Debug/eng 3822 pr264 by sawez-deepsource · Pull Request #290 · DeepSourceCorp/cli

sawez-deepsource · 2026-04-28T08:28:13Z

No description provided.

…features

Move utility packages from root `utils/` and `configvalidator/` into organized `internal/` subdirectories: - utils/prompt.go → internal/cli/prompt/ - utils/colors.go → internal/cli/style/ - utils/cmd_validator.go → internal/cli/args/ - utils/fetch_oidc_token.go → internal/oidc/ - utils/remote_resolver.go → internal/vcs/ - utils/fetch_remote.go → internal/vcs/remotes.go - configvalidator/* → internal/configvalidator/ - utils/fetch_analyzers_transformers.go → internal/configdata/ Add shell completion support via internal/cli/completion package. Update all import paths across commands and services to reflect new structure. This improves code organization and follows Go's internal package conventions for better encapsulation.

- Add new `auth whoami` command to display authenticated user info - Add new `issues browse` command for opening issues in browser - Add GetViewer API method to fetch authenticated user details - Refactor output messages to use pterm.Print* instead of pterm.Info for consistency across auth, config, issues, and repo commands - Update dependencies (pterm, testify, bubbletea, lipgloss)

- Add `runs list` command to display analysis runs for a repository - Add `runs issues` command to show issues for a specific run - Add GetAnalysisRuns and GetRunIssues API methods to client - Add GraphQL schema and queries for runs and run issues - Refactor whoami command to use boxed output format - Remove issues browse command - Add runs domain types and query helpers

Update all Go dependencies to their latest versions including: - github.com/spf13/cobra: v1.5.0 → v1.10.2 - github.com/spf13/viper: v1.7.1 → v1.21.0 - github.com/getsentry/sentry-go: v0.6.0 → v0.41.0 - github.com/stretchr/testify: v1.8.4 → v1.11.1 - github.com/fatih/color: v1.12.0 → v1.18.0 - github.com/google/go-cmp: v0.5.5 → v0.6.0 Also includes improvements to issues display: - Add terminal width-aware table rendering with column wrapping - Improve issue location formatting (single line vs range) - Add color-coded severity formatting - Add JSON export capability for run issues with --json and --output-file flags

Add support for filtering issues by analyzer, category, severity, code, and path. Filters can be specified multiple times to match any of the provided values. New flags: - --analyzer: filter by analyzer shortcode - --category: filter by issue category - --severity: filter by severity level - --code: filter by issue code - --path: filter by file path (supports partial matching) Also refactor runs command to accept commit-oid argument and wire up issue flags via AddRunIssueFlags for better flag reusability.

- Replace Makefile with justfile, add VERSION file for version tracking - Replace goreleaser release pipeline with build-and-deploy workflow - Add install script template - Move version/ package to buildinfo/ - Swap DataDog/zstd (cgo) for klauspost/compress/zstd (pure Go) - Replace deprecated io/ioutil usage with os and io - Bump Go version to 1.25 in CI - Update SARIF schema URL to official OASIS source - Add TCP readiness check for mock server in tests - Update README with auth docs and current command list

- Drop config generate/validate commands and supporting packages - Drop issues list command and related services - Remove configvalidator, configdata, and issues service packages - Update root command registrations and dependencies - Clean up justfile test targets

- Add top-level issues, metrics, and vulnerabilities commands with SDK queries - Add transparent token refresh in GraphQL client (removes need for auth refresh) - Remove version, auth refresh, and auth whoami commands - Add UserError type to skip user-correctable errors from Sentry - Improve Sentry setup with panic recovery, release tagging - Add YAML output format and source filter for run issues - Auto-open browser on login instead of waiting for user input - Update GraphQL schema to use issues instead of occurrences - Use --version flag instead of version subcommand - Clean up error messages and stale code

- Rename `repo` to `repository` and `runs` to `analysis` - Rename `--run` flag to `--commit` across issues, metrics, and vulnerabilities - Update default hostname from deepsource.io to deepsource.com - Add `human` output format as new default, keep `table` as explicit option - Add `--output-file`, `--verbose`, `--analyzer` filter, and `--limit` flags - Remove legacy YAML config support and debug logging infrastructure - Add `GetEnabledAnalyzers` API endpoint and repository analyzers command - Fix report service using Errorf instead of Printf for info messages

- Rename "human" output format to "pretty" in issues, metrics, and vulnerabilities - Simplify issues table: remove boxed style, drop wrapText, conditionally show SOURCE column - Humanize displayed values (severity, status, reachability, ecosystem) - Add ECOSYSTEM column to vulnerabilities table - Use helper functions for formatting location, severity, and analyzer names

deepsource-io · 2026-04-28T08:30:19Z

DeepSource Code Review

We reviewed changes in 80132f2...c9a4c79 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

Important

Some issues found as part of this review are outside of the diff in this pull request and aren't shown in the inline review comments due to GitHub's API limitations. You can see those issues on the DeepSource dashboard.

