(tooling-agents) branch main updated: Notate what severity threshold was applied

[ak...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

andrewmusselman pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tooling-agents.git


The following commit(s) were added to refs/heads/main by this push:
     new 98d9411  Notate what severity threshold was applied
98d9411 is described below

commit 98d9411969a1f45b252c056637a36bd80c772750
Author: Andrew Musselman <an...@gmail.com>
AuthorDate: Tue Apr 21 01:26:07 2026 -0700

    Notate what severity threshold was applied
---
 repos/apache/ASVS/README.md                                    |  5 +++--
 .../ASVS/agents/consolidate_asvs_security_audit_reports.py     | 10 ++++++++--
 repos/apache/ASVS/agents/orchestrate_asvs_audit_to_github.py   |  1 +
 3 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/repos/apache/ASVS/README.md b/repos/apache/ASVS/README.md
index 47e9a31..6164c11 100644
--- a/repos/apache/ASVS/README.md
+++ b/repos/apache/ASVS/README.md
@@ -95,7 +95,7 @@ The main entry point. Calls all other agents.
 | `outputToken` | yes | PAT with write access to output repo |
 | `outputDirectory` | yes | Base directory — repo name and commit hash are appended automatically |
 | `discover` | no | `"true"` or `"false"` (default `"true"`) |
-| `level` | no | `"L1"`, `"L2"`, or `"L3"` |
+| `level` | no | `"L1"`, `"L2"`, or `"L3"` (default `"L3"` — use `"L1"` for a quick baseline audit) |
 | `severityThreshold` | no | `"CRITICAL"`, `"HIGH"`, `"MEDIUM"`, or empty |
 | `consolidate` | no | `"true"` or `"false"` (default `"true"`) |
 
@@ -169,7 +169,8 @@ Reads per-section reports from GitHub, deduplicates, produces consolidated repor
 |---|---|---|
 | `inputText` | yes | Multi-line: `repo:`, `pat:`, `directories:`, `output:` |
 | `domainGroups` | no | JSON string mapping domain names to ASVS section arrays |
-| `level` | no | `"L1"`, `"L2"`, or `"L3"` (default `"L3"`) |
+| `level` | no | `"L1"`, `"L2"`, or `"L3"` (default `"L3"` — use `"L1"` for a quick baseline audit) |
+| `severityThreshold` | no | Included in report metadata when provided |
 
 **Output:** `outputText` — summary. Pushes `consolidated.md` and `issues.md` to GitHub.
 
diff --git a/repos/apache/ASVS/agents/consolidate_asvs_security_audit_reports.py b/repos/apache/ASVS/agents/consolidate_asvs_security_audit_reports.py
index c54c76d..465c095 100644
--- a/repos/apache/ASVS/agents/consolidate_asvs_security_audit_reports.py
+++ b/repos/apache/ASVS/agents/consolidate_asvs_security_audit_reports.py
@@ -1,5 +1,4 @@
 # consolidate_asvs_security_audit_reports
-
 from agent_factory.remote_mcp_client import RemoteMCPClient
 from services.llm_service import call_llm
 import httpx
@@ -43,6 +42,7 @@ async def run(input_dict, tools):
         input_text = input_dict.get("inputText", "")
         domain_groups_raw = input_dict.get("domainGroups", "")
         level = input_dict.get("level", "L3")
+        severity_threshold = input_dict.get("severityThreshold", "")
 
         # Normalize level
         level = level.strip().upper()
@@ -796,13 +796,17 @@ If no duplicates: {"merges": []}"""
 
         # Executive summary (Opus)
         print(f"Generating executive summary...")
+        severity_scope = f"Severity threshold: {severity_threshold} and above" if severity_threshold else "Severity threshold: none (all findings included)"
+
         exec_summary_prompt = f"""Generate the opening sections of a security audit consolidated report in Markdown.
 
 Audit scope: up to {level}
+{severity_scope}
 
 Repository: {owner}/{repo}
 Directories: {', '.join(directories)}
 ASVS Level: {level}
+{severity_scope}
 Commit: {commit_info}
 Date: {audit_date}
 Auditor: Tooling Agents
@@ -821,7 +825,7 @@ Finding titles:
 Positive controls: {json.dumps(all_positive_controls[:50], indent=2, default=str)}
 
 Generate ONLY:
-1. Report Metadata table (Repository, ASVS Level, Commit, Date, Auditor, Source Reports, Total Findings)
+1. Report Metadata table (Repository, ASVS Level, Severity Threshold, Commit, Date, Auditor, Source Reports, Total Findings)
 2. Executive Summary with severity distribution, level coverage, top 5 risks, positive controls
 
 End with ---."""
@@ -873,6 +877,8 @@ End with ---."""
 
         # Section 7: Level Coverage (deterministic)
         s7 = ["\n\n## 7. Level Coverage Analysis\n", f"\n**Audit scope:** up to {level}\n"]
+        if severity_threshold:
+            s7.append(f"**Severity threshold:** {severity_threshold} and above\n")
         s7.append("| Level | Sections Audited | Findings Found |")
         s7.append("|-------|-----------------|----------------|")
         for lv_name, lv_num in [("L1", 1), ("L2", 2), ("L3", 3)]:
diff --git a/repos/apache/ASVS/agents/orchestrate_asvs_audit_to_github.py b/repos/apache/ASVS/agents/orchestrate_asvs_audit_to_github.py
index d439e44..5c5d1ff 100644
--- a/repos/apache/ASVS/agents/orchestrate_asvs_audit_to_github.py
+++ b/repos/apache/ASVS/agents/orchestrate_asvs_audit_to_github.py
@@ -288,6 +288,7 @@ async def run(input_dict, tools):
                             ]),
                             "domainGroups": json.dumps(domain_groups),
                             "level": level or "L3",
+                            "severityThreshold": severity_threshold,
                         }
                     )
                     print(f"  Consolidation done", flush=True)


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org