feat(cli): 설정 기반 finding suppression 추가

config suppressions를 finding id와 filePrefix 기준으로 적용하고 suppressedByConfig summary를 노출합니다.

Closes #81

Author: JeremyDev87

crates/maximus-checks/src/registry.rs

@@ -1,13 +1,14 @@
-use std::collections::HashSet;
+use std::collections::{BTreeSet, HashSet};
 use std::fs;
 use std::io;
 use std::path::{Path, PathBuf};
 
+use maximus_core::config::ConfigSuppression;
+use maximus_core::findings::summarize_findings_with_suppressed_by_config;
 use maximus_core::{
     discover_project, discover_project_with_ignore_root, parse_jsonc, read_text_if_exists,
-    sort_findings, summarize_findings, unique_fixes, AuditResult, CheckFilterConfig,
-    ConfigSeverity, MaximusConfig, PlannedFix, ProjectDirectory, ProjectFile, ProjectSnapshot,
-    Severity,
+    sort_findings, unique_fixes, AuditResult, CheckFilterConfig, ConfigSeverity, MaximusConfig,
+    PlannedFix, ProjectDirectory, ProjectFile, ProjectSnapshot, Severity,
 };
 use serde_json::{Map, Value};
 
@@ -173,9 +174,20 @@ pub fn audit_project_with_config_root(
     };
     let mut outcome = run_registered_checks_with_config_root(&project, config, ignore_root)?;
     apply_severity_overrides(&mut outcome.findings, &config.severity);
+    let suppressed_by_config = apply_config_suppressions(
+        &mut outcome,
+        &config.suppressions,
+        &project.root_dir,
+        ignore_root,
+    );
     outcome.findings = sort_findings(&outcome.findings);
     let structure = build_structure_report(&project, &outcome.findings);
-    let summary = summarize_findings(&outcome.findings, &outcome.fixes, &structure);
+    let summary = summarize_findings_with_suppressed_by_config(
+        &outcome.findings,
+        &outcome.fixes,
+        &structure,
+        suppressed_by_config,
+    );
     let result = AuditResult {
         root_dir: project.root_dir.clone(),
         summary,
@@ -524,6 +536,130 @@ fn run_editorconfig_prettier_check_registered(
     run_editorconfig_prettier_check_with_ignore_root(project, &ignored_patterns, ignore_root)
 }
 
+fn apply_config_suppressions(
+    outcome: &mut CheckOutcome,
+    suppressions: &[ConfigSuppression],
+    root_dir: &Path,
+    ignore_root: &Path,
+) -> usize {
+    if suppressions.is_empty() || outcome.findings.is_empty() {
+        return 0;
+    }
+
+    let original_count = outcome.findings.len();
+    outcome
+        .findings
+        .retain(|finding| !is_suppressed_by_config(finding, suppressions, root_dir, ignore_root));
+    let suppressed_count = original_count - outcome.findings.len();
+
+    if suppressed_count > 0 {
+        let active_fix_ids = outcome
+            .findings
+            .iter()
+            .flat_map(|finding| finding.fix_ids.iter().cloned())
+            .collect::<BTreeSet<_>>();
+        outcome.fixes.retain(|fix| active_fix_ids.contains(&fix.id));
+        outcome
+            .planned_fixes
+            .retain(|fix| active_fix_ids.contains(&fix.public.id));
+    }
+
+    suppressed_count
+}
+
+fn is_suppressed_by_config(
+    finding: &maximus_core::Finding,
+    suppressions: &[ConfigSuppression],
+    root_dir: &Path,
+    ignore_root: &Path,
+) -> bool {
+    suppressions.iter().any(|suppression| {
+        suppression.id == finding.id
+            && suppression_file_matches(finding, suppression, root_dir, ignore_root)
+    })
+}
+
+fn suppression_file_matches(
+    finding: &maximus_core::Finding,
+    suppression: &ConfigSuppression,
+    root_dir: &Path,
+    ignore_root: &Path,
+) -> bool {
+    let Some(prefix) = suppression
+        .file_prefix
+        .as_deref()
+        .and_then(normalize_file_prefix)
+    else {
+        return true;
+    };
+    let Some(file) = finding.file.as_ref() else {
+        return false;
+    };
+
+    finding_file_candidates(file, &[root_dir, ignore_root])
+        .iter()
+        .any(|candidate| path_matches_prefix(candidate, &prefix))
+}
+
+fn finding_file_candidates(file: &Path, roots: &[&Path]) -> Vec<String> {
+    let mut candidates = vec![path_to_slash_string(file)];
+    if let Ok(canonical_file) = fs::canonicalize(file) {
+        push_unique_candidate(&mut candidates, path_to_slash_string(&canonical_file));
+    }
+
+    for root in roots {
+        push_relative_candidate(&mut candidates, file, root);
+    }
+
+    candidates
+}
+
+fn push_relative_candidate(candidates: &mut Vec<String>, file: &Path, root: &Path) {
+    if let Ok(relative) = file.strip_prefix(root) {
+        push_unique_candidate(candidates, path_to_slash_string(relative));
+    }
+
+    if let (Ok(canonical_file), Ok(canonical_root)) =
+        (fs::canonicalize(file), fs::canonicalize(root))
+    {
+        if let Ok(relative) = canonical_file.strip_prefix(canonical_root) {
+            push_unique_candidate(candidates, path_to_slash_string(relative));
+        }
+    }
+}
+
+fn push_unique_candidate(candidates: &mut Vec<String>, candidate: String) {
+    if !candidates.contains(&candidate) {
+        candidates.push(candidate);
+    }
+}
+
+fn normalize_file_prefix(value: &str) -> Option<String> {
+    let normalized = value
+        .trim()
+        .replace('\\', "/")
+        .trim_start_matches("./")
+        .trim_end_matches('/')
+        .to_string();
+
+    if normalized.is_empty() {
+        None
+    } else {
+        Some(normalized)
+    }
+}
+
+fn path_matches_prefix(path: &str, prefix: &str) -> bool {
+    path == prefix
+        || path
+            .strip_prefix(prefix)
+            .is_some_and(|suffix| suffix.starts_with('/'))
+}
+
+fn path_to_slash_string(path: &Path) -> String {
+    path.to_string_lossy().replace('\\', "/")
+}
+
 fn apply_severity_overrides(
     findings: &mut [maximus_core::Finding],
     overrides: &std::collections::BTreeMap<String, ConfigSeverity>,

