v0.0.6

Changelog
v0.0.5

✨ New Features

• KICS path exclusions: new [kics].exclude config option (string array of glob patterns) passed to KICS via --exclude-paths, mirroring the existing [grype].exclude support (features/scans/kics, loader/dto.go).
• DefectDojo triage status support: findings marked in DefectDojo as false_p (false positive), risk_accepted, or out_of_scope are now mapped to local status INACTIVE, alongside the existing active=false case (features/sync/sync.go).
• Caveman skills added to better manage token consumption

🐛 Bug Fixes

• Grype/DefectDojo finding matching: matching a local Grype finding to its DefectDojo counterpart no longer hashes on Recommendation text, since DefectDojo's Anchore Grype parser rewrites that text (e.g. "Upgrade to version: X" vs. ScopeGuardian's "Upgrade to X"), causing findings to silently fail to match and never transition out of ACTIVE. Matching now uses the CVE/GHSA vulnerability ID instead, which DefectDojo passes through verbatim (domains/models/finding.go, features/scans/grype/service.go, features/sync/sync.go).
• CI/build vulnerabilities: hardened GitHub Actions workflows (ci.yml, release.yml, security.yml) and bumped Go module dependencies (go 1.24.4 → 1.25.0, golang.org/x/sys → v0.44.0).
• Pinned curl to 8.19.0-r0 in the Docker image (was 8.17.0-r1).

🔧 Configuration

• config.toml — Exclude example field added under [kics].

v0.0.5

Changelog

v0.0.5

✨ New Features

• Syft: configurable SBOM exclusion patterns (syft_exclude) — The [grype] config block now accepts a syft_exclude array of glob patterns (e.g. ["**/src/test/**", "**/testdata/**"]). Each pattern is forwarded to Syft via --exclude flags, removing matching paths from the SBOM and reducing noise in Grype findings.

• Syft: configurable POM parent resolution depth (syft_depth) — A new syft_depth integer field in [grype] controls how many parent POM levels Syft recursively resolves during Java dependency scanning. Defaults to 1 when not set.

• Grype: CWE/CVE column enrichment — The findings table column was renamed from CWE to CWE/CVE. For Grype findings the column is now populated with the CVE identifier sourced from the epss[].cve field, giving operators direct CVE references in the output.

🐛 Bug Fixes

• Grype: EPSS field now parsed as an array — The epss field in Grype's JSON output schema is an array; the GrypeEpss DTO was updated from a pointer to a slice ([]GrypeEpss) to match, preventing silent parse failures on recent Grype output.

• Syft: --exclude patterns passed correctly — Quote-wrapping around exclude patterns was removed from the exec.Command call so that Syft receives the raw glob strings as intended.

📄 Documentation

• README.md updated to reflect the new syft_exclude array field replacing the previous exclude_test_libraries boolean, added syft_depth documentation, and corrected config examples (PR #43, PR #44).
• CLAUDE.md added with project context and development guidelines for AI coding assistants.

🔧 Configuration

• config.toml — syft_depth example field added under [grype].
• loader/dto.go — New SyftExclude []string and SyftDepth int fields added to the Grype DTO.

📦 Files Changed

File	Changes
README.md	Updated config reference and field table
CLAUDE.md	New — project context for AI assistants
.claude/skills/go-fmt/SKILL.md	New — go fmt Claude Code skill
.claude/skills/update-readme/SKILL.md	New — README update Claude Code skill
config.toml	+1 line — syft_depth example
loader/dto.go	+14 lines — SyftExclude, SyftDepth fields
loader/loader_test.go	+1 line — updated loader test
loader/mocks/config_with_grype.toml	+1 line — test fixture
display/display.go	+1/-1 — rename column CWE → CWE/CVE
display/display_test.go	Updated to match new column name
features/scans/grype/dto.go	+5 lines — GrypeEpss struct; Epss as slice
features/scans/grype/service.go	Updated CVE field population
features/scans/grype/service_test.go	Updated tests
features/scans/grype/mocks/.../grype-result.json	Updated to array epss format
features/scans/syft/const.go	+2 lines — excludeArgument, envJavaMaxParentRecursiveDepth
features/scans/syft/factory.go	+8 lines — pass exclude, depth to service
features/scans/syft/factory_test.go	+46 lines — new factory tests
features/scans/syft/service.go	+7 lines — --exclude flags, depth env var
features/scans/syft/service_test.go	+68 lines — new service tests

Total: 40 files changed, +614 insertions, -148 deletions

v0.0.4

Changelog: v0.0.3 → v0.0.4

✨ New Features

• Proxy support for scanner sub-processes — Scanner sub-processes (Grype, KICS, OpenGrep, Syft) now inherit and pass proxy configuration through to their execution environments. This enables scans to work in network-restricted environments that require a proxy.

