(
manifest: dict[str, Any], findings_document: dict[str, Any], coverage: dict[str, Any]
)
| 379 | |
| 380 | |
| 381 | def build_report_markdown( |
| 382 | manifest: dict[str, Any], findings_document: dict[str, Any], coverage: dict[str, Any] |
| 383 | ) -> str: |
| 384 | scan = manifest["scan"] |
| 385 | target = scan["target"] |
| 386 | scope = scan["scope"] |
| 387 | threat_model = scan.get("threatModel") if isinstance(scan.get("threatModel"), dict) else {} |
| 388 | findings = sorted( |
| 389 | ( |
| 390 | finding |
| 391 | for finding in findings_document["findings"] |
| 392 | if finding["severity"]["level"] in REPORTABLE_SEVERITIES |
| 393 | ), |
| 394 | key=_finding_sort_key, |
| 395 | ) |
| 396 | include_paths = _strings(coverage.get("includePaths", scope.get("includePaths", []))) |
| 397 | exclude_paths = _strings(coverage.get("excludePaths", scope.get("excludePaths", []))) |
| 398 | limitations = _strings(scope.get("limitations")) |
| 399 | explicit_exclusions = coverage.get("explicitExclusions", []) |
| 400 | lines = [ |
| 401 | f"# Security Review: {_text(target['displayName'], 'Unknown target')}", |
| 402 | "", |
| 403 | "## Scope", |
| 404 | "", |
| 405 | _text( |
| 406 | scope.get("summary"), |
| 407 | "The scan reviewed the canonical include paths and exclusions listed below.", |
| 408 | ), |
| 409 | "", |
| 410 | f"- Scan mode: {coverage['mode']}", |
| 411 | *_target_scope_lines(target), |
| 412 | f"- Inventory strategy: {coverage['inventoryStrategy']}", |
| 413 | f"- Included paths: {', '.join(include_paths) or 'none'}", |
| 414 | f"- Excluded paths: {', '.join(exclude_paths) or 'none'}", |
| 415 | f"- Runtime or test status: {_text(scope.get('runtimeStatus'), 'not recorded')}", |
| 416 | ] |
| 417 | artifacts_reviewed = _strings(scope.get("artifactsReviewed")) |
| 418 | if artifacts_reviewed: |
| 419 | lines.extend(["- Artifacts reviewed: " + ", ".join(artifacts_reviewed)]) |
| 420 | context = _text(scope.get("context"), "") |
| 421 | if context: |
| 422 | lines.extend([f"- Scan context: {context}"]) |
| 423 | for exclusion in explicit_exclusions: |
| 424 | if isinstance(exclusion, dict): |
| 425 | limitations.append( |
| 426 | f"Excluded {_text(exclusion.get('pattern'), 'unspecified')}: " |
| 427 | f"{_text(exclusion.get('reason'), 'reason not recorded')}" |
| 428 | ) |
| 429 | if limitations: |
| 430 | lines.extend(["", "Limitations and exclusions:", *_bullets(limitations, "None recorded.")]) |
| 431 | lines.extend( |
| 432 | [ |
| 433 | "", |
| 434 | "### Scan Summary", |
| 435 | "", |
| 436 | "| Field | Value |", |
| 437 | "| --- | --- |", |
| 438 | f"| Reportable findings | {len(findings)} |", |
no test coverage detected