Updates to new format #1

2026-10-01T11:46:44Z

fklement commented

2026-10-01 11:46:44 +00:00

First-time contributor

No description provided.

fklement added 17 commits 2026-10-01 11:46:44 +00:00

Add toc and include all findings in the report 2e2ab63232

Retitle the report and drop the report and artifact ids 5959d9364b

The report now covers every finding from all tools, so "SAST/SCA Report"
undersold it. The report and artifact ids were never filled in.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Let the project name and the manufacturer be supplied on the command line dc8ed38d8c

Neither is recorded in the artifacts: the metadata's repository_name is
empty and nothing names a manufacturer. --project wins over the metadata.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Report the scanned commit as the project version 08a8477442

The pipeline leaves repository_version empty, but tags the Dependency-Track
upload with the commit it scanned. Use that when no version is stated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Label the set-aside count Suppressed / False Positives ae04b50a6c

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Drop the recommendation from the CVE cards 8629ba7bcf

The VDR carries no recommendation, so every card only ever showed <xxx>.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Grade SARIF findings by score, then CWE, then level 8f47303605

A result's own security-severity score is banded like CVSS; without one,
the finding is graded by a hand-built CWE table; failing that, by its
SARIF level, one band lower than before. The scanners' levels said more
about the tool than about the risk: a container running as root came out
Critical and a hard-coded password Medium.

The summariser only reads security-severity off the rule, and Lynkeus
scores each result, so the runs are summarised here to keep that score.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Name the dependency check CipherCell SCA on the cover b380c736c9

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Remove the scan information section 9d78e9edf4

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Report lines of code and the main languages from cloc.txt 2d88ffa953

The project page takes the size from cloc's sum and names the three to
five largest languages, leaving out prose and data files such as Markdown,
text, CSV and JSON, and anything under 1% of the code beyond the third.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Put the SBOM vulnerabilities before the per-tool sections b96b4315f1

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Lead the cover with manufacturer and project, end with the scan id e3b477d677

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Drop the CVE metrics the artifacts cannot answer cce3e85e9d

Time to exploit, CVE volume trends, CWE abstraction level and CWE
relationships need exploitation history, earlier scans or the CWE catalog,
none of which the VDR carries, so they only ever showed <xxx>.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Report CipherCell SCA first, then Lynkeus, then SAST, everywhere 303bcdf0b4

The dependency check is named CipherCell SCA throughout, and the sources
keep one order on the cover, in the summary, the most-critical table and
the sections. Lynkeus before SAST no longer depends on the run order in
the SARIF file.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Add a CipherCell header to every page but the cover ffcd68f9f8

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Let the caller state the project's version 0ace2e1803

--version replaces the commit hash on the cover and the project page, for
generate and from-folder alike. Without it the report still falls back to
repository_version from the metadata, else the scanned commit.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Add a summary report set from Markdown 864e2ff824

from-markdown takes a hand-written summary such as SUMMARY.md and sets it
in the full report's dress: the same cover, header, footers, table of
contents, headings and grids. The shared macros move to macros.html.j2 so
both templates draw from them, and layout.render_pdf takes the template and
document title to use.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

You are not authorized to merge this pull request.

This pull request can be merged automatically.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u https://git.ciphercell.de/CipherCell/pdf-reporting updates-to-new-format:CipherCell-updates-to-new-format

git checkout CipherCell-updates-to-new-format

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: florian/pdf-reporting#1

Allow edits from maintainers