🐛 Bug Fixes

• Exit code on engine initialization failure — The engine now exits with code -2 (instead of a generic failure) when engine initialization fails, allowing callers to better distinguish initialization errors from other failures.

📄 Documentation

• README.md updated with proxy configuration instructions and examples (added ~36 lines).

🔧 Configuration

• config.toml — New proxy-related configuration options added.
• loader/dto.go — New DTO fields to support proxy configuration loading.

📦 Files Changed

File	Changes
README.md	+36 lines — proxy docs
config.toml	+8 lines — proxy config
engine/const.go	+2 — new exit code constant
engine/engine.go	+15/-1 — init failure exit code
main.go	+6/-2 — engine init handling
loader/dto.go	+39 — proxy config DTO
loader/dto_test.go	+58 — proxy config tests
loader/loader_test.go	+11 — loader tests
loader/mocks/config_with_proxy.toml	+8 — test fixture
features/scans/grype/service.go	+5/-3 — proxy pass-through
features/scans/kics/service.go	+5/-3 — proxy pass-through
features/scans/opengrep/service.go	+5/-3 — proxy pass-through
features/scans/syft/service.go	+8/-4 — proxy pass-through
(factory & test files)	Updated accordingly

Total: 22 files changed, +262 insertions, -60 deletions

v0.0.3

Changelog: v0.0.2 → v0.0.3

🚀 New Features

Finding Status Tracking (closes #38)

• Duplicate finding detection: Findings are now tracked with a status of ACTIVE, INACTIVE, or DUPLICATE via the DefectDojo API.
• New Finding domain model (domains/models/finding.go) with deduplication logic and status fields.
• All scanners (Grype, KICS, OpenGrep) now produce findings with deduplication keys.
• The sync feature now compares findings with DefectDojo and correctly marks duplicates instead of re-creating them.
• Updated DefectDojo connector: new DTO fields, API methods for fetching active/duplicate findings, and full test coverage.
• Security gate now evaluates finding counts per status (active, duplicate, inactive).

🔧 Improvements & Fixes

CI/Release Pipeline

• secrets: inherit added to both ci.yml and release.yml workflow calls so DefectDojo credentials (DD_URL, DD_ACCESS_TOKEN) are properly passed to the security job.
• Security workflow now passes DD_URL, DD_ACCESS_TOKEN, SG_VERSION, and BRANCH as environment variables (fixing potential secret interpolation in shell commands).
• ScopeGuardian now runs with --sync and --threshold "critical=1,high=1,medium=1,low=1" flags in CI.
• BRANCH now correctly uses github.head_ref || github.ref_name to support both PRs and push events.

Security Config

• Removed exclude_queries for KICS (fd54f200 query no longer suppressed).
• Removed exclude_rule for OpenGrep (go.lang.security.audit.dangerous-exec-command).

📦 Files Changed

36 files changed, +1,851 / −191 lines

Area	Files
Domain model	domains/models/finding.go, finding_test.go
Scanners	grype, kics, opengrep services & tests
DefectDojo connector	const.go, dto.go, service.go, service_mock.go, tests
Sync feature	sync.go, sync_test.go, const.go
Security gate	security_gate.go, security_gate_test.go
Parser	parser.go, dto.go, const.go, parser_test.go
Engine / Main	engine.go, main.go
Display	display.go, display_test.go
CI/Config	.github/workflows/ci.yml, release.yml, security.yml, security-config.toml
Documentation	README.md

v0.0.2

Changelog: v0.0.1 → v0.0.2

✨ New Features

• feat(kics): add --exclude-queries support — Added support for the --exclude-queries flag in the KICS scanner. Allows specific KICS query IDs to be excluded from scans via the configuration file. Updated README with documentation.

