diff --git a/.github/release-notes.md b/.github/release-notes.md index 70f1699ab7..53ec4cd7dc 100644 --- a/.github/release-notes.md +++ b/.github/release-notes.md @@ -1,15 +1,13 @@ - + ## Highlights -Codex Security 0.7.0 adds optional post-scan validation and improves Deep Scan recovery, usage reporting, and saved results. Review the upgrade notes for changes to external imports, hosted verification, and direct helper integrations. +Codex Security 0.8.0 adds OpenGrep report imports and changes how scan results record scope and review details. -- **Post-scan validation.** Add `--validate` to run a supplemental validation pass after a scan and save a separate `validation.md` report. This pass makes additional model calls, leaves the saved findings and `--fail-on-severity` decision unchanged, and cannot be combined with `--max-cost`, a configured cost cap, `--dry-run`, or `--mock`. See [validation options](https://github.com/openai/codex-security/blob/npm-v0.7.0/sdk/typescript/docs/cli.md#follow-up-finding-validation). -- **Deep Scan recovery.** Deadline recovery retains unfinished checkpoints and worker coverage, retries keep selected results stable, and the CLI waits for the coordinator to finish before returning. Scan finalization preserves findings and honors project budgets. -- **Clearer usage and progress.** Scan output distinguishes file inventory from review progress and reports usage timestamps and account allowance. Large usage receipts, policy files, checkpoints, failure diagnostics, and reviewed feedback are retained. -- **Owner reports and saved results.** Scan owner reports are finalized without an extra model call. Saved findings remain consistent through recovery, SARIF exports retain run warnings, and report rendering preserves literal source paths and text. +- **OpenGrep imports.** Import a native JSON or gzip-compressed report into the local workbench or publish it to Cloud with `publish findings --provider opengrep`. Supply `--source-repository-url` and enable external imports with `CODEX_SECURITY_ENABLE_EXTERNAL_IMPORTS=1`. Imported findings retain their scanner evidence and start as unassessed. See the [OpenGrep guide](https://github.com/openai/codex-security/blob/npm-v0.8.0/docs/scanner-imports/opengrep.md). +- **Scan recovery.** Resume an interrupted Deep Scan after clearing its additional instructions. Read a completed Workbench scan’s saved artifacts even after moving or removing the original checkout. @@ -17,24 +15,7 @@ Codex Security 0.7.0 adds optional post-scan validation and improves Deep Scan r ## Upgrade notes -- **External imports require opt-in.** Set `CODEX_SECURITY_ENABLE_EXTERNAL_IMPORTS=1` before using `publish findings`, `findings imported`, `import github-advisories`, or the corresponding SDK operations. Only the literal value `1` enables these features. SDK callers that supply `dependencies.environment` must include the flag there. Previously imported records are retained. See [external import setup](https://github.com/openai/codex-security/blob/npm-v0.7.0/sdk/typescript/docs/cli.md#import-vendor-findings-locally). -- **Hosted verification uses the CLI verdict contract.** Remove imports of `FindingVerificationCheck` and replace reads of `verification.checks` with `verification.status` and `verification.evidence`. The original executor report, when supplied, remains available in `execution.finalResponse`. Update custom executors to return the matching finding `id`, a status of `fixed`, `still_vulnerable`, or `inconclusive`, and nonempty evidence. See [the hosted remediation contract](https://github.com/openai/codex-security/blob/npm-v0.7.0/sdk/typescript/docs/hosted-remediation.md). -- **Direct inventory helper calls move to Node.** Integrations that invoke the removed Python inventory and ranking scripts must use the bundled launcher and its `--helper` commands below. SDK and MCP callers use the new implementation automatically; the inventory and ranking artifact formats are unchanged. -- **Committed-diff scans require a clean, full checkout.** Check out the requested head revision and commit or stash local changes before running a committed-diff scan, including with `--validate`. A mismatched checkout or local changes now fail before scanning. See [scan options](https://github.com/openai/codex-security/blob/npm-v0.7.0/sdk/typescript/docs/cli.md#scan-options-and-output). - -
