demo: suppression showcase (inline + global) with verification

README.md

@@ -56,13 +56,14 @@ valk-guard-example/
 Workflow install target is configured as:
 
 ```text
-github.com/valkdb/valk-guard/cmd/valk-guard@latest
+github.com/valkdb/valk-guard/cmd/valk-guard.0.0-20260304065917-b9d9468a4ea3@latest
 ```
 
 Rationale:
 
-- This repository is a demo showcase; tracking latest keeps examples aligned with current built-in behavior.
-- If you need strict reproducibility, pin a fixed tag in workflow `VALK_GUARD_INSTALL_REF`.
+- This repository is a demo showcase, but CI is pinned to a known-good valk-guard build to keep output shape stable.
+- Pinning avoids format drift that can break downstream tooling steps (for example: `Convert to reviewdog format`).
+- When upgrading, bump `VALK_GUARD_INSTALL_REF` intentionally and verify the full workflow output.
 
 ## Creating Demo PRs (one rule at a time)
 
@@ -105,6 +106,21 @@ Separate snippets for schema-aware rules are in:
 - `docs/schema-aware-demos/VG105.md`
 - `docs/schema-aware-demos/VG106.md`
 
+## Suppression Demo
+
+Inline and global suppression examples are in:
+
+- `demo/suppressions/README.md`
+- `demo/suppressions/inline/`
+- `demo/suppressions/config/global_disable_vg001.yaml`
+
+Quick verify:
+
+```bash
+valk-guard scan demo/suppressions/inline --config .valk-guard.yaml --format json
+valk-guard scan demo/suppressions/inline --config demo/suppressions/config/global_disable_vg001.yaml --format json
+```
+
 ## License
 
 [Apache 2.0](https://www.apache.org/licenses/LICENSE-2.0)

demo/suppressions/README.md

@@ -0,0 +1,33 @@
+# Suppression Showcase
+
+This demo shows suppression at two levels:
+
+1. Query-level inline suppression
+- Rule-specific: `valk-guard:disable VG001`
+- Statement-wide: `valk-guard:disable`
+
+2. Global suppression via config
+- `demo/suppressions/config/global_disable_vg001.yaml` disables `VG001` globally.
+
+## Files
+
+- `inline/sql_inline.sql`
+- `inline/go_inline.go`
+- `inline/python_inline.py`
+
+## Verification
+
+From repo root:
+
+```bash
+# Baseline config: query-level suppressions apply, unsuppressed VG001 remains.
+valk-guard scan demo/suppressions/inline --config .valk-guard.yaml --format json
+
+# Global config: VG001 disabled globally, so inline folder returns zero findings.
+valk-guard scan demo/suppressions/inline --config demo/suppressions/config/global_disable_vg001.yaml --format json
+```
+
+Expected behavior:
+
+- Baseline config: only unsuppressed `VG001` findings remain.
+- Global config: `VG001` findings are suppressed globally; result is empty.

demo/suppressions/config/global_disable_vg001.yaml

@@ -0,0 +1,3 @@
+rules:
+  VG001:
+    enabled: false

demo/suppressions/inline/go_inline.go

@@ -0,0 +1,18 @@
+package suppressions
+
+import (
+	"context"
+	"database/sql"
+)
+
+func GoInlineSuppression(db *sql.DB) {
+	ctx := context.Background()
+
+	// valk-guard:disable VG001
+	_, _ = db.QueryContext(ctx, "SELECT * FROM users LIMIT 1")
+
+	_, _ = db.QueryContext(ctx, "SELECT * FROM users LIMIT 1")
+
+	// valk-guard:disable
+	_, _ = db.ExecContext(ctx, "DELETE FROM orders")
+}

demo/suppressions/inline/python_inline.py

@@ -0,0 +1,12 @@
+from sqlalchemy import text
+from sqlalchemy.orm import Session
+
+
+def python_inline_suppression(session: Session):
+    # valk-guard:disable VG001
+    session.execute(text("SELECT * FROM users LIMIT 1")).all()
+
+    session.execute(text("SELECT * FROM users LIMIT 1")).all()
+
+    # valk-guard:disable
+    session.execute(text("UPDATE users SET active = false"))

demo/suppressions/inline/sql_inline.sql

@@ -0,0 +1,7 @@
+-- valk-guard:disable VG001
+SELECT * FROM users LIMIT 1;
+
+SELECT * FROM users LIMIT 1;
+
+-- valk-guard:disable
+UPDATE users SET active = false;