🔒 Security Pipeline

• Add reusable security workflow using ScopeGuardian v0.0.1 — Introduced .github/workflows/security.yml and .github/security-config.toml to run ScopeGuardian's own security checks as part of CI.
• Add security gate — Integrated a security gate step into the pipeline.
• Grant packages:read permission — Fixed permissions in ci.yml and release.yml to allow pulling the Docker image from GHCR.

🐛 Bug Fixes

• Fix: address vulnerabilities in Dockerfile, docker-compose.yml, and exec.go — Resolved reported security findings. Some were subsequently rolled back where the behavior was intentional (e.g. exec.go uses exec by design).

⚙️ Configuration & CI Tuning

• Exclude Docker files from OpenGrep scan — docker-compose.yml and Dockerfile-related patterns excluded from OpenGrep since they are already covered by KICS.
• Exclude test files from SAST scan — Test files excluded from the security scan to reduce false positives.
• Whitelist ROOT user usage in Docker image — Marked as not relevant since the tool is used as a CLI.
• Add variable for SG version — Parameterized the ScopeGuardian version used in the security workflow.

🗑️ Removals

• Delete unused CHANGELOG.md — Removed a previously committed but unused changelog file.

---

Files changed: .github/workflows/security.yml, .github/workflows/ci.yml, .github/workflows/release.yml, .github/security-config.toml, Dockerfile,, features/scans/kics/const.go, features/scans/kics/service.go, features/scans/kics/service_test.go, loader/dto.go, loader/loader_test.go, loader/mocks/config.toml, README.md

v0.0.1

🎉 ScopeGuardian v0.0.1 — Initial Release

ScopeGuardian is an open-source CLI tool that orchestrates multiple security scanners against your codebase and optionally synchronises the findings with DefectDojo. It can also act as a security gate in CI/CD pipelines, blocking pipelines when finding counts exceed configurable thresholds.

---

✨ Features

🔍 Scanner Integrations

• KICS — Infrastructure-as-code (IaC) static analysis. Supports Dockerfile, Terraform, CloudFormation, Kubernetes, Ansible, and more.
• Grype + Syft — Software Composition Analysis (SCA). Syft generates an SBOM first; Grype then scans it for known vulnerabilities. Configurable ignore states (not-fixed, unknown, wont-fix) and path exclusions.
• OpenGrep — Static Application Security Testing (SAST). Findings are enriched with CWE, OWASP, impact, and confidence metadata before being uploaded to DefectDojo.

🔄 DefectDojo Sync (--sync)

• Automatically creates or reuses a DefectDojo engagement per project/branch combination (named <projectName>-<branch>).
• Extends expired engagement end dates automatically.
• Protected branches (e.g. main, master) receive a 1-year engagement end date; all others get 1 week.
• Per-scanner import with tagging (IACST, SCA, SAST), group-by-title deduplication, and automatic closure of findings absent from the latest scan.

🚦 Security Gate (--threshold)

• Fail a CI/CD pipeline when finding counts at or above a configured severity meet a threshold.
• Supports critical, high, medium, low, info severities.
• When used together with --sync, the gate evaluates deduplicated findings from DefectDojo rather than raw scan output.

📤 Output Options

• -q — Quiet mode: suppress all log output.
• -o <file> — Write findings to a file (only findings; no banner or logs).
• --format json|csv|raw — Control the output format when -o is set (default: json).

🐳 Docker Image

• Multi-stage Dockerfile that bundles ScopeGuardian together with KICS, OpenGrep, Syft, and Grype.
• docker-compose.yml for spinning up a local DefectDojo instance (PostgreSQL + Redis) for testing.

⚙️ Two-Phase Execution Engine

• Phase 1 (prerequisites): Syft SBOM generation runs first, concurrently.
• Phase 2 (scanners): Grype, KICS, and OpenGrep run concurrently after Phase 1. Any scanner whose prerequisite failed is skipped automatically.

---

📦 Installation

From source:

go build -o ScopeGuardian .

Docker:

docker build -t ScopeGuardian .

---

⚙️ Requirements

• Go 1.24+ (source builds only)
• SCAN_DIR environment variable (base directory for scan operations)
• DD_URL + DD_ACCESS_TOKEN (only when --sync is used)

---

📄 Configuration

ScopeGuardian is driven by a TOML configuration file. See README → Configuration File for the full reference.

---

🙏 Acknowledgements

Built on top of KICS, Grype, Syft, OpenGrep, and DefectDojo.