PR Report Card

Overall Grade Focus Area: Hygiene	Security Reliability Complexity Hygiene

Feedback

Receiver and method shape consistency

Several reliability issues point at method receivers: unused receivers across adapters and mixed value/pointer receivers on CLIConfig.
These both touch how methods are attached to types, so it’s worth deciding a consistent pattern here; it reduces surprise for callers and makes future refactors safer.

Security config defaults

Both TLS issues and the Slowloris concern are about relying on default network settings.
Treating TLS/server config as “must be explicit” instead of “defaults are fine” would address these together whenever new HTTP clients/servers are added.

Code Review Summary

Analyzer	Updated (UTC)	Details
Go	Apr 28, 2026 8:31a.m.	Review ↗
Secrets	Apr 28, 2026 8:31a.m.	Review ↗
Code coverage	Apr 28, 2026 8:31a.m.	Review ↗

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

deepsource-io · 2026-04-28T08:35:33Z

+			sentry.CaptureException(err)
+		}
 		sentry.Flush(2 * time.Second)
 		os.Exit(1)


os.Exit will exit, and `defer func(){...}(...)` will not run

Calls to os.Exit or log.Fatal and friends made in function with defer
statements do not execute those statements if control reaches the
os.Exit or log.Fatal and friends.

deepsource-io · 2026-04-28T08:35:33Z

+		Use:   "analysis [flags]",
+		Short: "View analysis runs",
+		Long:  doc,
+		RunE: func(cmd *cobra.Command, args []string) error {


parameter 'args' seems to be unused, consider removing or renaming it as _

Unused parameters in functions or methods should be replaced with _
(underscore) or removed.

deepsource-io · 2026-04-28T08:35:33Z

+	cmd.Flags().IntVarP(&opts.LimitArg, "limit", "l", 20, "Number of analysis runs to fetch")
+	cmd.Flags().StringVar(&opts.commitOid, "commit", "", "Show metadata and issues summary for a specific commit")
+
+	_ = cmd.RegisterFlagCompletionFunc("repo", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {


parameter 'toComplete' seems to be unused, consider removing or renaming it as _

Unused parameters in functions or methods should be replaced with _
(underscore) or removed.

deepsource-io · 2026-04-28T08:35:33Z

+	cmd.Flags().IntVarP(&opts.LimitArg, "limit", "l", 20, "Number of analysis runs to fetch")
+	cmd.Flags().StringVar(&opts.commitOid, "commit", "", "Show metadata and issues summary for a specific commit")
+
+	_ = cmd.RegisterFlagCompletionFunc("repo", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {


parameter 'args' seems to be unused, consider removing or renaming it as _

Unused parameters in functions or methods should be replaced with _
(underscore) or removed.

deepsource-io · 2026-04-28T08:35:33Z

+	cmd.Flags().IntVarP(&opts.LimitArg, "limit", "l", 20, "Number of analysis runs to fetch")
+	cmd.Flags().StringVar(&opts.commitOid, "commit", "", "Show metadata and issues summary for a specific commit")
+
+	_ = cmd.RegisterFlagCompletionFunc("repo", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {


parameter 'cmd' seems to be unused, consider removing or renaming it as _

Unused parameters in functions or methods should be replaced with _
(underscore) or removed.

deepsource-io · 2026-04-28T08:35:34Z

+			"yaml\tYAML output",
+		}, cobra.ShellCompDirectiveNoFileComp
+	})
+	_ = cmd.RegisterFlagCompletionFunc("category", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {


parameter 'args' seems to be unused, consider removing or renaming it as _

Unused parameters in functions or methods should be replaced with _
(underscore) or removed.

deepsource-io · 2026-04-28T08:35:34Z

+			"yaml\tYAML output",
+		}, cobra.ShellCompDirectiveNoFileComp
+	})
+	_ = cmd.RegisterFlagCompletionFunc("category", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {


parameter 'toComplete' seems to be unused, consider removing or renaming it as _

Unused parameters in functions or methods should be replaced with _
(underscore) or removed.

