feat: add reviewedBy and reviewedOn to suppression details [IGNR-2204] by adisatop · Pull Request #660 · snyk/go-application-framework

adisatop · 2026-07-20T10:17:02Z

Description

Adds optional reviewedBy and reviewedOn fields to the suppression details of
the local finding model, so consumers (CLI, IDE, MCP) can see who reviewed an
ignore and when — not just who requested it (ignoredBy / ignoredOn).

Snyk ignores go through a review lifecycle (pending / approved / rejected).
Upstream SARIF (code-client-go SuppressionProperties) already exposes
ReviewedOn and ReviewedBy, but GAF was dropping them during transformation.

Changes:

Extend types.SuppressionDetails in the REST test spec with optional
reviewedOn and reviewedBy (both string) and regenerate local_models.
Map the new fields in mapSuppressions: reviewedOn passes through, and
reviewedBy is flattened from the SARIF Reviewer.Name (nil-safe).
Bump code-client-go to expose the reviewed suppression properties.
Add unit-test coverage for the reviewed fields in transform_test.go.

The fields are optional pointers (omitempty), so unreviewed ignores leave them
unset. This keeps the change additive and backwards compatible on the public API.

Checklist

Tests added and all succeed (make test)
Regenerated mocks, etc. (make generate)
Linted (make lint)
Test your changes work for the CLI
1. Clone / pull the latest CLI main.
2. Run go get github.com/snyk/go-application-framework@YOUR_LATEST_GAF_COMMIT in the cliv2 directory.
  - Tip: for local testing, you can uncomment the line near the bottom of the CLI's go.mod to point to your local GAF code.
3. Run go mod tidy in the cliv2 directory.
4. Run the CLI tests and do any required manual testing.
5. Open a PR in the CLI repo now with the go.mod and go.sum changes.
- Once this PR is merged, repeat these steps, but pointing to the latest GAF commit on main and update your CLI PR.

Note

Low Risk
Additive optional fields on suppression metadata and presentation only; no auth or scan logic changes. Dependency bumps are routine.

Overview
Adds optional reviewedOn and reviewedBy on suppression details so CLI, IDE, and MCP outputs can show who reviewed an ignore and when, alongside existing ignoredBy / ignoredOn request metadata.

The OpenAPI test spec and regenerated local_models gain TypesReviewer and the new suppression fields; SARIF → local finding mapping in mapSuppressions now preserves ReviewedOn and ReviewedBy from code-client-go (bumped to v1.29.0) instead of dropping them. Text and SARIF presenters emit the fields when present.

Tests cover transform mapping and presenter output for component text and SARIF JSON. Fields are optional (omitempty), so behavior stays backward compatible when review data is absent.

^{Reviewed by Cursor Bugbot for commit 09af3d4. Bugbot is set up for automated code reviews on this repo. Configure here.}

snyk-io · 2026-07-20T10:17:18Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

snyk-io · 2026-07-20T10:17:19Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues
✅	Secrets	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

cbill-s

We also need to update local_finding.sarif.tmpl for the changes to be written in the Sarif.

cbill-s · 2026-07-21T11:56:54Z

+   {{- if and .Attributes.Suppression.Details.ReviewedOn .Attributes.Suppression.Details.ReviewedBy }}
+   Reviewed on: {{ .Attributes.Suppression.Details.ReviewedOn }}
+   Reviewed by name : {{ .Attributes.Suppression.Details.ReviewedBy.Name }}
+   Reviewed by email: {{ .Attributes.Suppression.Details.ReviewedBy.Email }}


let's follow the same pattern as ignored - can we have something like this?

{{- if .Attributes.Suppression.Details.ReviewedOn }} Reviewed on: {{ .Attributes.Suppression.Details.ReviewedOn }} {{- end }} {{- if and .Attributes.Suppression.Details.ReviewedBy .Attributes.Suppression.Details.ReviewedBy.Name}} Reviewed by: {{ .Attributes.Suppression.Details.ReviewedBy.Name }} {{- end }}

I would suggest

{{- if .Attributes.Suppression.Details.ReviewedOn }} Reviewed on: {{ .Attributes.Suppression.Details.ReviewedOn }} {{- end }} {{- if .Attributes.Suppression.Details.ReviewedBy .Attributes.Suppression.Details.ReviewedBy.Name}} Reviewed by: {{ .Attributes.Suppression.Details.ReviewedBy.Name }} {{- end }}

the and does not bring anything in this case, if I am not mistaken

related https://github.com/snyk/go-application-framework/pull/660/changes#r3657815027

This reverts commit 1560fb6.

cursor · 2026-07-22T08:45:01Z

   Ignored on: {{ formatDatetime .Attributes.Suppression.Details.IgnoredOn "2006-01-02T15:04:05.999999999Z07:00" "January 02, 2006" }}
   Ignored by: {{ .Attributes.Suppression.Details.IgnoredBy.Name }}
+   {{- if .Attributes.Suppression.Details.ReviewedOn }}
+   Reviewed on: {{ .Attributes.Suppression.Details.ReviewedOn }}


ReviewedOn shown without datetime formatting

Low Severity

Reviewed on prints raw ReviewedOn, while Ignored on in the same block uses formatDatetime for a human-readable date. Review timestamps will appear as ISO strings in CLI output, inconsistent with neighboring suppression fields.

