perf(scanner): cache immutable scan-root path context - #899

#!/bin/bash
set -euo pipefail

echo '== Exact refs and merge base =='
git rev-parse HEAD
git rev-parse 3e7cec7b539fef7b14ae54133511acfe7d82df1b
git rev-parse 0d07baae44a40edfcaec5e42c7fb9351510ca9f0
git merge-base 3e7cec7b539fef7b14ae54133511acfe7d82df1b 0d07baae44a40edfcaec5e42c7fb9351510ca9f0

echo '== Changed files and summary =='
git diff --check 0d07baae44a40edfcaec5e42c7fb9351510ca9f0...3e7cec7b539fef7b14ae54133511acfe7d82df1b
git diff --stat 0d07baae44a40edfcaec5e42c7fb9351510ca9f0...3e7cec7b539fef7b14ae54133511acfe7d82df1b
git diff --name-status 0d07baae44a40edfcaec5e42c7fb9351510ca9f0...3e7cec7b539fef7b14ae54133511acfe7d82df1b

echo '== Relevant symbol locations =='
rg -n -C 4 -g '*.py' \
  '\b(ScanPathContext|build_scan_path_context|cmd_scan|_scan_file)\b' .

echo '== Relevant authentication-pattern locations =='
rg -n -i -C 4 -g '*.py' \
  '(auth(entication)?|credential|defer|comment)' .

echo '== Candidate test and workflow files =='
fd -t f . | rg '(^|/)(test|tests)/|\.github/workflows/|pyproject\.toml$|coverage'

echo '== Changed patch =='
git diff --find-renames --find-copies --no-ext-diff \
  0d07baae44a40edfcaec5e42c7fb9351510ca9f0...3e7cec7b539fef7b14ae54133511acfe7d82df1b

#!/bin/bash
set -euo pipefail

log=/tmp/coderabbit-shell-logs/shell-output-LZd3gJ

echo '== Exact-ref section from prior inspection =='
sed -n '1,80p' "$log"

echo '== CLI function map =='
ast-grep outline scanner/cli/appguardrail.py --items all --type function --match 'cmd_scan|_scan_file|_path_allowed_by_rule|_display_path'

echo '== Core context source =='
cat -n appguardrail_core/scan_paths.py

echo '== Changed CLI call path =='
sed -n '1380,1455p' scanner/cli/appguardrail.py
sed -n '2890,3015p' scanner/cli/appguardrail.py

echo '== YAML rule loading and regex evaluation =='
rg -n -C 12 -g '*.py' \
  '(safe_load|yaml\.|pattern-regex|patterns|applicable_rules|finditer)' \
  scanner appguardrail_core

echo '== Current packaged authorization rules =='
cat -n scanner/rules/authz.yml

echo '== Base packaged authorization rules =='
git show 0d07baae44a40edfcaec5e42c7fb9351510ca9f0:scanner/rules/authz.yml | cat -n

echo '== Focused test maps and contents =='
ast-grep outline tests/test_scan_path_context_core.py --items all --type function
ast-grep outline tests/test_scan_path_context_integration.py --items all --type function
ast-grep outline tests/test_auth_deferral_comment_rule.py --items all --type function
sed -n '1,180p' tests/test_scan_path_context_core.py
sed -n '1,180p' tests/test_scan_path_context_integration.py
sed -n '1,140p' tests/test_auth_deferral_comment_rule.py

#!/bin/bash
set -euo pipefail

echo '== Packaged-rule consumers and full-YAML engines =='
rg -n -C 5 \
  '(scanner/rules|authz\.yml|--config|semgrep.*config|rules_dir|rules_path|glob.*\.yml|rglob.*\.yml)' \
  . -g '!scanner/rules/authz.yml'

echo '== References to modified rule identities =='
rg -n -C 4 \
  '\b(api-route-missing-auth-check|missing-api-auth|db-query-without-user-filter|req-body-user-id-trust|trusting-client-user-id)\b' \
  .

echo '== Parser and packaged-rule loader =='
sed -n '930,1045p' scanner/cli/appguardrail.py
sed -n '1045,1105p' scanner/cli/appguardrail.py
rg -n -C 8 -g '*.py' \
  '\b(_parse_yaml_regex_rules|_load.*rule|SCAN_RULES\s*=|scanner/rules)\b' \
  scanner/cli/appguardrail.py

echo '== Path normalization and scan-root setup =='
sed -n '1145,1185p' scanner/cli/appguardrail.py
sed -n '1345,1395p' scanner/cli/appguardrail.py

echo '== Diff limited to non-comment packaged-rule changes =='
git diff --no-ext-diff --unified=12 \
  0d07baae44a40edfcaec5e42c7fb9351510ca9f0...3e7cec7b539fef7b14ae54133511acfe7d82df1b \
  -- scanner/rules/authz.yml