crates/maximus-cli/src/exit_codes.rs

@@ -34,6 +34,7 @@ mod tests {
             info_findings: 0,
             fixable_findings: 0,
             fixes_available: 0,
+            suppressed_by_config: 0,
             config_files: 1,
             package_count: 1,
             env_directories: 0,

crates/maximus-cli/src/fail_policy.rs

@@ -37,6 +37,7 @@ mod tests {
             info_findings: 1,
             fixable_findings: 0,
             fixes_available: 0,
+            suppressed_by_config: 0,
             config_files: 1,
             package_count: 1,
             env_directories: 0,

crates/maximus-cli/src/main.rs

@@ -357,6 +357,7 @@ fn resolve_effective_config(
         config.ignore = scope_ignore_patterns(&config.ignore, &config_root, &ignore_root)?;
         config.ignore_patterns =
             scope_ignore_patterns(&config.ignore_patterns, &config_root, &ignore_root)?;
+        scope_suppression_file_prefixes(&mut config.suppressions, &config_root, &ignore_root);
     }
     let mut ignore_file_patterns = load_ignore_file_pattern_sources(&ignore_root, target_dir)?;
     if !ignore_file_patterns.maximusignore.is_empty() {
@@ -393,6 +394,69 @@ fn resolve_effective_config(
     })
 }
 
+fn scope_suppression_file_prefixes(
+    suppressions: &mut [maximus_core::config::ConfigSuppression],
+    config_root: &std::path::Path,
+    ignore_root: &std::path::Path,
+) {
+    for suppression in suppressions {
+        if let Some(file_prefix) = suppression.file_prefix.as_mut() {
+            *file_prefix = scope_suppression_file_prefix(file_prefix, config_root, ignore_root);
+        }
+    }
+}
+
+fn scope_suppression_file_prefix(
+    value: &str,
+    config_root: &std::path::Path,
+    ignore_root: &std::path::Path,
+) -> String {
+    let normalized = normalize_suppression_file_prefix(value);
+    if normalized.is_empty() || std::path::Path::new(&normalized).is_absolute() {
+        return normalized;
+    }
+
+    let config_relative_path = config_root.join(&normalized);
+    relative_path_from_root(&config_relative_path, ignore_root).unwrap_or(normalized)
+}
+
+fn normalize_suppression_file_prefix(value: &str) -> String {
+    value
+        .trim()
+        .replace('\\', "/")
+        .trim_start_matches("./")
+        .trim_end_matches('/')
+        .to_string()
+}
+
+fn relative_path_from_root(path: &std::path::Path, root: &std::path::Path) -> Option<String> {
+    if let Ok(relative) = path.strip_prefix(root) {
+        return Some(path_to_slash_string(relative));
+    }
+
+    if let (Ok(absolute_path), Ok(absolute_root)) =
+        (std::path::absolute(path), std::path::absolute(root))
+    {
+        if let Ok(relative) = absolute_path.strip_prefix(absolute_root) {
+            return Some(path_to_slash_string(relative));
+        }
+    }
+
+    if let (Ok(canonical_path), Ok(canonical_root)) =
+        (std::fs::canonicalize(path), std::fs::canonicalize(root))
+    {
+        if let Ok(relative) = canonical_path.strip_prefix(canonical_root) {
+            return Some(path_to_slash_string(relative));
+        }
+    }
+
+    None
+}
+
+fn path_to_slash_string(path: &std::path::Path) -> String {
+    path.to_string_lossy().replace('\\', "/")
+}
+
 fn effective_fail_on_level(config: &MaximusConfig) -> FailOnLevel {
     config.report.fail_on.clone().unwrap_or_default()
 }

