Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/scanoss/cli.py`:
- Around line 1741-1766: The code forwards args.scan_dir verbatim to
scanner.scan_folder_with_options (filter_path) and
scanner.scan_file_with_options (file_id), which can cause mismatches for inputs
like "./sub/file.c" or "sub/../file.c"; normalize the path before passing it.
Compute a normalized target: if scan_root is provided, derive a relative,
normalized path from scan_root to effective_path (e.g.,
os.path.relpath(effective_path, scan_root) then os.path.normpath), otherwise use
os.path.normpath(args.scan_dir); pass that normalized value as filter_path to
scan_folder_with_options and as file_id to scan_file_with_options instead of the
raw args.scan_dir.

In `@src/scanoss/file_filters.py`:
- Around line 353-355: The filter logic mishandles '.' and path-separator
differences; normalize filter_path with os.path.normpath and os.path.normcase,
treat '.' or empty result as "no filter" (skip filtering), and then filter files
by comparing each file's normalized/normcased path to the normalized filter
using equality or startswith(normalized + os.sep); update the block that sets
normalized and filters files (variables filter_path, normalized, files) to use
os.path.normpath/os.path.normcase and the special-case for '.'/'' so separators
and platforms are handled correctly.

In `@src/scanoss/scanoss_settings.py`:
- Line 27: Remove the unused getcwd import to fix the F401 lint error: edit the
import statement that currently reads "from os import getcwd" and either delete
it or replace it with only the actually used os imports in this module so no
unused symbol (getcwd) remains referenced in scanoss_settings.py.

---

Nitpick comments:
In `@tests/test_file_filters.py`:
- Around line 344-373: Add a regression test that calls
self.file_filters.get_filtered_files_from_folder(self.test_dir, '.') to ensure
filter_path='.' returns files from the repository root subtree; use self._create
to set up files (e.g. files at root and in subfolders) and assert the returned
list matches the expected sorted set (use same conventions as existing tests
like test_filter_path_none_returns_all and
test_filter_path_allows_nested_subdir), e.g., create ['a.c', 'sub/b.c'] and
assert '.' returns ['a.c', 'sub/b.c'] (or sorted equivalent) to lock down
--scan-root behavior.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/container-local-test.yml:
- Line 24: Replace all tag-pinned GitHub Action references (e.g., the literal
string "uses: actions/checkout@v6" and the other "uses: ...@v4" / "...@v7"
entries) with the corresponding action pinned to a full commit SHA; locate each
"uses:" line in the workflow (the ones ending with `@v6`, `@v4`, `@v7`) and update
them to the full immutable commit SHA from the upstream action repository
release you intend to use (copy the commit SHA from the action's GitHub
tags/releases and substitute it in place of the tag).

In @.github/workflows/container-publish-ghcr.yml:
- Line 27: Pin every GitHub Action reference in the workflow to an immutable
commit SHA instead of mutable major tags: replace actions/checkout@v6,
actions/setup-python@v6, docker/setup-qemu-action@v4,
docker/setup-buildx-action@v4, docker/metadata-action@v6,
docker/build-push-action@v7 (and the other listed uses entries) with their
corresponding full commit SHAs retrieved from each action's repo, and ensure the
already-commented pinned SHA for docker/setup-buildx-action is applied; update
each uses: line to the exact "owner/repo@<full-commit-sha>" form so the workflow
is deterministic.

In @.github/workflows/python-local-test.yml:
- Line 23: Replace the mutable tag "actions/checkout@v6" with the corresponding
immutable commit SHA: locate the actions/checkout repository tag v6 on GitHub,
copy the commit SHA for that tag, and update the workflow's uses line to
"actions/checkout@<COMMIT_SHA>" so the workflow references the exact commit
instead of the moving tag; ensure you replace the value in the uses: entry that
currently reads actions/checkout@v6.

In @.github/workflows/python-publish-pypi.yml:
- Line 17: The workflow uses floating action refs (actions/checkout@v6,
actions/setup-python@v6, pypa/gh-action-pypi-publish@release/v1,
softprops/action-gh-release@v3, nick-fields/retry@v4) which must be pinned to
immutable commit SHAs; update each uses: entry to reference the corresponding
full 40-character commit SHA for the specific released tag you want to consume
(replace e.g. actions/checkout@v6 with actions/checkout@<commit-sha>), verifying
the SHA against the action repo release/tag and keeping the tag name in a
comment if helpful.

