feat(sast): test-suite detection with config-file and dependency corroboration

Detect findings located in the project's test suite via an exhaustive path table
corroborated by test-runner config files and declared test dependencies; emit the
attribution as SARIF result properties and typed wire fields, upload detected
config files as env metadata, and add --suppress-test-code.

Author: 0x73746F66

cmd/sarif_persist.go

@@ -52,7 +52,7 @@ var sarifKinds = []sarifScanKind{
 // to its matching /v2/cli.<kind> endpoint. When baseSnapshotUuid is set, the
 // first SARIF request attaches to that existing SCA snapshot; otherwise the
 // SARIF endpoint creates its own snapshot as before.
-func postScanSARIF(report *sast.SASTReport, enabledKinds map[string]bool, gitCtx *gitctx.GitContext, rootPath string, snippetContext int, baseSnapshotUuid string, suppressions []vdb.CliSuppressionMint, w io.Writer) ([]snapshotLink, map[string]string, []vdb.CliSuppressionResult) {
+func postScanSARIF(report *sast.SASTReport, enabledKinds map[string]bool, gitCtx *gitctx.GitContext, rootPath string, snippetContext int, baseSnapshotUuid string, suppressions []vdb.CliSuppressionMint, testConfigs []vdb.CliTestConfigMetadata, w io.Writer) ([]snapshotLink, map[string]string, []vdb.CliSuppressionResult) {
 	if report == nil {
 		return nil, nil, nil
 	}
@@ -88,7 +88,14 @@ func postScanSARIF(report *sast.SASTReport, enabledKinds map[string]bool, gitCtx
 			thisSupp = pendingSupp
 			sentSupp = true // attempted on this kind; never resend (avoid dup upsert)
 		}
-		link, snapshotUuid, results, ok := submitSARIFKind(client, env, sk, bucket, memRecords, rootPath, snippetContext, baseSnapshotUuid, thisSupp, w)
+		// Detected test-runner config files describe the SAST test surface, so
+		// they ride the SAST submission's env only (each kind gets its own
+		// snapshot; attaching everywhere would duplicate the rows).
+		kindEnv := env
+		if sk.kind == "sast" {
+			kindEnv.TestConfigs = testConfigs
+		}
+		link, snapshotUuid, results, ok := submitSARIFKind(client, kindEnv, sk, bucket, memRecords, rootPath, snippetContext, baseSnapshotUuid, thisSupp, w)
 		if len(thisSupp) > 0 && len(results) > 0 {
 			suppResults = results
 		}
@@ -243,6 +250,12 @@ func buildAPISARIFFinding(f sast.Finding, memRecords map[string]memory.FindingRe
 		MemoryVexStatus:        mem.Status,
 		MemoryVexJustification: mem.Justification,
 		MemoryVexAction:        mem.ActionResponse,
+		IsTestSuite:            f.IsTestSuite,
+		TestFramework:          f.TestFramework,
+		TestLanguage:           f.TestLanguage,
+		TestConfidence:         f.TestConfidence,
+		TestMatchedPattern:     f.TestMatchedPattern,
+		TestEvidence:           f.TestEvidence,
 	}
 }
 

