Log a message if verbose mode is enabled.

Check if a finding should be excluded based on hard rules. Args: finding: Security finding to check

Parse JSON from text with multiple fallback strategies and error handling. Args: text: The text to parse error_context:

Main execution function for GitHub Action.

Create a filter that only uses hard exclusions.

Extract JSON object from text, looking in various formats and locations. Args: text: The text that may contain JSON

Helper to get simple kept/excluded tuple from FindingsFilter.

Run Claude Code security audit. Args: repo_dir: Path to repository directory prompt: Security audit prompt

Generate security audit prompt for Claude Code. Args: pr_data: PR data dictionary from GitHub API pr_diff: Optional complete

Validate that Claude Code is available.

Get PR metadata and files from GitHub API. Args: repo_name: Repository name in format "owner/repo" pr_number:

Extract security findings from Claude's JSON response.

Get and validate environment configuration. Returns: Tuple of (repo_name, pr_number) Raises: ConfigurationError:

Filter out generated files and excluded directories from diff content.

Apply findings filter to reduce false positives. Args: findings_filter: Filter instance original_findings: Original findings

Initialize GitHub and Claude clients. Returns: Tuple of (github_client, claude_runner) Raises: ConfigurationErro

Initialize findings filter based on environment configuration. Args: custom_filtering_instructions: Optional custom filtering instruc

Check if a file should be excluded based on directory patterns.

Run the SAST audit script on a repository. Args: test_case: Test case being evaluated repo_path: Path to the

Set up repository worktree for PR evaluation. Args: test_case: Test case containing repo and PR info

Filter security findings to remove false positives. Args: findings: List of security findings from Claude Code audit

Get a configured logger that outputs to stderr. Args: name: The name of the logger (usually __name__) Returns: C

Get complete PR diff in unified format. Args: repo_name: Repository name in format "owner/repo" pr_number: Pu

Run security evaluation on a single PR. Args: test_case: Test case to evaluate Returns:

Clean up locked or stale worktrees and remove untracked branches. Args: repo_path: Path to the main repository

Generate a branch name for evaluation. Args: test_case: Test case being evaluated Returns:

Get or create a lock for a repository. Args: repo_name: Repository name Returns: Lock fo

Run the security audit with Claude Code. Args: claude_runner: Claude runner instance prompt: The security audit prompt

Convenience function to run a single evaluation. Args: test_case: Test case to evaluate verbose: Enable verbose logging

Convert to dictionary for JSON serialization.

Clean up a worktree after evaluation. Args: test_case: Test case that was evaluated worktree_path: Path to th

Generate prompt for analyzing a single security finding. Args: finding: Single security finding pr_context: O

Generate system prompt for security analysis.

Check if a finding references a file in an excluded directory. Args: finding: Security finding dictionary github_client: GitH

Read a file and format it with line numbers. Args: file_path: Path to the file to read Returns:

Analyze a single security finding to filter false positives using Claude API. Args: finding: Single security finding to a

Make Claude API call with retry logic. Args: prompt: User prompt system_prompt: Optional system prompt

Main entry point for single PR SAST evaluation.

Validate that API access is working. Returns: Tuple of (success, error_message)

Initialize findings filter. Args: use_hard_exclusions: Whether to apply hard exclusion rules use_claude_filte

Initialize Claude API client. Args: model: Claude model to use api_key: Anthropic API key (if None, reads fro

Initialize GitHub client using environment variables.

Initialize Claude runner. Args: timeout_minutes: Timeout for Claude execution (defaults to SUBPROCESS_TIMEOUT)

Initialize evaluation engine. Args: work_dir: Directory for cloning repositories verbose: Enable verbose logg

Convenience function to get Claude API client. Args: model: Claude model identifier api_key: Optional API key (reads from env

Set up mock environment variables.

Test that actual exposed secrets are not excluded.

Test handling of Anthropic API key.

Test handling of filter failure.

Test applying FindingsFilter to findings.

Test applying FindingsFilter to findings.

Test when security audit fails.

Test case sensitivity in exclusion rules.

Test various Claude output formats.

Test worktree cleanup.

Test findings that match multiple patterns.

Test that all component modules can be imported.

Test that _create_findings_from_text was removed.

Test that _create_findings_from_text was removed.

Test that deployment PR titles are correctly identified.

Test exclusion of DOS-related findings.

Test that stack overflow with exploit mention is not excluded.

Test DOS pattern exclusions.

Test handling of duplicate findings.

Test handling of empty or malformed findings.

Test filtering empty findings list.

Test engine initialization with API key.

Test engine initialization without API key.

Test creating an EvalCase instance.

Test creating an EvalResult instance.

Test converting EvalResult to dictionary.

Test creating an EvalResult with error.

Test creating an EvalResult with findings.

Test general exception handling.

Test extracting JSON array from text (currently not supported).

Test extracting JSON from nested code blocks.

Test extracting JSON from mixed text.

Test JSON extraction from various text formats.

Test extracting JSON from text with no JSON returns None.

Test extracting JSON when none exists.

Test extracting JSON from markdown code blocks.

Test extracting JSON from plain text.

Test extracting JSON when multiple JSON blocks exist.

Test extracting JSON when there are syntax errors in surrounding text.

Test JSON extraction with unicode.

Test extraction from Claude Code wrapper format.

Test that direct findings format was removed - only wrapped format is supported.

Test extraction with no findings.

Test that text fallback was removed - only JSON is supported.

Test edge cases in generated file filtering.

Test findings with extra/unexpected fields.

Test FindingsFilter with LLM filtering disabled.

Test complete workflow with realistic PR data.

Test that generic validation findings are NOT excluded anymore.