In @.github/workflows/python-publish-testpypi.yml:
- Line 16: Workflow uses mutable action tags; replace actions/checkout@v6,
actions/setup-python@v6, and pypa/gh-action-pypi-publish@release/v1 with their
corresponding full commit SHAs to pin to immutable revisions: locate the three
usages of actions/checkout@v6, actions/setup-python@v6 (two occurrences), and
pypa/gh-action-pypi-publish@release/v1 in the TestPyPI workflow and replace each
tag with the exact commit SHA from the action repository (ensure you copy the
full 40-character SHA), then verify the workflow file's YAML remains valid and
run the workflow to confirm success.

In @.github/workflows/scanoss.yml:
- Line 23: Replace tag-based action refs with immutable commit SHAs: update the
two uses: entries that reference actions/checkout@v6 and
scanoss/gha-code-scan@v1 to point to their corresponding full commit SHA values
(replace the tag with the specific commit hash) so the workflow pins to exact
revisions; locate the uses lines for "actions/checkout@v6" and
"scanoss/gha-code-scan@v1" in the scanoss.yml and substitute each tag with the
verified commit SHA for that action.

In @.github/workflows/version-tag.yml:
- Around line 19-22: Update the checkout step that uses actions/checkout@v6 to
include persist-credentials: false so the SC_GH_TAG_TOKEN is not stored in the
job git config, and then modify the later git push --tags step to authenticate
explicitly (e.g., use the token from secrets in the push command or configure a
remote with https://<token>`@github.com/`... before pushing) so tag push uses only
the explicit credentials rather than persisted ones; look for the
actions/checkout@v6 step and the job step that runs git push --tags to make
these changes.
- Line 19: The workflow uses floating tags for actions and leaves checkout
credentials implicit: replace uses: actions/checkout@v6 and uses:
actions/setup-python@v6 with their immutable commit SHAs (pin both to specific
commit refs) and explicitly set actions/checkout persist-credentials to false in
the checkout step; then create a dedicated git-auth step that calls
actions/checkout or configures git with token: ${{ secrets.SC_GH_TAG_TOKEN }}
only for the push step (or set persist-credentials true only in that single
push-related checkout), ensuring the token is not written into local git config
for earlier steps.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@src/scanoss/cli.py`:
- Around line 1801-1805: Add a fast-fail guard for the invalid combination of
--container and --scan-root: before you set args.scan_loc or call
container_scan(parser, args, ...), check if args.container and args.scan_root
are both provided and call parser.error(...) (or raise SystemExit with a clear
message) to reject the combination. Modify the branch around args.container /
container_scan in the CLI so the check runs first; reference the args.container,
args.scan_loc assignment, and the container_scan(parser, args,
only_interim_results=True) call when making the change.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/python-local-test.yml:
- Around line 113-116: The echo in the if block that checks the variable
`hash_names` is missing its closing double-quote and will cause a Bash parse
error; fix the `echo` line used to report "Error: Folder hash failed to generate
HPFM hashes. Failing." by terminating the string with a closing `"` (and keep
`exit 1` on its own line), so the `if [ "$hash_names" = "" ]; then` ... `fi`
block contains a properly quoted echo followed by `exit 1`.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@tests/cli-test.py`:
- Around line 141-157: Add a happy-path test for get_scanoss_settings_from_args
in tests/cli-test.py that verifies scan_root is passed through (and scan_dir
fallback if applicable) to ScanossSettings.load_json_file when
skip_settings_file is False. Use the existing _args helper plus
get_scanoss_settings_from_args and assert the load_json_file call receives the
expected scan_root/scan_dir value, since current coverage only checks the
conflict and skip-only branches.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@src/scanoss/scanossapi.py`:
- Around line 56-68: The parse_retry_after docstring overstates the lower bound
of the returned delay. Update the documentation for parse_retry_after to match
the actual behavior: negative or invalid values do not clamp to 0, they fall
back to the default retry delay, so the effective minimum is the default value
(unless changed by the caller), while the maximum still remains capped by
maximum.
- Around line 284-311: The retry-exhausted 429/503 branch in `SCANOSSAPI` skips
persisting the failing WFP, unlike the no-response and generic error paths.
Update the exhausted-retry logic in the `r.status_code in (...)` block to call
`self.save_bad_req_wfp(...)` before raising, using the same request/WFP context
as the other failure branches so the exact rate-limit/outage case is captured
for debugging.