cmd/scan.go

@@ -21,6 +21,7 @@ import (
 	"github.com/vulnetix/cli/v3/internal/memory"
 	"github.com/vulnetix/cli/v3/internal/sast"
 	"github.com/vulnetix/cli/v3/internal/scan"
+	"github.com/vulnetix/cli/v3/internal/testsuite"
 	"github.com/vulnetix/cli/v3/internal/triage"
 	"github.com/vulnetix/cli/v3/internal/tui"
 	"github.com/vulnetix/cli/v3/internal/update"
@@ -379,6 +380,7 @@ func runScanWithFeatures(ctx context.Context, cmd *cobra.Command, noSAST, noSCA,
 	if cmd.Flags().Changed("snippet-context") {
 		snippetContext, _ = cmd.Flags().GetInt("snippet-context")
 	}
+	suppressTestCode, _ = cmd.Flags().GetBool("suppress-test-code")
 	excludes, _ := cmd.Flags().GetStringArray("exclude")
 	ignoreGlobs, _ := cmd.Flags().GetStringArray("ignore")
 	ignoreGit, _ := cmd.Flags().GetBool("ignore-git")
@@ -1508,6 +1510,31 @@ func runLocalScan(
 						fmt.Sprintf("%d finding(s) suppressed by ignore rules", n))
 				}
 			}
+
+			// Test-suite attribution: mark findings that live in the project's
+			// test code, corroborated by test-runner config files and declared
+			// test-framework dependencies found in the repo. The resulting
+			// metadata rides the SARIF (result properties) + typed wire findings,
+			// and the detected config files ride the SAST env. Run before SARIF
+			// build so both on-disk and uploaded artefacts carry it.
+			var testSuppressionMints []vdb.CliSuppressionMint
+			testActive := testsuite.Scan(rootPath)
+			testMarked := testsuite.Annotate(sastReport.Findings, testActive)
+			testConfigMeta := testConfigsToWire(testActive.Configs)
+			if testMarked > 0 {
+				sastReport.Degradations = append(sastReport.Degradations,
+					fmt.Sprintf("%d finding(s) attributed to test suites", testMarked))
+			}
+			// Optionally suppress test-code SAST findings when the user opts in.
+			if suppressTestCode && testMarked > 0 {
+				if kept, mints := suppressTestFindings(sastReport.Findings, gitCtx); len(mints) > 0 {
+					sastReport.Findings = kept
+					testSuppressionMints = mints
+					sastReport.Degradations = append(sastReport.Degradations,
+						fmt.Sprintf("%d test-code finding(s) suppressed (--suppress-test-code)", len(mints)))
+				}
+			}
+
 			rec.SASTRulesLoaded = sastReport.RulesLoaded
 			rec.SASTFindingCount = len(sastReport.Findings)
 
@@ -1662,6 +1689,8 @@ func runLocalScan(
 			if !disableMemory {
 				suppressionMints = reconcileScanSuppressions(mem, gitCtx, nosecHits, rootPath, time.Now().Unix())
 			}
+			// Test-code suppressions (--suppress-test-code) ride the same mint list.
+			suppressionMints = append(suppressionMints, testSuppressionMints...)
 			if !isUnauthenticatedScan() {
 				// Which SARIF-family scanners actually ran — an enabled one that
 				// found nothing still submits so the backend records coverage.
@@ -1672,7 +1701,7 @@ func runLocalScan(
 					"oci":     !noContainers,
 				}
 				var suppResults []vdb.CliSuppressionResult
-				sarifSnapshots, sarifSnapshotUuids, suppResults = postScanSARIF(sastReport, enabledKinds, gitCtx, rootPath, snippetContext, scaSnapshotUuid, suppressionMints, progressStderr)
+				sarifSnapshots, sarifSnapshotUuids, suppResults = postScanSARIF(sastReport, enabledKinds, gitCtx, rootPath, snippetContext, scaSnapshotUuid, suppressionMints, testConfigMeta, progressStderr)
 				applyMintedSuppressionUUIDs(mem, suppResults)
 			}
 		}
@@ -4408,8 +4437,14 @@ func addSASTFlags(cmd *cobra.Command) {
 		"Override default registry (https://github.com) for all --rule repos")
 	cmd.Flags().String("rule-id", "",
 		"Run only the single SAST rule with this ID (e.g. VNX-GQL-004); skips SCA and license checks")
+	cmd.Flags().Bool("suppress-test-code", false,
+		"Suppress SAST findings located in the project's test suite (test files corroborated by test-runner config/dependencies)")
 }
 
+// suppressTestCode is set from the --suppress-test-code flag in
+// runScanWithFeatures and read by runLocalScan.
+var suppressTestCode bool
+
 // filterFilesByFeature removes detected files excluded by the active feature flags.
 // noSCA removes ordinary package manifests; noContainers removes docker/OCI
 // manifests; noIAC removes HCL and Nix manifests.

