Function prepareComments

src/codeScan/util/github.ts:75–121

(
  comments: Comment[],
  review?: string,
  minimumSeverity?: string,
)

 * @returns Prepared comments and review body ready for GitHub posting
 */
export function prepareComments(
  comments: Comment[],
  review?: string,
  minimumSeverity?: string,
): {
  lineComments: Comment[];
  generalComments: Comment[];
  reviewBody: string;
} {
  // Sort comments by severity (descending: critical > high > medium > low)
  const sortedComments = [...comments].sort((a, b) => {
    const rankA = a.severity ? getSeverityRank(a.severity) : 0;
    const rankB = b.severity ? getSeverityRank(b.severity) : 0;
    return rankB - rankA;
  });

  // Only findings with a valid line can become inline review comments. File-only and
  // fileless findings remain useful, but must go through the general-comment path.
  const postableComments = sortedComments.filter(isPrPostableFinding);
  const lineComments = postableComments.filter(hasInlineCommentLocation);
  const generalComments = postableComments.filter((comment) => !hasInlineCommentLocation(comment));

  // Check if we only have "none" severity comments (i.e., no real vulnerabilities)
  const hasOnlyNoneSeverity =
    comments.length > 0 && comments.every((c) => c.severity === CodeScanSeverity.NONE);

  // Construct review body
  let reviewBody = review || '';

  // If no real vulnerabilities, prepend "All Clear" to review
  if (hasOnlyNoneSeverity && reviewBody) {
    reviewBody = `${ALL_CLEAR_MESSAGE}\n\n${reviewBody}`;
  }

  // Append minimum severity threshold if provided
  if (minimumSeverity && reviewBody) {
    const severityFormatted = formatSeverity(minimumSeverity as CodeScanSeverity, 'plain');
    reviewBody += `\n\n<sub>Minimum severity threshold: ${severityFormatted} | To re-scan after changes, comment \`@promptfoo-scanner\`</sub>`;
    reviewBody += `\n<sub>[Learn more](https://www.promptfoo.dev/docs/code-scanning/)</sub>`;
  }

  return {
    lineComments,
    generalComments,
    reviewBody,
  };
}