Spring caveat reachability already does.
DavidBakerEffendi
added a commit
to BrokkAi/dataflowbench
that referenced
this pull request
Sep 4, 2026
…yzer/2026.09.03.9752bd2 The three remaining gapped rows of the 2026-09-03 survey, each bumped because no hold reason was on record. Every declaration moves; the pin-currency review entry records the bases, holds the vendored Semgrep rules snapshot, and records the OpenTaint CLI switch as owed: the hidden `--entry-points` flag (seqra/opentaint#395) is on main but not in any released CLI. Retained-evidence descriptions keep naming the build they were measured on. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
DavidBakerEffendi
added a commit
to BrokkAi/dataflowbench
that referenced
this pull request
Sep 4, 2026
…nt analyzer/2026.09.03 and re-run all 33 slices (#150) Follows #146 (rebased onto it after its merge). Takes the three remaining bump-or-hold decisions of the v0.7.0 freeze-prep against the 2026-09-03 survey: **Semgrep CE 1.175.0 → 1.176.0**, **Joern 4.0.614 → 4.0.617**, **OpenTaint `analyzer/2026.08.27.17eb0fe` → `analyzer/2026.09.03.9752bd2`**, each re-run across every slice at the unchanged fixture revision. With #146 every gapped pin in the survey is current. Refs #138 (closed by #146); refs #144. ## Commits, in freeze-prep order 1. **Re-pin** — declarations for all three move; the pin-currency review entry in `docs/adapters.md` records the witnessed bases (Semgrep `--version`; Joern console banner from the SHA-512-verified `v4.0.617` macOS distribution; OpenTaint jar `db3a6163…` and models `8746b959…`, matching the release API's digests and re-witnessed by the runner before every case). The vendored Semgrep rules snapshot is held per policy. The Semgrep modeling-matrix anchor moves with the heading in the rule comment and the three native provenance files, as the v0.6.0 review did. 2. **Evidence** — all 33 populations (Joern 6 kernels + 3 modeling + 3 native; Semgrep 11 + 3 + 3; OpenTaint 2 + 1 + 1), 1,278 results. 3. **Development-scope freeze** over the same 82 reports. After #149 landed, `main` was merged in and the manifest recut bound to `main`'s tip (`9dba9a72`), the commit this PR's squash commit will have as its parent — the shape #149 requires so the recorded revision survives the merge. The digests bind the regenerated evidence; `validate-freeze` and `generate-results --check` pass on the branch. 4. **Regenerated `results/`** — `generate-results --check` passes; no staleness caveat anywhere. ## OpenTaint: still driven through the jar, CLI switch recorded as owed The hidden `--entry-points` flag on `opentaint scan` merged in seqra/opentaint#395 on 2026-09-03 (closing #390), but it has not shipped: the CLI's latest release is v0.4.5 (2026-07-10) and the dated `analyzer/*` releases carry only the jar and models. A CLI built from `main` would have no release identity to witness, so the invocation is unchanged here and the review entry dates the switch as owed on the first CLI release that includes #395. ## Outcome deltas **None.** All 33 populations reproduce every committed outcome: | Adapter | Populations | Results | Moves | Kernel diagnostics | | --- | --- | --- | --- | --- | | Joern 4.0.617 | 12 | 486 | 0 | byte-identical | | Semgrep CE 1.176.0 | 17 | 678 | 0 | byte-identical | | OpenTaint 2026.09.03 | 4 | 152 | 0 | byte-identical | Kernel configuration hashes are all byte-identical to the superseded reports (the #141 guard confirming no query/rule/semantics file moved); the seven native hashes move with the witnessed identity by construction, plus the Semgrep JavaScript modeling hash and native provenance files via the anchor edit. The only textual change in retained evidence is in the tool-native decline rationales: the re-run embeds today's partition constants, so Joern's category-S cells now carry the A26 scan-bundle grounds and Semgrep's Java/JavaScript cells the A27-confirmed wording, where the v0.6.0-era reports carried the earlier text — the amendment convention's re-witness-never-patch rule. ## Machine cleanup (per request) Removed the superseded Joern 4.0.610/4.0.614 distributions, the 4.0.432 system install under `/opt/joern` and its `/usr/local/bin/joern` symlink, the 2026-08-27 OpenTaint assets, a stale pyre-check 0.9.25 venv, and the redundant Infer archive. `scripts/probe-joern-scan-native.sh` keeps naming `joern-v4.0.614` as the distribution A26 probed; that is a record, not a live path. ## Verification `cargo fmt --check` · `cargo test` (217 passed) · `cargo run -- validate` (852 cases) · `cargo run -- validate-reports` (82 reports, 66 hashes checked, 0 known-stale) · `validate-freeze reports/freeze.json` · `generate-results … --check` (current). 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Expose the analyzer's entry-point selector on
opentaint scan, bound to the existing DebugRunAnalysisOnSelectedEntryPoints config field. The flag is hidden, since it is a debugging aid rather than part of the normal scan surface.Registered on scanCmd only, not in the shared addScanFlags, so it does not collide with the
test rule reachabilityflag of the same name. The scan run prints the same Spring caveat reachability already does.