feat: TOON field selection by robertolopezlopez · Pull Request #766 · snyk/go-application-framework

robertolopezlopez · 2026-09-15T09:21:15Z

Description

Adds default and --full TOON output for SCA and Secrets.

context, feedback and scanner diagnostics
--full adds SCA title, CVSS and upgrade details
stdout and file output render the same TOON
extraction errors and unfinished scans stop rendering
to align with AXI behavior: replaced results[] with sca[] and secrets[]

Checklist

Tests added and all succeed (make test)
Regenerated mocks, etc. (make generate)
Linted (make lint)
Test your changes work for the CLI -> feat: TOON flags and field selection cli#7267
1. Clone / pull the latest CLI main.
2. Run go get github.com/snyk/go-application-framework@YOUR_LATEST_GAF_COMMIT in the cliv2 directory.
  - Tip: for local testing, you can uncomment the line near the bottom of the CLI's go.mod to point to your local GAF code.
3. Run go mod tidy in the cliv2 directory.
4. Run the CLI tests and do any required manual testing.
5. Open a PR in the CLI repo now with the go.mod and go.sum changes.
- Once this PR is merged, repeat these steps, but pointing to the latest GAF commit on main and update your CLI PR.

Note

Medium Risk
Changes CLI structured output format and flag semantics (--toon), which can break consumers expecting the old results[] envelope; issue grouping and primary-problem selection also affect SCA/license presentation.

Overview
Reworks UFM TOON output from a raw results[] JSON dump to compact, scanner-specific tables (sca[], secrets[], generic findings[]) with org/project context, interaction ID, diagnostics (*_error, *_hint, *_warning), and a compact-mode hint to use --toon=full.

--toon becomes a string flag (compact / full, bare --toon → full) with validation; full mode renders SARIF-derived runs[] via a new renderFullTOON path instead of toon.PrepareResults. Rendering is context-aware through RenderTemplateWithContext and new template helpers (mapTOONIssue, jsonFields, issue conversion from test results).

Issue extraction changes in testapi: deterministic grouping order, safer keyless grouping, and primary problem preference (snyk_vuln over license/generic). Malformed SCA data and unfinished scans fail without writing partial output.

^{Reviewed by Cursor Bugbot for commit 0083347. Bugbot is set up for automated code reviews on this repo. Configure here.}

snyk-io · 2026-09-15T09:21:29Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

snyk-io · 2026-09-15T09:21:29Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues
✅	Secrets	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

cursor

Stale Bugbot comment from a previous run.

robertolopezlopez · 2026-09-16T06:45:07Z

@PeterSchafer ready for review again after your comments. I also have #767 which depends on this change. I am starting work on the final CLI PR for TOON in parallel.

cursor

Stale Bugbot comment from a previous run.

this addresses #766 (comment)

cursor

Stale Bugbot comment from a previous run.

cursor · 2026-09-22T06:55:04Z

+		severity := strings.ToLower(string(attributes.Rating.Severity))
+		if severity == "" {
+			severity = "low"
+		}


Secrets rows ignore effective severity

Low Severity

Secret TOON rows take severity from each finding’s raw rating.severity, while sortAndFilterIssues includes or excludes issues using GetEffectiveSeverity(). Policy-adjusted severities can disagree between the table and filtering.

^{Reviewed by Cursor Bugbot for commit 9496f5e. Configure here.}

octavian-snyk · 2026-09-22T06:55:27Z

 	FindingTypeLicense = "license"
 )

+const dataKeyComponentVersions = "component-versions"


I noticed the string is also duplicated in internal/presenters/toon_issues.go. Would it make sense to move this logic entirely into internal/presenters/toon_issues.go so we can avoid introducing any new symbols here?

I wrote the same answer in packageVersions below:

The problem about moving dataKeyComponentVersions is that it is used here and I wouldn't see clean/logical having issues.go depending on toon_issues.go - don't you think?

octavian-snyk · 2026-09-22T07:05:07Z

 	problemID            string
 	packageName          string
 	packageVersion       string
+	packageVersions      []string


If we can move dataKeyComponentVersions to internal/presenters/toon_issues.go, I think we can also remove packageVersions. We can keep the shared pkg/apiclients/testapi/issues.go changes minimal and iterate on TOON separately as needed.

the problem about moving dataKeyComponentVersions is that it is used here and I wouldn't see clean/logical having issues.go depending on toon_issues.go - don't you think?

Agreed, issues.go shouldn't depend on toon_issues.go. That's not what I'm proposing.

issues.go drops packageVersions and dataKeyComponentVersions entirely.

toon_issues.go builds the same list itself, reading each finding's own problem and package location, the way singleFindingComponent already does for a single finding. Neither package needs a new shared symbol.

