Skip to content

feat(preship): add security gate and security diff - #25

Open
shuvonsec wants to merge 1 commit into
mainfrom
feat/axguard-preship
Open

shuvonsec wants to merge 1 commit into
mainfrom
feat/axguard-preship

Conversation

@shuvonsec

@shuvonsec shuvonsec commented Sep 16, 2026

Copy link
Copy Markdown
Member

Summary

  • Adds Pre-Ship CLI: axguard preship . — gate with PASS / PASS_WITH_NOTES / REVIEW_REQUIRED / FAIL; exit codes 0 / 0 / 1 / 2 (3 = tool error).
  • Adds Security Diff CLI: axguard diff (alias axguard security-diff) — app model, dataflow, controls, authz/tenant, attack paths; reuses Twin/Memory/Predictive when available.
  • MCP tools axguard_preship and axguard_security_diff; docs, fixtures, and skill updates.

Test plan

  • pytest tests/test_preship.py tests/test_security_diff.py (19 passed)
  • Full suite previously green (477 passed)
  • Manual: axguard preship . and axguard diff HEAD~1
  • Confirm no AI attribution on commit or PR body

if not text:
return None
p = Path(text)
if p.exists():
return None
p = Path(text)
if p.exists():
return p.resolve()
if value in {".", "./"}:
return False
p = Path(value)
if p.exists():
notes: list[str] = []

# --- resolve baseline -------------------------------------------------
if base_path is not None and base_path.is_dir():


def _load_json(path: Path) -> dict[str, Any] | None:
if not path.is_file():
if not path.is_file():
return None
try:
data = json.loads(path.read_text(encoding="utf-8"))
Soft-imports existing engines. Never invents missing analysis.
"""
opts = dict(options or {})
root = Path(target).resolve()
name: str = "default",
) -> dict[str, Any] | None:
path = resolve_baseline_dir(project_root) / f"{_safe_name(name)}.json"
if not path.is_file():
if not path.is_file():
return None
try:
data = json.loads(path.read_text(encoding="utf-8"))
result.setdefault("resolved_findings", [])
result.setdefault("security_posture_delta", result.get("security_impact") or {})
result["github_summary"] = format_github_pr_summary(result)
return result
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants