diff_reports
Compare two scans to see what a change introduced and what it resolved, and check whether a pull request gate would fail on new findings.
Instructions
Compare two scans and report what a change introduced and what it resolved. Ask this rather than summarize_report when the question is whether a change made things worse: a project with inherited findings answers 'what is wrong' the same way before and after, which says nothing about the change. Give failOnNew to learn whether a pull request gate would fail.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | maximum new findings to return; defaults to 20 | |
| basePath | Yes | path to the results.sarif from the base revision | |
| headPath | Yes | path to the results.sarif from the revision being proposed | |
| failOnNew | No | report whether a new finding at or above this would fail a gate, in either vocabulary: a priority band (P1-P4), which folds in the component's declared exposure and criticality, or a severity (critical, high, medium, low) |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| new | No | ||
| note | No | ||
| fixed | No | ||
| newCount | Yes | findings present in head and absent from base | |
| wouldFail | No | true when a new finding meets failOnNew; only meaningful when failOnNew was given | |
| fixedCount | Yes | findings present in base and absent from head | |
| movedCount | No | findings in both scans under a different component, as splitting or renaming a component reports them; neither new nor fixed, and no gate reads them | |
| gateApplied | No | the threshold wouldFail was computed against |