feat(report): add baseline, provenance, and runtime context by ben-ranford · Pull Request #977 · ben-ranford/lopper

ben-ranford · 2026-06-02T13:20:33Z

Summary

Adds baseline, provenance, and runtime context reporting for #493, #494, #497, #499, and #500.

Changes

add baseline compare support to dashboard runs and the TUI summary
add policy pack provenance and merge trace data to effective policy output
enrich SARIF with provenance, runtime context, and baseline context
correlate runtime traces with parent modules and entrypoints
update report schema/docs for the new optional output fields

Validation

Commands run locally by the worker:

go test ./internal/dashboard ./internal/ui ./internal/thresholds ./internal/report ./internal/runtime ./internal/cli ./internal/app
git diff --check

CI follow-up is required for the unused dashboard materialization lint failure and Sonar findings.

Risk and compatibility

Breaking changes: none intended; new report fields are optional.
Migration required: downstream consumers pinned to the prior report/SARIF shape should tolerate baselineComparison, effectivePolicy.mergeTrace, and runtime parent/entrypoint context.
Performance impact: none expected.
Memory benchmark impact: none expected.

Closes #493
Closes #494
Closes #497
Closes #499
Closes #500

Checklist

Tests added/updated for behavior changes
Docs updated (README/docs/schema) if needed
memory-approved requested/applied if intentional memory benchmark regressions exceed CI thresholds
No unrelated changes included
Ready for review

github-actions · 2026-06-02T13:21:10Z

Feature flag enforcement

Feature PR: yes (feat PR title)
Check: passed
Rule: feature PRs must add a feature flag, new flags must start as preview, and feature flag ids and names must be unique.

New feature flags in this PR

LOP-FEAT-0006 baseline-provenance-runtime-context-preview (preview) - Enable baseline comparison, policy provenance, and runtime parent/entrypoint context in reports and dashboard views.

Result

Passed. This feature PR adds at least one new preview feature flag.

github-actions · 2026-06-02T13:22:05Z

Memory Benchmarks

Thresholds: bytes/op <= +15.0%, allocs/op <= +10.0%

Benchmark	Base B/op	Head B/op	Delta B/op	Base allocs/op	Head allocs/op	Delta allocs/op	Status
`github.com/ben-ranford/lopper/internal/lang/shared/BenchmarkCountUsage`	25632.3	25632.3	+0.0%	375.0	375.0	+0.0%	ok
`github.com/ben-ranford/lopper/internal/lang/shared/BenchmarkCountUsageRegexPerIdentifier`	414004.3	414856.0	+0.2%	3067.0	3067.0	+0.0%	ok
`github.com/ben-ranford/lopper/internal/report/BenchmarkFormatLargeTable`	256167.0	256162.3	-0.0%	3064.0	3064.0	+0.0%	ok

Result: memory benchmark gate passed.

Approval: not required.

Copilot

Pull request overview

This PR expands Lopper’s report model so baseline snapshots/comparisons, policy provenance (merge trace), and richer runtime trace context are propagated through the CLI, dashboard/TUI, SARIF output, and documentation—addressing several feature gaps where downstream formatters previously only represented the current-run view.

Changes:

Add baseline snapshot + compare support for lopper dashboard and baseline-aware compare mode rendering in the TUI summary.
Add effective policy field-level provenance via effectivePolicy.mergeTrace and surface it in table/JSON outputs.
Enrich runtime trace ingestion/annotation with parentModules + entrypoints, and include runtime + provenance + baseline context in SARIF properties.