^{Reviewed by Cursor Bugbot for commit b977b26. Configure here.}

Question: @adisatop I think this is a reasonable comment. or am I missing a reason why the date format should not be presented consistently?

cbill-s · 2026-07-22T08:40:12Z

+      type: object
+      required:
+        - name
+


please remove the empty lines please

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0daff2b. Configure here.}

robertolopezlopez · 2026-07-23T14:18:05Z

 module github.com/snyk/go-application-framework

-go 1.26
+go 1.26.2


is this an intentional change?

yes, since bumped the code-client-go dep that using that version.

robertolopezlopez · 2026-07-23T14:19:28Z

please add table-driven validity tests for this

robertolopezlopez · 2026-07-23T14:20:52Z

+   Reviewed on: {{ .Attributes.Suppression.Details.ReviewedOn }}
+   {{- end }}
+   {{- if .Attributes.Suppression.Details.ReviewedBy }}
+   Reviewed by name: {{ .Attributes.Suppression.Details.ReviewedBy.Name }}


done, thanks.

Question: Should this really be Reviewed by name:? Or should it be something like Reviewed by: <Name> (<EMail>)

robertolopezlopez · 2026-07-23T14:21:42Z


   Expiration: {{- if .Attributes.Suppression.Details.Expiration }} {{ formatDatetime .Attributes.Suppression.Details.Expiration "2006-01-02T15:04:05.999999999Z07:00" "January 02, 2006" }} {{- else }} never {{- end }}
+   {{- if .Attributes.Suppression.Details.ReviewedOn }}
+   Reviewed on: {{ .Attributes.Suppression.Details.ReviewedOn }}


done. thanks.

robertolopezlopez

Hi @adisatop , please finish addressing the open threads (ok if you do not like the cursor suggested datetime formatting).

cbill-s · 2026-07-27T10:06:22Z

+									{{- end }}
+									{{- if and $finding.Attributes.Suppression.Details.ReviewedBy }}
+										"reviewedBy": {
+										"name": {{ getQuotedString $finding.Attributes.Suppression.Details.ReviewedBy.Name }}


add indent please on both name, email

done, thanks

cbill-s · 2026-07-27T10:09:15Z

 								"properties": {
 									"category": {{ getQuotedString $finding.Attributes.Suppression.Details.Category }},
 									{{- if $finding.Attributes.Suppression.Details.Expiration }}"expiration": "{{ $finding.Attributes.Suppression.Details.Expiration }}",{{- end }}
+									{{- if and $finding.Attributes.Suppression.Details.ReviewedOn }}


we can remove the and here I believe

agree, done

cbill-s · 2026-07-27T10:09:52Z

 										  "name": {{ getQuotedString $finding.Attributes.Suppression.Details.IgnoredBy.Name }},
 										  "email": {{ getQuotedString $finding.Attributes.Suppression.Details.IgnoredBy.Email }}
 									}
+


please remove empty line

Remove redundant single-argument `and` conditionals and normalize indentation/trailing whitespace in the reviewedBy/ignoredBy blocks of the SARIF template. No change to rendered output. Co-authored-by: Cursor <cursoragent@cursor.com>

snyk-pr-review-bot · 2026-07-27T10:24:19Z

PR Reviewer Guide 🔍

🧪 PR contains tests
🔒 No security concerns identified
⚡ Recommended focus areas for review Inconsistent Formatting 🟡 [minor] The newly added `reviewedOn` field is rendered raw in the CLI template, whereas existing date fields like `ignoredOn` and `expiration` (line 23 and 34) use the `formatDatetime` helper. This leads to inconsistent output for users where some dates are formatted (e.g., 'January 02, 2006') and others are printed as raw ISO strings. Reviewed on: {{ .Attributes.Suppression.Details.ReviewedOn }}
📚 Repository Context Analyzed This review considered 20 relevant code sections from 9 files (average relevance: 0.79) pkg/local_workflows/ignore_workflow/response.go (lines 1-51) pkg/utils/sarif/sarif.go (lines 1-248) pkg/local_workflows/local_models/types_rules_builder.go (lines 1-229) internal/local_findings/source/openapi/rest/rest/test.spec.yaml (2 segments, lines 860-1101) pkg/local_workflows/local_models/models.gen.go (4 segments, lines 1396-1574) pkg/local_workflows/ignore_workflow/config.go (lines 1-205) internal/local_findings/source/openapi/rest/test.spec.yaml (3 segments, lines 1602-1822) ... and 2 more file(s)
🤖 Repository instructions applied (from `AGENTS.md`)

PeterSchafer · 2026-07-27T13:51:38Z

Please open a CLI PR as well, to ensure that the changes integrate well.

