[amarkdotdev]

Fixes #1414

scan-repository was creating a ResultContext with IncludeVulnerabilities=false. When watches are configured, that hid JAS vulnerability tables (including SAST) even though the scan found issues.

Test plan

• go test ./utils/issues/... ./utils/outputwriter/... -count=1 (pass)
• scanrepository tests require JF_URL; change is a one-line context flag fix aligned with scan-pull-request behavior

Summary by CodeRabbit

• Bug Fixes
  • Repository scans now use the updated results context configuration. This may affect how scan results are handled, while the scan command’s other behavior remains unchanged.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI; Enforced overrides: Organization, Workspace
• Review profile: CHILL
• Plan: Advanced
• Run ID: d73c11c6-a94e-4710-8fd2-405fa0b30162

Commits

Reviewing files that changed from the base of the PR and between 6dd9dbe and 3e056f8.

Files selected for processing: 1

• scanrepository/scanrepository.go

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

Walkthrough

The scan repository command now passes true to SetResultsContext during prerequisite setup.

Changes: Scan repository results

Layer / File(s)	Summary
Enable scan results context scanrepository/scanrepository.go	setCommandPrerequisites now passes true to SetResultsContext.

Priority: Normal

Estimated code review effort: 1 (Trivial) | ~2 minutes

Change: Bug fix · Severity of issue fixed: Medium

Suggested reviewers: orto17, eranturgeman, attiasas

Merge Risk: Minimal · up to 3e056

The change enables vulnerability reporting alongside violations. No concrete merge-blocking defect was established; mergeability remains subject to normal checks.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: including vulnerabilities in scan output.
Linked Issues check		Issue #1414 requires SAST results to remain available in scan output. In scanrepository/scanrepository.go, setCommandPrerequisites now calls SetResultsContext(..., true). This enables vulnerabil…
Out of Scope Changes check		The pull request changes one argument in scanrepository/scanrepository.go. The argument directly controls vulnerability inclusion for the behavior in issue #1414. No unrelated code or behavior is sh…
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…

Full details: Linked Issues check

Explanation

Issue #1414 requires SAST results to remain available in scan output. In scanrepository/scanrepository.go, setCommandPrerequisites now calls SetResultsContext(..., true). This enables vulnerability inclusion for scan-repository, including watch-based JAS vulnerability tables. The reported utility and output-writer tests passed. The scanrepository tests were not run because they require JF_URL, but no issue acceptance criterion requires those tests to run.

Full details: Out of Scope Changes check

Explanation

The pull request changes one argument in scanrepository/scanrepository.go. The argument directly controls vulnerability inclusion for the behavior in issue #1414. No unrelated code or behavior is shown in the reviewed diff.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 1 files.

_{Comment @coderabbitai help to get the list of available commands.}

[amarkdotdev]

Hey folks, gentle nudge when someone has cycles for a maintainer look at this. Thanks!

[amarkdotdev]

Merged main; CI should rerun including scan-pull-request.