deepsource-io · 2026-04-28T08:35:34Z

+			"documentation",
+		}, cobra.ShellCompDirectiveNoFileComp
+	})
+	_ = cmd.RegisterFlagCompletionFunc("severity", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {


parameter 'args' seems to be unused, consider removing or renaming it as _

Unused parameters in functions or methods should be replaced with _
(underscore) or removed.

deepsource-io · 2026-04-28T08:35:34Z

+			"documentation",
+		}, cobra.ShellCompDirectiveNoFileComp
+	})
+	_ = cmd.RegisterFlagCompletionFunc("severity", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {


parameter 'toComplete' seems to be unused, consider removing or renaming it as _

Unused parameters in functions or methods should be replaced with _
(underscore) or removed.

deepsource-io · 2026-04-28T08:35:34Z

+			"documentation",
+		}, cobra.ShellCompDirectiveNoFileComp
+	})
+	_ = cmd.RegisterFlagCompletionFunc("severity", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {


parameter 'cmd' seems to be unused, consider removing or renaming it as _

Unused parameters in functions or methods should be replaced with _
(underscore) or removed.

vishnu-deepsource and others added 11 commits January 28, 2026 15:17

refactor: CLI architecture refactor, to improve DX, and to add newer …

55044ed

…features

sawez-deepsource closed this Apr 28, 2026

sawez-deepsource reopened this Apr 28, 2026

deepsource-io Bot reviewed Apr 28, 2026

View reviewed changes

sawez-deepsource closed this Apr 28, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Debug/eng 3822 pr264#290

Debug/eng 3822 pr264#290
sawez-deepsource wants to merge 11 commits intofake-base-masterfrom
debug/eng-3822-pr264

sawez-deepsource commented Apr 28, 2026

Uh oh!

deepsource-io Bot commented Apr 28, 2026 •

edited

Loading

Uh oh!

deepsource-io Bot Apr 28, 2026

Uh oh!

deepsource-io Bot Apr 28, 2026

Uh oh!

deepsource-io Bot Apr 28, 2026

Uh oh!

deepsource-io Bot Apr 28, 2026

Uh oh!

deepsource-io Bot Apr 28, 2026

Uh oh!

deepsource-io Bot Apr 28, 2026

Uh oh!

deepsource-io Bot Apr 28, 2026

Uh oh!

deepsource-io Bot Apr 28, 2026

Uh oh!

deepsource-io Bot Apr 28, 2026

Uh oh!

deepsource-io Bot Apr 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

Conversation

sawez-deepsource commented Apr 28, 2026

Uh oh!

deepsource-io Bot commented Apr 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

DeepSource Code Review

PR Report Card

Feedback

Code Review Summary

Uh oh!

deepsource-io Bot Apr 28, 2026

Choose a reason for hiding this comment

os.Exit will exit, and `defer func(){...}(...)` will not run

Uh oh!

deepsource-io Bot Apr 28, 2026

Choose a reason for hiding this comment

parameter 'args' seems to be unused, consider removing or renaming it as _

Uh oh!

deepsource-io Bot Apr 28, 2026

Choose a reason for hiding this comment

parameter 'toComplete' seems to be unused, consider removing or renaming it as _

Uh oh!

deepsource-io Bot Apr 28, 2026

Choose a reason for hiding this comment

parameter 'args' seems to be unused, consider removing or renaming it as _

Uh oh!

deepsource-io Bot Apr 28, 2026

Choose a reason for hiding this comment

parameter 'cmd' seems to be unused, consider removing or renaming it as _

Uh oh!

deepsource-io Bot Apr 28, 2026

Choose a reason for hiding this comment

parameter 'args' seems to be unused, consider removing or renaming it as _

Uh oh!

deepsource-io Bot Apr 28, 2026

Choose a reason for hiding this comment

parameter 'toComplete' seems to be unused, consider removing or renaming it as _

Uh oh!

deepsource-io Bot Apr 28, 2026

Choose a reason for hiding this comment

parameter 'args' seems to be unused, consider removing or renaming it as _

Uh oh!

deepsource-io Bot Apr 28, 2026

Choose a reason for hiding this comment

parameter 'toComplete' seems to be unused, consider removing or renaming it as _

Uh oh!

deepsource-io Bot Apr 28, 2026

Choose a reason for hiding this comment

parameter 'cmd' seems to be unused, consider removing or renaming it as _

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

deepsource-io Bot commented Apr 28, 2026 •

edited

Loading