Reviewed changes

Copilot reviewed 48 out of 48 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
scripts/runtime/require-hook.cjs	Emit `entrypoint` for CommonJS runtime trace events.
scripts/runtime/loader.mjs	Emit `entrypoint` for ESM loader trace events.
README.md	Document TUI baseline compare usage + new runtime usage fields.
internal/ui/options.go	Add baseline inputs to TUI options.
internal/ui/summary.go	Load/apply baseline to summary report when baseline inputs are provided.
internal/ui/summary_test.go	Add coverage for baseline-aware TUI snapshot output.
internal/ui/view_model.go	Map new runtime usage fields into the UI view model.
internal/ui/detail.go	Render runtime parent modules + entrypoints in detail output.
internal/cli/usage.go	Update CLI help for dashboard/TUI baseline flags.
internal/cli/parse_tui.go	Parse TUI baseline flags into the request model.
internal/cli/parse_tui_test.go	Test TUI baseline flag parsing.
internal/cli/parse_dashboard.go	Parse dashboard baseline flags (store/key/label/save).
internal/cli/parse_dashboard_test.go	Test dashboard baseline flag parsing.
internal/cli/parse_analyse.go	Thread policy merge trace through analyse request building.
internal/cli/parse_analyse_test.go	Validate policy trace precedence for CLI overrides.
internal/cli/parse_analyse_overrides.go	Merge CLI-derived policy trace into resolved policy trace.
internal/app/types.go	Extend request types (analyse policy trace; TUI/dashboard baseline fields).
internal/app/app.go	Forward TUI baseline options from app layer.
internal/app/dashboard.go	Aggregate dashboard report, apply baseline compare, optionally save snapshot.
internal/app/dashboard_request.go	Resolve config-provided baseline store (relative to config dir).
internal/app/dashboard_request_options_test.go	Test baseline store resolution from config.
internal/app/dashboard_rendering_test.go	Validate dashboard JSON includes `baseline_comparison` when comparing.
internal/app/analyse_prepare.go	Include `effectivePolicy.mergeTrace` in analyse report decoration.
internal/thresholds/config.go	Add `PolicyTrace` to threshold load result (defaults + merged).
internal/thresholds/config_packs.go	Track field-level policy source per merged override; export as trace list.
internal/thresholds/config_cov_more_branches_test.go	Add tests for policy trace merge/source tracking.
internal/runtime/trace_types.go	Extend runtime event + trace aggregates for parent/entrypoint context.
internal/runtime/trace_load.go	Parse/store parent + entrypoint counts per dependency.
internal/runtime/trace_load_test.go	Test trace loading for parent + entrypoint fields.
internal/runtime/trace_annotate.go	Attach parentModules/entrypoints to `report.RuntimeUsage`.
internal/runtime/trace_annotate_test.go	Test runtime annotation includes new provenance fields.
internal/report/model/metadata.go	Add `effectivePolicy.mergeTrace` to report schema model.
internal/report/model/dependency.go	Add `runtimeUsage.parentModules` and `runtimeUsage.entrypoints`.
internal/report/model_aliases.go	Export `PolicyMergeTrace` alias from report package.
internal/report/format_table_sections.go	Print merge trace section in table formatter.
internal/report/format_table_values.go	Render parent/entrypoint runtime context in table runtime usage string.
internal/report/format_test.go	Add test ensuring table includes merge trace content.
internal/report/sarif.go	Add provenance/runtime/baseline context to SARIF result properties.
internal/report/sarif_test.go	Update SARIF tests for new function signatures/properties.
internal/dashboard/types.go	Add dashboard baseline comparison model.
internal/dashboard/baseline.go	Implement dashboard baseline snapshot storage + comparison computation.
internal/dashboard/format.go	Emit baseline comparison in dashboard CSV/HTML outputs.
internal/dashboard/dashboard_test.go	Add baseline snapshot + comparison coverage for dashboard package.
docs/threshold-tuning.md	Document `effectivePolicy.mergeTrace` and TUI baseline flags.
docs/sarif-code-scanning.md	Document SARIF provenance/runtime/baseline enrichment.
docs/report-schema.md	Update schema docs for mergeTrace + runtime + richer baselineComparison.
docs/report-schema.json	Add JSON schema definitions for mergeTrace + runtime parent/entrypoint fields.
docs/dashboard.md	Document dashboard baseline store/key/label/save semantics.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

…0260610

…20260610

…-20260610 # Conflicts: # internal/report/format_table_values.go # internal/thresholds/config_cov_more_branches_test.go

github-actions · 2026-06-10T14:47:21Z

Lopper (Delta)

Metric delta	Value
Dependency count	+0
Used percent	+0.0%
Waste percent	+0.0%
Estimated unused bytes	+0 B
Known licenses	+0
Unknown licenses	+0
Denied licenses	+0

Changed	Regressions	Progressions	Added	Removed	Unchanged
0	0	0	0	0	9

No dependency-surface deltas detected.

github-actions · 2026-06-10T14:47:23Z

SonarQube (PR)

Open issues: 0
Actionable issues shown (excluding mock/fixture files): 0

Duplication

Overall duplicated lines: 583
Overall duplication density: 0.50%
New duplicated lines: n/a
New duplication density: n/a

Issues

Open Sonar issues (0)

#	Severity	Rule	Location	Message
-	-	-	-	No open Sonar issues for this PR.

Source: SonarCloud PR view

…20260610 # Conflicts: # internal/report/format_table_values.go # internal/runtime/capture_env.go # internal/runtime/capture_env_test.go # internal/thresholds/config_cov_more_branches_test.go

sonarqubecloud · 2026-06-10T15:07:49Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
2.6% Duplication on New Code

See analysis details on SonarQube Cloud

ben-ranford added 2 commits June 2, 2026 23:15

fix(core): harden config, path, and output trust boundaries

150df17

feat: add baseline provenance and runtime context

5190598

Copilot AI review requested due to automatic review settings June 2, 2026 13:20

ben-ranford added the enhancement New feature or request label Jun 2, 2026

ben-ranford added this to the v1.6.0 milestone Jun 2, 2026

Copilot started reviewing on behalf of ben-ranford June 2, 2026 13:20 View session

Copilot AI reviewed Jun 2, 2026

View reviewed changes

ben-ranford added 8 commits June 6, 2026 17:10

fix(core): address workspace quoted path lint

794a983

feat(report): register baseline context preview flag

4392c44

Merge remote-tracking branch 'origin/main' into bug/pr-976-ci-green-2…

841fa5a

…0260610

Merge remote-tracking branch 'origin/main' into feat/pr-977-ci-green-…

7ed3270

…20260610

fix(ci): clear PR 976 lint and sonar failures

c3dfee3

Merge branch 'bug/pr-976-ci-green-20260610' into feat/pr-977-ci-green…

8ad425d

…-20260610 # Conflicts: # internal/report/format_table_values.go # internal/thresholds/config_cov_more_branches_test.go

fix(ci): reduce baseline duplication and coverage gaps

a892ebd

fix: reduce duplication and sonar noise

0d7b527

ben-ranford added 2 commits June 11, 2026 00:51

fix: resolve remaining sonar issues

5729a30

Merge remote-tracking branch 'origin/main' into feat/pr-977-ci-green-…

ece1ad3

…20260610 # Conflicts: # internal/report/format_table_values.go # internal/runtime/capture_env.go # internal/runtime/capture_env_test.go # internal/thresholds/config_cov_more_branches_test.go

ben-ranford merged commit 0faf079 into main Jun 10, 2026
10 checks passed

ben-ranford deleted the feat/issues-493-494-497-499-500-baseline-provenance-context branch June 10, 2026 15:10

ben-ranford mentioned this pull request Jun 10, 2026

chore(main): release 1.6.0 #974

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(report): add baseline, provenance, and runtime context#977

feat(report): add baseline, provenance, and runtime context#977
ben-ranford merged 12 commits into
mainfrom
feat/issues-493-494-497-499-500-baseline-provenance-context

ben-ranford commented Jun 2, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jun 2, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jun 2, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

github-actions Bot commented Jun 10, 2026

Uh oh!

github-actions Bot commented Jun 10, 2026 •

edited

Loading

Uh oh!

sonarqubecloud Bot commented Jun 10, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

ben-ranford commented Jun 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Validation

Risk and compatibility

Checklist

Uh oh!

github-actions Bot commented Jun 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Feature flag enforcement

New feature flags in this PR

Result

Uh oh!

github-actions Bot commented Jun 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Memory Benchmarks

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

github-actions Bot commented Jun 10, 2026

Lopper (Delta)

Uh oh!

github-actions Bot commented Jun 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

SonarQube (PR)

Duplication

Issues

Uh oh!

sonarqubecloud Bot commented Jun 10, 2026

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ben-ranford commented Jun 2, 2026 •

edited

Loading

github-actions Bot commented Jun 2, 2026 •

edited

Loading

github-actions Bot commented Jun 2, 2026 •

edited

Loading

github-actions Bot commented Jun 10, 2026 •

edited

Loading