diff --git a/.galaxyscope.yaml b/.galaxyscope.yaml index 12e70d5b..60797e3e 100644 --- a/.galaxyscope.yaml +++ b/.galaxyscope.yaml @@ -5,7 +5,7 @@ galaxyscope: - "vendor/" - "gitgalaxy/standards/" - "gitgalaxy/security/" - - "gitgalaxy/tools/ + - "gitgalaxy/tools/" SARIF_IGNORED_RULES: - "GH-1022" - "squid-protocol" \ No newline at end of file diff --git a/gitgalaxy/galaxyscope.py b/gitgalaxy/galaxyscope.py index 35c96cd6..39a30f84 100644 --- a/gitgalaxy/galaxyscope.py +++ b/gitgalaxy/galaxyscope.py @@ -918,7 +918,6 @@ def execute_pipeline(self, output_file: str = "galaxy.json"): if "risk_vector" in file_data and isinstance(file_data["risk_vector"], list): file_data["risk_vector"] = [0.0] * len(file_data["risk_vector"]) - # THE NUCLEAR SCRUB: Annihilate all telemetry except what the 3D map requires if "telemetry" in file_data: file_data["telemetry"] = { "popularity": file_data["telemetry"].get("popularity", 0), @@ -947,6 +946,8 @@ def execute_pipeline(self, output_file: str = "galaxy.json"): or k.replace("sec_", "") in mitigs or k in ignored_rules or f"sec_{k}" in ignored_rules + or f"GG-SAST-{k.upper()}" in ignored_rules + or f"GG-SAST-{k.replace('sec_', '').upper()}" in ignored_rules ] keys_to_delete_eqs = [ k for k in eqs.keys() @@ -954,6 +955,8 @@ def execute_pipeline(self, output_file: str = "galaxy.json"): or k.replace("sec_", "") in mitigs or k in ignored_rules or k.replace("sec_", "") in ignored_rules + or f"GG-SAST-{k.upper()}" in ignored_rules + or f"GG-SAST-{k.replace('sec_', '').upper()}" in ignored_rules ] for k in keys_to_delete_ts: @@ -964,6 +967,19 @@ def execute_pipeline(self, output_file: str = "galaxy.json"): if k in eqs: del eqs[k] + if "GG-AGENT-VULNERABILITY" in ignored_rules or "ai_appsec" in mitigs: + if "ai_appsec" in file_data.get("telemetry", {}): + del file_data["telemetry"]["ai_appsec"] + + if "GG-AGENT-GUARDRAIL" in ignored_rules or "ai_guardrails" in mitigs: + if "ai_guardrails" in file_data.get("telemetry", {}): + del file_data["telemetry"]["ai_guardrails"] + + if file_data.get("is_ml_threat"): + ai_class = file_data.get("telemetry", {}).get("domain_context", {}).get("AI Threat Class", "Unknown") + if f"GG-ML-{ai_class.upper().replace(' ', '_').replace('/', '')}" in ignored_rules or "ml_threat" in mitigs: + file_data["is_ml_threat"] = False + # ========================================================== # PHASE 11: GLOBAL TELEMETRY & METADATA LOCKING # ==========================================================