Could this work?

You seem to already have this here: bd51c88#diff-923c25855547b91d56b9927487d06cc40313c54e63fe1b138f5b47911c676435

octavian-snyk · 2026-09-22T07:12:40Z

+		}
+		return *value
+	}
+	defaultMap["number"] = func(value int) json.Number { return json.Number(strconv.Itoa(value)) }


I am not entirely sure these are needed. Could we keep them in TOON for the time being, and move them to default once we confirm our last iteration requires these and would be useful to other consumers as well?

moved to getToonTemplateFuncMap

sorry, I don't think these were moved.
I am not sure if jsonStrings, jsonNumbers, getSourceLocation, runes, runeString, and number have any consumer?

cursor

Stale Bugbot comment from a previous run.

octavian-snyk · 2026-09-22T12:06:53Z

 	// Add finding types derived from actual findings
 	// todo: this is potentially an expensive intermediate conversion to issues, which we could cache or optimize differently.
-	issues, err := testapi.NewIssuesFromTestResult(context.Background(), testResults)
+	issues, err := testapi.NewIssuesFromTestResult(ctx, testResults)


Why not testapi.GetIssuesFromTestResult ? Could this also simplify the changes to pkg/apiclients/testapi/issues.go further?

because GetIssuesFromTestResult creates a new context. And using NewIssuesFromTestResult we carry forward the context from the template rendering

also, GetIssuesFromTestResult adds filtering and sorting -> we do not need that here

snyk-pr-review-bot · 2026-09-22T12:48:55Z

PR Reviewer Guide 🔍

🧪 PR contains tests
🔒 No security concerns identified
⚡ No major issues detected
📚 Repository Context Analyzed This review considered 97 relevant code sections from 11 files (average relevance: 1.00) internal/presenters/funcs.go (2 segments, lines 1-260) pkg/utils/ufm/json_test_result.go (lines 1-100) pkg/utils/sarif/sarif.go (2 segments, lines 1-100) internal/presenters/components.go (lines 1-100) CONTRIBUTING.md (lines 201-300) internal/presenters/presenter_local_finding.go (lines 1-100) pkg/local_workflows/connectivity_check_extension/connectivity/formatter.go (lines 1-100) ... and 4 more file(s)
🤖 Repository instructions applied (from `AGENTS.md`)

cursor

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0083347. Configure here.}

cursor · 2026-09-22T12:49:31Z

+	]}]`)
+	requireTOONEqual(t, `sca[1]{fixable,id,pkg,severity}:
+  no,same,"example@1.10,1.2",high
+sca_summary: 1 unique vulns (2 paths) | 1 high | 0 fixable`, output)


Missing sca_summary in compact TOON

Medium Severity

The new grouped-SCA mapping test expects a top-level sca_summary field in compact TOON output, but the main template only appends sca table rows and never sets sca_summary on the envelope, so rendered output cannot match the documented contract for grouped vulnerabilities.

^{Reviewed by Cursor Bugbot for commit 0083347. Configure here.}

octavian-snyk · 2026-09-22T14:32:31Z

 		return err
 	}

+	if mimeType == ApplicationTOONMimeType {


not necessarly an actionable comment for now; perhaps we should pick this in a later iteration.

just to keep in mind: it may be a good idea to split TOON Full MimeType from Compact TOON MimeType.

Perhaps:
text/toon; schema=full
text/toon; schema=compact

octavian-snyk · 2026-09-22T15:30:00Z

+	return findingTypes
+}
+
+func getFindingTypesFromTestResultWithContext(ctx context.Context, testResults testapi.TestResult) ([]testapi.FindingType, error) {


reading the body of the function before this, could we fold getFindingTypesFromTestResultWithContext directly into getFindingTypesFromTestResult? I'm not sure why there's a need to add the getFindingTypesFromTestResultWithContext.

robertolopezlopez marked this pull request as ready for review September 15, 2026 11:34

robertolopezlopez requested review from a team as code owners September 15, 2026 11:34

This comment has been minimized.

Sign in to view

robertolopezlopez mentioned this pull request Sep 15, 2026

feat: TOON flags and field selection snyk/cli#7267

Open

9 tasks

This comment has been minimized.

Sign in to view

PeterSchafer reviewed Sep 15, 2026

View reviewed changes

Comment thread internal/presenters/templates/ufm.toon.tmpl Outdated

This comment has been minimized.

