feat(ci): Add diff-aware scanning and GitHub PR commenting - #509

Adds output/filter.go with DiffFilter that filters EnrichedDetection
results to only include findings in changed files. This connects the
diff/ package (PR 1) to the detection pipeline — PR 3 will wire it
into ci.go and scan.go.

- NewDiffFilter: builds a changed-file set from path list
- Filter: keeps detections whose RelPath matches changed files
- FilteredCount: reports how many detections would be excluded
- ChangedFileCount: reports size of the changed-file set
- 100% test coverage on filter.go (27 test cases)

Co-Authored-By: Claude Opus 4.6 <[email protected]>

…i/scan commands

Wire diff-aware scanning into ci.go and scan.go via shared helpers in
diff_helpers.go. CI mode enables diff-aware by default (--no-diff to disable)
with auto-detection from GITHUB_BASE_REF, CI_MERGE_REQUEST_TARGET_BRANCH_NAME,
and PATHFINDER_BASELINE_REF. Scan mode is opt-in via --diff-aware flag.
Both commands support --base, --head, --github-token, --github-repo, --github-pr
flags for flexible diff computation. 100% test coverage on diff_helpers.go.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Strip the GitHub API-based changed files provider and all associated
CLI flags (--github-token, --github-repo, --github-pr). Git diff is
sufficient for computing changed files. GitHub API integration will be
re-introduced in a later PR specifically for PR comment posting, which
uses a different API endpoint entirely.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Add the github/ package with a thin HTTP client wrapping the GitHub REST
API endpoints needed for posting PR comments and inline review comments.

- Client supports: GetPullRequest, ListComments, CreateComment,
  UpdateComment, CreateReview, ListReviewComments, DeleteReviewComment
- Uses net/http (no new dependencies), context support, 30s timeout
- Token auth via Authorization header, pagination for list endpoints
- Types for Comment, ReviewComment, PullRequest, ReviewCommentInput
- 91% test coverage using httptest mock servers

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Add CommentManager for creating/updating PR summary comments with
marker-based deduplication (finds existing comment, updates in-place).

- PostOrUpdate: idempotent post-or-update using hidden HTML marker
- FormatSummaryComment: markdown with shields.io badges, findings table,
  collapsible details section, severity counts, scan metrics
- Severity badges turn green when count is zero, colored when > 0
- Critical findings trigger a warning callout
- 95% test coverage with httptest mock servers

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Add ReviewManager for posting inline review comments on critical and
high severity findings with marker-based update-in-place.

- PostInlineComments: batches new comments into atomic review, updates
  existing comments individually via hidden HTML markers
- FormatInlineComment: severity emoji, description, taint flow
  (source->sink), CWE/OWASP references
- ShouldPostInline: only critical/high get inline comments
- filterEligible: validates severity + location before posting
- indexByMarker: matches existing comments for dedup
- 100% code coverage on review.go (every function)

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Add prCommentOptions struct with validation, parseGitHubRepo helper,
and postPRComments orchestrator that posts summary and/or inline review
comments on GitHub PRs. Register five new CLI flags (--github-token,
--github-repo, --github-pr, --pr-comment, --pr-inline) on the ci
command. PR commenting runs after output generation with soft failure
(warning + continue) so CI reports are always produced.

Also adds SetBaseURL to github.Client for test server injection and a
newGitHubClient factory variable (matching osExit pattern) for full
httptest coverage of postPRComments success and error paths.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Fix three issues found by reviewing GitHub REST API documentation:

1. UpdateComment used issues/comments endpoint for review comments,
   which would 404. Add UpdateReviewComment using pulls/comments
   endpoint and call it from ReviewManager.PostInlineComments.

2. Add side:"RIGHT" to ReviewCommentInput so inline comments
   explicitly target the new file version in the diff.

3. Change auth header from "token" to "Bearer" prefix per current
   GitHub API recommendations.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

The CI command was missing the container rules execution path that
scan.go already had. Docker/docker-compose rules use @dockerfile_rule
and @compose_rule decorators which are loaded via LoadContainerRules,
not LoadRules. Without this, CI mode with --rules pointing to Docker
rule directories would find 0 rules and post empty comments.

Add extractContainerFiles + LoadContainerRules + executeContainerRules
flow to ci.go, matching the existing pattern in scan.go. Container
detections are merged with code analysis detections before diff
filtering and PR commenting.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

FilesScanned incorrectly used len(codeGraph.Nodes) which counts AST
nodes, not unique files. RulesExecuted only counted code analysis rules,
missing container rules entirely. Now deduplicates files by path and
counts unique rule IDs from all detections (matching scan.go pattern).

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Findings in the summary comment table and details section are now
sorted critical > high > medium > low > info using a stable sort
that preserves original order within the same severity level.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Replace the heading-per-finding layout with a compact table showing
severity, rule, file, line, CWE, and description in columns. Renders
much cleaner on GitHub PR comments.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

…gs table

Remove the redundant View Details collapsible section. Add a link column
to the findings table with a clickable emoji linking to the exact file
and line in the PR head commit (blob URL). PR metadata is now fetched
once at the start of postPRComments for both summary links and inline
comments.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Previously the CI command returned a hard error when the project had no
recognized source files, preventing PR summary comments from being
posted. Now it logs a message and continues, so zero-finding summaries
are posted correctly.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Rules metric showed 0 when no findings existed because it counted unique
rule IDs from detections. Now counts actually loaded rules: code analysis
rules from LoadRules plus container rules parsed from the JSON IR.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Files Scanned metric counted all files in the code graph including ones
not in the PR diff. Now uses len(changedFiles) when diff-aware scanning
is active, so only files actually in the PR are counted.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Co-Authored-By: Claude Opus 4.6 <[email protected]>

- Add TestCICmdValidation (10 subtests) covering all RunE validation
  paths in ci.go: missing rules/project, invalid output format, PR flag
  validation (token, repo, PR number, repo format) for both --pr-comment
  and --pr-inline
- Add TestScanCmdValidation (5 subtests) covering RunE validation paths
  in scan.go: missing rules/project, invalid output format, diff-aware
  without base ref, diff-aware with invalid base ref
- Add TestSetBaseURL for github/client.go
- Add network error tests for all 8 client methods covering doRequest
  failure branches
- Fix prealloc lint in review.go

Co-Authored-By: Claude Opus 4.6 <[email protected]>

- Add Low (blue) and Info (informational) badges to the severity badge
  row in PR summary comments
- Add info emoji and label support for findings table
- Update severityCounts to include Info field
- Update countBySeverity to count "info" severity findings
- Update status badge condition to include Info count
- Found 1 existing INFO rule: maintainer_deprecated.py (Docker)

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Co-Authored-By: Claude Opus 4.6 <[email protected]>