[mldangelo-oai]

Summary

This carries forward the original contribution from #2606, which conflicts with current main. The original commit is in this branch’s history. The CLI imports a saved ArmorCode SAST report into the local workbench.

Changes

• Keep both the updated Wiz import and the ArmorCode reader, add the compiled reader to the SDK package allowlist, and format the new schema-guide table row.
• Check each retained ArmorCode repository URL against the selected destination. For SAST rows that omit a URL, the existing --source-repository-url option can supply the verified repository for the report. The original scanner record remains available as evidence.
• Update the guide to preview and import the same file and describe the verified local workflow.

Testing

I used the built CLI to import two synthetic SAST findings, read back both records, replay the report without duplicates, and update one record in place. On the repository-matching fix, the CLI rejected a mixed-repository report before writing. A SAST row missing its URL imported with an explicit, matching source URL. The focused tests cover local preparation and Cloud preparation with injected responses. The SDK build, type checks, formatting, and plugin compatibility checks passed.

Risk and rollout

The end-to-end test covered local imports. A mixed-repository report now fails destination validation, so export findings for one repository at a time. The hosted service was not exercised.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-11T18:50:29.723802Z	815e74a	New commits
🔒 Security Review	✅ Completed 2026-11-11T18:51:53.534431Z	815e74a	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8645c4a03f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[alandelong-oai]

Thanks for carrying this contribution forward. This owner-level merge-safety review of 8645c4a0 confirms the existing repository-binding finding. With checkout A selected, the built CLI stored a DAST row explicitly naming repository B under A; a row without scanType behaved the same way. An equivalent SAST row was correctly rejected. Synthetic Cloud previews also prepared those mismatched rows for destination A. The follow-up linked in that thread is separate from this reviewed head, which still needs the repository-binding fix.

Validation passed 575 maintained tests with two Windows-only skips, plus builds, type checks and formatting. Seven compiled CLI cases covered import/replay/update and the issue above; four Cloud-preview cases used injected responses, with no external requests or uploads. The package contract passed after restoring declared launcher modes in an identical-content staging archive; the original checkout modes blocked the unchanged archive check. No live ArmorCode or Cloud service was exercised.

[mldangelo-oai]

Thanks for checking the DAST and missing-scanType cases, @alandelong-oai. I added the repository-matching fix to this PR in 815e74af and reran both cases. Each mixed import exited before writing. Workbench readback showed only the preexisting record at its original version. Both cases also failed destination validation in the file and normalized Cloud-preview tests, with zero POSTs. Could you review this updated head?

[alandelong-oai]

Thanks for bringing the repository-binding fix into this PR. This owner-level merge-safety re-review of 815e74af found no blocking issues. Retained repository claims now participate in local and Cloud destination checks independently of scan type. The compiled CLI rejected mixed DAST, SCA and untyped reports without changing existing records, and a matching explicit source successfully supplied a missing SAST repository.

Validation: 612 focused tests passed with two Windows-only skips, plus builds, type checks and formatting. All 13 compiled CLI scenarios and 16 file/normalized Cloud previews passed; previews used injected responses and made no POSTs. No live ArmorCode or Cloud service was exercised. The package contract passed after restoring declared launcher modes in an identical-content staging archive.