cmd/testsuite_scan.go

@@ -0,0 +1,69 @@
+package cmd
+
+import (
+	"github.com/vulnetix/cli/v3/internal/gitctx"
+	"github.com/vulnetix/cli/v3/internal/sast"
+	"github.com/vulnetix/cli/v3/internal/testsuite"
+	"github.com/vulnetix/cli/v3/pkg/vdb"
+)
+
+// testConfigsToWire converts detected test-runner config files into the typed
+// env metadata carried on the SAST submission (metadata only, no raw body).
+func testConfigsToWire(configs []testsuite.Config) []vdb.CliTestConfigMetadata {
+	if len(configs) == 0 {
+		return nil
+	}
+	out := make([]vdb.CliTestConfigMetadata, 0, len(configs))
+	for _, c := range configs {
+		out = append(out, vdb.CliTestConfigMetadata{
+			Path:        c.Path,
+			Framework:   c.Framework,
+			Language:    c.Language,
+			ContentType: c.ContentType,
+			SHA256:      c.SHA256,
+			Size:        c.Size,
+		})
+	}
+	return out
+}
+
+// suppressTestFindings removes findings attributed to the test suite from the
+// report and returns a CliSuppressionMint per removed finding, so the backend
+// records them as suppressed (analogous to nosec-driven suppressions) rather
+// than as active findings. Only used when --suppress-test-code is set.
+func suppressTestFindings(findings []sast.Finding, gitCtx *gitctx.GitContext) ([]sast.Finding, []vdb.CliSuppressionMint) {
+	branch := ""
+	if gitCtx != nil {
+		branch = gitCtx.CurrentBranch
+	}
+	kept := make([]sast.Finding, 0, len(findings))
+	var mints []vdb.CliSuppressionMint
+	for _, f := range findings {
+		if !f.IsTestSuite {
+			kept = append(kept, f)
+			continue
+		}
+		category := "sast"
+		if f.Metadata != nil && f.Metadata.Kind != "" {
+			category = f.Metadata.Kind
+		}
+		reason := "Located in test suite"
+		if f.TestFramework != "" {
+			reason += " (" + f.TestFramework + ")"
+		}
+		mints = append(mints, vdb.CliSuppressionMint{
+			RuleID:          f.RuleID,
+			Category:        category,
+			SuppressionType: "test-code",
+			Reason:          reason,
+			FilePath:        f.ArtifactURI,
+			LineNumber:      f.StartLine,
+			CodeSnippet:     f.Snippet,
+			BranchName:      branch,
+			Origin:          "cli-test-code",
+			Active:          true,
+			Fingerprint:     f.Fingerprint,
+		})
+	}
+	return kept, mints
+}

internal/sast/rule.go

@@ -33,6 +33,16 @@ type Finding struct {
 	Snippet     string        `json:"snippet"`
 	Fingerprint string        `json:"-"`
 	Metadata    *RuleMetadata `json:"-"`
+
+	// Test-suite attribution, set post-evaluation by internal/testsuite when the
+	// finding's file belongs to the project's test suite. IsTestSuite drives the
+	// SARIF `vulnetix/test-*` result properties and the typed wire fields.
+	IsTestSuite        bool     `json:"-"`
+	TestFramework      string   `json:"-"`
+	TestLanguage       string   `json:"-"`
+	TestConfidence     string   `json:"-"`
+	TestMatchedPattern string   `json:"-"`
+	TestEvidence       []string `json:"-"`
 }
 
 // SeverityToLevel maps severity to the default SARIF level when a rule

internal/sast/sarif.go

@@ -224,6 +224,24 @@ func BuildSARIF(findings []Finding, rules []RuleMetadata, toolVersion string) *S
 		result.Properties = SARIFPropertyBag{
 			"severity": f.Severity,
 		}
+		if f.IsTestSuite {
+			result.Properties["vulnetix/test-suite"] = true
+			if f.TestFramework != "" {
+				result.Properties["vulnetix/test-framework"] = f.TestFramework
+			}
+			if f.TestLanguage != "" {
+				result.Properties["vulnetix/test-language"] = f.TestLanguage
+			}
+			if f.TestConfidence != "" {
+				result.Properties["vulnetix/test-confidence"] = f.TestConfidence
+			}
+			if f.TestMatchedPattern != "" {
+				result.Properties["vulnetix/test-matched-pattern"] = f.TestMatchedPattern
+			}
+			if len(f.TestEvidence) > 0 {
+				result.Properties["vulnetix/test-evidence"] = f.TestEvidence
+			}
+		}
 
 		results = append(results, result)
 	}