PeterSchafer · 2026-07-27T14:01:14Z

 	github.com/rs/zerolog v1.34.0
 	github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06
-	github.com/snyk/code-client-go v1.24.5
+	github.com/snyk/code-client-go v1.29.0


Question: This is actually quite a bump. The CLI actually uses 1.27 but still there are some changes in where I wonder if this is tested enough snyk/code-client-go@v1.27.0...v1.29.0

adisatop requested review from a team as code owners July 20, 2026 10:17

adisatop marked this pull request as draft July 20, 2026 10:17

This comment has been minimized.

Sign in to view

feat: add reviewedBy and reviewedOn to suppression details [IGNR-2204]

def56d3

adisatop force-pushed the fix/IGNR-2204-bump-code-client-go branch from 70faf67 to def56d3 Compare July 20, 2026 13:14

adisatop changed the title ~~fix(deps): bump code-client-go to v1.29.0 [IGNR-2204]~~ feat: add reviewedBy and reviewedOn to suppression details [IGNR-2204] Jul 20, 2026

cbill-s reviewed Jul 20, 2026

View reviewed changes

Comment thread internal/local_findings/source/openapi/rest/test.spec.yaml Outdated

fix: added review information in to sarif template

6c8f333

adisatop requested a review from cbill-s July 20, 2026 14:39

fix: added reviewer details in finding component tmpl

d1290f0

cbill-s reviewed Jul 21, 2026

View reviewed changes

Comment thread internal/local_findings/source/openapi/rest/test.spec.yaml Outdated

Comment thread internal/local_findings/source/openapi/rest/test.spec.yaml Outdated

cbill-s reviewed Jul 21, 2026

View reviewed changes

fix: address pr comment

1560fb6

adisatop requested a review from cbill-s July 21, 2026 13:06

adisatop added 2 commits July 21, 2026 16:19

Revert "fix: address pr comment"

9b21f21

This reverts commit 1560fb6.

fix: fix tests

b977b26

adisatop marked this pull request as ready for review July 22, 2026 08:42

This comment has been minimized.

Sign in to view

cursor Bot reviewed Jul 22, 2026

View reviewed changes

fix: extra closing brace

7772a57

cbill-s reviewed Jul 22, 2026

View reviewed changes

cursor Bot reviewed Jul 22, 2026

View reviewed changes

Comment thread pkg/local_workflows/local_models/models.gen.go

This comment has been minimized.

Sign in to view

robertolopezlopez reviewed Jul 22, 2026

View reviewed changes

Comment thread internal/presenters/templates/finding.component.tmpl Outdated

fix: fix pr comments

0daff2b

adisatop requested review from cbill-s and robertolopezlopez July 23, 2026 10:38

cursor Bot reviewed Jul 23, 2026

View reviewed changes

Comment thread internal/presenters/templates/local_finding.sarif.tmpl

fix: fix invalid json

97ea46b

This comment has been minimized.

Sign in to view

snyk deleted a comment from snyk-pr-review-bot Bot Jul 23, 2026

robertolopezlopez reviewed Jul 23, 2026

View reviewed changes

robertolopezlopez requested changes Jul 23, 2026

View reviewed changes

fix: added tests

d2f42b4

This comment has been minimized.

Sign in to view

adisatop requested a review from robertolopezlopez July 26, 2026 09:29

cbill-s reviewed Jul 27, 2026

View reviewed changes

PeterSchafer reviewed Jul 27, 2026

View reviewed changes

adisatop requested a review from cbill-s July 27, 2026 14:35

Uh oh!

Conversation

adisatop commented Jul 20, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Checklist

Uh oh!

snyk-io Bot commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

snyk-io Bot commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

This comment has been minimized.

cbill-s left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This comment has been minimized.

Uh oh!

Uh oh!

cursor Bot Jul 22, 2026

Choose a reason for hiding this comment

ReviewedOn shown without datetime formatting

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cbill-s Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This comment has been minimized.

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This comment has been minimized.

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

robertolopezlopez left a comment

Choose a reason for hiding this comment

Uh oh!

This comment has been minimized.

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

adisatop commented Jul 20, 2026 •

edited by cursor Bot

Loading

snyk-io Bot commented Jul 20, 2026 •

edited

Loading

snyk-io Bot commented Jul 20, 2026 •

edited

Loading

cbill-s Jul 22, 2026 •

edited

Loading