diff --git a/README.md b/README.md index 76ae6fb..6439942 100644 --- a/README.md +++ b/README.md @@ -56,13 +56,14 @@ valk-guard-example/ Workflow install target is configured as: ```text -github.com/valkdb/valk-guard/cmd/valk-guard@latest +github.com/valkdb/valk-guard/cmd/valk-guard.0.0-20260304065917-b9d9468a4ea3@latest ``` Rationale: -- This repository is a demo showcase; tracking latest keeps examples aligned with current built-in behavior. -- If you need strict reproducibility, pin a fixed tag in workflow `VALK_GUARD_INSTALL_REF`. +- This repository is a demo showcase, but CI is pinned to a known-good valk-guard build to keep output shape stable. +- Pinning avoids format drift that can break downstream tooling steps (for example: `Convert to reviewdog format`). +- When upgrading, bump `VALK_GUARD_INSTALL_REF` intentionally and verify the full workflow output. ## Creating Demo PRs (one rule at a time) @@ -105,6 +106,21 @@ Separate snippets for schema-aware rules are in: - `docs/schema-aware-demos/VG105.md` - `docs/schema-aware-demos/VG106.md` +## Suppression Demo + +Inline and global suppression examples are in: + +- `demo/suppressions/README.md` +- `demo/suppressions/inline/` +- `demo/suppressions/config/global_disable_vg001.yaml` + +Quick verify: + +```bash +valk-guard scan demo/suppressions/inline --config .valk-guard.yaml --format json +valk-guard scan demo/suppressions/inline --config demo/suppressions/config/global_disable_vg001.yaml --format json +``` + ## License [Apache 2.0](https://www.apache.org/licenses/LICENSE-2.0) diff --git a/demo/suppressions/README.md b/demo/suppressions/README.md new file mode 100644 index 0000000..823defe --- /dev/null +++ b/demo/suppressions/README.md @@ -0,0 +1,33 @@ +# Suppression Showcase + +This demo shows suppression at two levels: + +1. Query-level inline suppression +- Rule-specific: `valk-guard:disable VG001` +- Statement-wide: `valk-guard:disable` + +2. Global suppression via config +- `demo/suppressions/config/global_disable_vg001.yaml` disables `VG001` globally. + +## Files + +- `inline/sql_inline.sql` +- `inline/go_inline.go` +- `inline/python_inline.py` + +## Verification + +From repo root: + +```bash +# Baseline config: query-level suppressions apply, unsuppressed VG001 remains. +valk-guard scan demo/suppressions/inline --config .valk-guard.yaml --format json + +# Global config: VG001 disabled globally, so inline folder returns zero findings. +valk-guard scan demo/suppressions/inline --config demo/suppressions/config/global_disable_vg001.yaml --format json +``` + +Expected behavior: + +- Baseline config: only unsuppressed `VG001` findings remain. +- Global config: `VG001` findings are suppressed globally; result is empty. diff --git a/demo/suppressions/config/global_disable_vg001.yaml b/demo/suppressions/config/global_disable_vg001.yaml new file mode 100644 index 0000000..b2109f5 --- /dev/null +++ b/demo/suppressions/config/global_disable_vg001.yaml @@ -0,0 +1,3 @@ +rules: + VG001: + enabled: false diff --git a/demo/suppressions/inline/go_inline.go b/demo/suppressions/inline/go_inline.go new file mode 100644 index 0000000..441f8bd --- /dev/null +++ b/demo/suppressions/inline/go_inline.go @@ -0,0 +1,18 @@ +package suppressions + +import ( + "context" + "database/sql" +) + +func GoInlineSuppression(db *sql.DB) { + ctx := context.Background() + + // valk-guard:disable VG001 + _, _ = db.QueryContext(ctx, "SELECT * FROM users LIMIT 1") + + _, _ = db.QueryContext(ctx, "SELECT * FROM users LIMIT 1") + + // valk-guard:disable + _, _ = db.ExecContext(ctx, "DELETE FROM orders") +} diff --git a/demo/suppressions/inline/python_inline.py b/demo/suppressions/inline/python_inline.py new file mode 100644 index 0000000..36c70c4 --- /dev/null +++ b/demo/suppressions/inline/python_inline.py @@ -0,0 +1,12 @@ +from sqlalchemy import text +from sqlalchemy.orm import Session + + +def python_inline_suppression(session: Session): + # valk-guard:disable VG001 + session.execute(text("SELECT * FROM users LIMIT 1")).all() + + session.execute(text("SELECT * FROM users LIMIT 1")).all() + + # valk-guard:disable + session.execute(text("UPDATE users SET active = false")) diff --git a/demo/suppressions/inline/sql_inline.sql b/demo/suppressions/inline/sql_inline.sql new file mode 100644 index 0000000..67c4adc --- /dev/null +++ b/demo/suppressions/inline/sql_inline.sql @@ -0,0 +1,7 @@ +-- valk-guard:disable VG001 +SELECT * FROM users LIMIT 1; + +SELECT * FROM users LIMIT 1; + +-- valk-guard:disable +UPDATE users SET active = false;