Sign in to view

robertolopezlopez enabled auto-merge (squash) September 15, 2026 19:58

cursor Bot reviewed Sep 15, 2026

View reviewed changes

Comment thread internal/presenters/templates/ufm.toon.tmpl Outdated

This comment has been minimized.

Sign in to view

robertolopezlopez mentioned this pull request Sep 16, 2026

feat: TOON scanner summaries #767

Open

4 tasks

robertolopezlopez disabled the stack merge September 16, 2026 09:01

robertolopezlopez added this pull request to stack #768 September 16, 2026 09:02

robertolopezlopez force-pushed the feat/CLI-1859 branch from b431ef0 to 6a42d75 Compare September 16, 2026 09:20

This comment has been minimized.

Sign in to view

PeterSchafer reviewed Sep 16, 2026

View reviewed changes

Comment thread pkg/local_workflows/output_workflow/constants.go Outdated

PeterSchafer reviewed Sep 16, 2026

View reviewed changes

Comment thread pkg/local_workflows/output_workflow/constants.go Outdated

This comment has been minimized.

Sign in to view

octavian-snyk reviewed Sep 16, 2026

View reviewed changes

Comment thread internal/presenters/templates/ufm.toon.tmpl Outdated

octavian-snyk reviewed Sep 16, 2026

View reviewed changes

Comment thread internal/presenters/templates/ufm.toon.tmpl Outdated

cursor Bot reviewed Sep 16, 2026

View reviewed changes

Comment thread pkg/local_workflows/output_workflow/writer.go Outdated

This comment has been minimized.

Sign in to view

octavian-snyk reviewed Sep 16, 2026

View reviewed changes

Comment thread pkg/local_workflows/output_workflow/writer.go Outdated

This comment has been minimized.

Sign in to view

robertolopezlopez force-pushed the feat/CLI-1859 branch from 81779d5 to f76ee43 Compare September 17, 2026 08:07

robertolopezlopez added 12 commits September 22, 2026 08:50

refactor: move ctx out of template

7326906

refactor: restore filtering out unknown severity issues

31b3e0a

refactor: reuse catalog errors

be67159

refactor: centralise issue metadata

5f9ecbb

refactor: unify toonSecrets toonSCA templatest

8c1d8bc

refactor: move aggregation and remediation to Issue

6e380a2

refactor: add vulnerability > license > generic problem precedence

5ff9af7

this addresses #766 (comment)

refactor: drop custom sortVersions

9249b4e

clean: issues.go, lint

2da1f87

chore: reuse remediation helpers

b6def94

chore: make full the default report

98e68b0

fix: restore type assertions

9496f5e

robertolopezlopez force-pushed the feat/CLI-1859 branch from 791fe46 to 9496f5e Compare September 22, 2026 06:52

robertolopezlopez requested a review from a team as a code owner September 22, 2026 06:52

cursor Bot reviewed Sep 22, 2026

View reviewed changes

octavian-snyk reviewed Sep 22, 2026

View reviewed changes

This comment has been minimized.

Sign in to view

fix: lint

03d3940

This comment has been minimized.

Sign in to view

octavian-snyk reviewed Sep 22, 2026

View reviewed changes

chore: adjust default full toon behavior

82abfb7

cursor Bot reviewed Sep 22, 2026

View reviewed changes

Comment thread internal/presenters/presenter_ufm_full_toon.go

This comment has been minimized.

Sign in to view

octavian-snyk reviewed Sep 22, 2026

View reviewed changes

chore: move TOON logic from issues.go to toon_issues.go

0083347

cursor Bot reviewed Sep 22, 2026

View reviewed changes

octavian-snyk reviewed Sep 22, 2026

View reviewed changes

Conversation

robertolopezlopez commented Sep 15, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Checklist

Uh oh!

snyk-io Bot commented Sep 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

snyk-io Bot commented Sep 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

Uh oh!

This comment has been minimized.

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This comment has been minimized.

robertolopezlopez commented Sep 16, 2026

Uh oh!

This comment has been minimized.

Uh oh!

Uh oh!

This comment has been minimized.

Uh oh!

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This comment has been minimized.

Uh oh!

This comment has been minimized.

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cursor Bot Sep 22, 2026

Choose a reason for hiding this comment

Secrets rows ignore effective severity

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

This comment has been minimized.

This comment has been minimized.

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This comment has been minimized.

octavian-snyk Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

robertolopezlopez commented Sep 15, 2026 •

edited by cursor Bot

Loading

snyk-io Bot commented Sep 15, 2026 •

edited

Loading

snyk-io Bot commented Sep 15, 2026 •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

octavian-snyk Sep 22, 2026 •

edited

Loading

octavian-snyk Sep 22, 2026 •

edited

Loading