crates/maximus-cli/src/report_json.rs

@@ -116,6 +116,7 @@ mod tests {
         assert_eq!(value["generator"], "maximus");
         assert_eq!(value["rootDir"], "/tmp/project");
         assert_eq!(value["summary"]["blockingFindings"], 0);
+        assert_eq!(value["summary"]["suppressedByConfig"], 0);
         assert_eq!(value["structure"]["configFiles"], 1);
         assert!(value["findings"].as_array().is_some());
     }
@@ -206,6 +207,7 @@ mod tests {
                 info_findings: 0,
                 fixable_findings: 0,
                 fixes_available: 0,
+                suppressed_by_config: 0,
                 config_files: 1,
                 package_count: 1,
                 env_directories: 0,

crates/maximus-cli/src/report_markdown.rs

@@ -16,11 +16,14 @@ pub fn format_audit_report(result: &AuditResult) -> String {
             result.summary.warning_findings,
             result.summary.info_findings
         ),
+    ];
+    push_suppression_summary(&mut lines, result.summary.suppressed_by_config);
+    lines.extend([
         format!("- Fixes available: `{}`", result.summary.fixes_available),
         String::new(),
         "## Structure".to_string(),
         format!("{}.", describe_structure(&result.structure)),
-    ];
+    ]);
 
     if result.findings.is_empty() {
         lines.push(String::new());
@@ -49,10 +52,13 @@ pub fn format_doctor_report(result: &AuditResult) -> String {
         String::new(),
         format!("- Target: `{}`", display_path(&result.root_dir)),
         format!("- Diagnosis: `{}`", result.summary.status),
+    ];
+    push_suppression_summary(&mut lines, result.summary.suppressed_by_config);
+    lines.extend([
         format!("- Project shape: {}", describe_structure(&result.structure)),
         String::new(),
         "## Prescription".to_string(),
-    ];
+    ]);
 
     let manual_findings = result
         .findings
@@ -176,6 +182,7 @@ pub fn format_fix_result(
         final_result.summary.warning_findings,
         final_result.summary.info_findings
     ));
+    push_suppression_summary(&mut lines, final_result.summary.suppressed_by_config);
 
     if final_result.findings.is_empty() {
         lines.push(String::new());
@@ -251,6 +258,12 @@ fn format_findings(result: &AuditResult) -> Vec<String> {
     lines
 }
 
+fn push_suppression_summary(lines: &mut Vec<String>, suppressed_by_config: usize) {
+    if suppressed_by_config > 0 {
+        lines.push(format!("- Suppressed by config: `{suppressed_by_config}`"));
+    }
+}
+
 fn describe_structure(structure: &StructureReport) -> String {
     let repo_type = if structure.is_monorepo {
         "monorepo"
@@ -363,6 +376,7 @@ mod tests {
                 info_findings: 2,
                 fixable_findings: 1,
                 fixes_available: 1,
+                suppressed_by_config: 0,
                 config_files: 2,
                 package_count: 1,
                 env_directories: 1,
@@ -438,6 +452,21 @@ mod tests {
         assert!(report.contains("+API_URL="));
     }
 
+    #[test]
+    fn markdown_reports_show_nonzero_suppressed_count() {
+        let root_dir = PathBuf::from("/tmp/project");
+        let mut result = sample_result(root_dir.clone());
+        result.summary.suppressed_by_config = 2;
+
+        let audit_report = format_audit_report(&result);
+        let doctor_report = format_doctor_report(&result);
+        let fix_report = format_fix_result(false, &root_dir, &result, &[], &result, None, None);
+
+        assert!(audit_report.contains("- Suppressed by config: `2`"));
+        assert!(doctor_report.contains("- Suppressed by config: `2`"));
+        assert!(fix_report.contains("- Suppressed by config: `2`"));
+    }
+
     fn sample_result(root_dir: PathBuf) -> AuditResult {
         AuditResult {
             root_dir,
@@ -449,6 +478,7 @@ mod tests {
                 info_findings: 0,
                 fixable_findings: 0,
                 fixes_available: 0,
+                suppressed_by_config: 0,
                 config_files: 1,
                 package_count: 1,
                 env_directories: 0,

crates/maximus-cli/src/report_sarif.rs

@@ -277,6 +277,7 @@ mod tests {
                 info_findings: 0,
                 fixable_findings: 0,
                 fixes_available: 0,
+                suppressed_by_config: 0,
                 config_files: 1,
                 package_count: 1,
                 env_directories: 0,
@@ -348,6 +349,7 @@ mod tests {
                 info_findings: 0,
                 fixable_findings: 0,
                 fixes_available: 0,
+                suppressed_by_config: 0,
                 config_files: 1,
                 package_count: 1,
                 env_directories: 0,