-Direct helper migration - -Use `launch_codex_security_mcp` from the bundled plugin's `scripts` directory, or `launch_codex_security_mcp.cmd` on Windows, with the existing arguments after the helper name: - -| Removed Python invocation | Launcher arguments | -| --- | --- | -| `generate_in_scope_files.py` | `--helper generate-in-scope-files` | -| `generate_rank_input.py make-repo-scope-input` | `--helper make-repo-scope-input` | -| `generate_rank_input.py make-diff-rank-input` | `--helper make-diff-rank-input` | - -The removed `rank_preview.py` implementation is incorporated into these helpers. See [diff helper examples and Windows quoting](https://github.com/openai/codex-security/blob/npm-v0.7.0/plugins/codex-security/skills/security-scan/references/scan-artifacts-and-ledger.md). - -
+- **SDK and JSON consumers.** Replace reads of `ScanResult.coverage` or the serialized `coverage` field with `review` for comparison exclusions. Read scan mode and scope from `manifest.scan`. Integrations that write drafts should put reviewed surfaces, unfinished work, and open questions in `reviewState`. +- **Saved files and GitHub Actions.** New scans no longer write `coverage.json`. Replace `ScanResult.coveragePath` with `manifestPath` and read `scan.review` in `scan-manifest.json`. Workflows that read the Action’s `coverage-path` output should switch to `manifest-path`. The legacy output is empty for current scans. Existing saved scans remain readable. See [Action outputs](https://github.com/openai/codex-security/blob/npm-v0.8.0/github-action/README.md#outputs). diff --git a/.github/release-pr-state.json b/.github/release-pr-state.json index 9d90c2befb..82eb280936 100644 --- a/.github/release-pr-state.json +++ b/.github/release-pr-state.json @@ -1,14 +1,14 @@ { - "baseVersion": "0.6.0", - "baseCommit": "13dcc6fec00aaf4c23a6fa7e375ccc1726b22836", + "baseVersion": "0.7.0", + "baseCommit": "f05a0b096cc881242ddf34a4d6b3ce0f322f3cf9", "sections": { "highlights": { - "generatedHash": "633ebab121430c0d4a78f5efcaf5c6b52f03a09b7ad0da880c6db84cc147c7bd", - "humanOwned": true + "generatedHash": "224dbb6af33c8755c91d742f64872e8b9aa18dac218ed0fca3f1bcaec5957e07", + "humanOwned": false }, "upgrades": { - "generatedHash": "f6f5552982b8aa1de02ec69316fa9bf4c68fa2d858087a31e5e8f21311cec57a", - "humanOwned": true + "generatedHash": "dba3f33340a5a700d43c6f01b1f3d795b9a3a750328b8040a36965b7e76c6827", + "humanOwned": false } } } diff --git a/examples/github-actions/codex-security.yml b/examples/github-actions/codex-security.yml index e406f2a31e..3f5a37ab22 100644 --- a/examples/github-actions/codex-security.yml +++ b/examples/github-actions/codex-security.yml @@ -32,7 +32,7 @@ jobs: security-events: write actions: read env: - CODEX_SECURITY_VERSION: "0.7.0" + CODEX_SECURITY_VERSION: "0.8.0" BEDROCK_MODEL_ID: ${{ vars.BEDROCK_MODEL_ID }} # Report-only by default. Set to "high" to fail on high/critical findings. FAIL_ON_SEVERITY: "" diff --git a/github-action/package-lock.json b/github-action/package-lock.json index c5f29d17d2..fdc96e0e4c 100644 --- a/github-action/package-lock.json +++ b/github-action/package-lock.json @@ -1,12 +1,12 @@ { "name": "codex-security-action", - "version": "0.7.0", + "version": "0.8.0", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "codex-security-action", - "version": "0.7.0", + "version": "0.8.0", "dependencies": { "@actions/artifact": "6.3.1", "@actions/core": "3.0.1", diff --git a/github-action/package.json b/github-action/package.json index 54200ad54f..87f0c8de41 100644 --- a/github-action/package.json +++ b/github-action/package.json @@ -1,6 +1,6 @@ { "name": "codex-security-action", - "version": "0.7.0", + "version": "0.8.0", "private": true, "type": "module", "description": "Run Codex Security in GitHub Actions with explicit scope, budgets, and scan health reporting", diff --git a/sdk/typescript/package.json b/sdk/typescript/package.json index c9bb3bd4be..e42715c335 100644 --- a/sdk/typescript/package.json +++ b/sdk/typescript/package.json @@ -1,6 +1,6 @@ { "name": "@openai/codex-security", - "version": "0.7.0", + "version": "0.8.0", "description": "TypeScript SDK and CLI for Codex Security", "license": "Apache-2.0", "author": "OpenAI",