Skip to content

PR5: Quality/security receipt adapters — Impeccable + Trail of Bits/SARIF #233

Description

@rhein1

Child of #229.

Add optional evaluation adapters that convert design/security findings into the shared Harness local receipt evidence model.

Scope:

  • Impeccable design findings adapter for frontend/UI work.
  • Generic SARIF/security findings adapter suitable for Trail of Bits workflows and other scanners.
  • Shared evaluation section on local receipts: producer/version, commit/input hash, findings by severity, evidence refs, suppressions, configured gate, result.
  • Objective configured failures may block deploy/listing-readiness; advisory findings must remain distinguishable.
  • Never claim certification, endorsement, or vulnerability absence.
  • Respect upstream licenses; do not copy CC BY-SA skill text into MIT/Apache packages without a documented licensing decision.

Acceptance:

  • deterministic fixtures for pass/fail/review states
  • receipts retain scanner identity/version and analyzed revision
  • suppressed findings remain visible in evidence
  • docs clearly describe external-tool invocation and licensing boundaries.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions