fix(comments): make per-alert ignores round trip

Author: lelia

socketsecurity/core/messages.py

@@ -936,7 +936,7 @@ def security_comment_template(diff: Diff, config=None) -> str:
 > **Review the following alerts detected in dependencies.**  
 >  
 > According to your organization's policies, you **must** resolve all **"Block"** alerts before proceeding. It's recommended to resolve **"Warn"** alerts too.  
-> Learn more about [Socket for GitHub](https://socket.dev?utm_medium=gh).
+> Learn more about [Socket](https://socket.dev).
 
 <!-- start-socket-updated-alerts-table -->
 <table>
@@ -968,7 +968,7 @@ def security_comment_template(diff: Diff, config=None) -> str:
             # Generate a table row for each alert
             ignore_html = (
                 f"<p><em>Mark as acceptable risk:</em> To ignore this alert only in this pull request, reply with:<br/>"
-                f"<code>@SocketSecurity ignore {alert.pkg_name}@{alert.pkg_version}</code><br/>"
+                f"<code>@SocketSecurity ignore {alert.pkg_type}/{alert.pkg_name}@{alert.pkg_version}</code><br/>"
                 f"Or ignore all future alerts with:<br/>"
                 f"<code>@SocketSecurity ignore-all</code></p>"
             ) if show_ignore else ""
@@ -1032,7 +1032,7 @@ def security_comment_template(diff: Diff, config=None) -> str:
 
             license_ignore_html = (
                 f"<p><em>Mark the package as acceptable risk:</em> To ignore this alert only in this pull request, reply with the comment "
-                f"<code>@SocketSecurity ignore {first_alert.pkg_name}@{first_alert.pkg_version}</code>. "
+                f"<code>@SocketSecurity ignore {first_alert.pkg_type}/{first_alert.pkg_name}@{first_alert.pkg_version}</code>. "
                 f"You can also ignore all packages with <code>@SocketSecurity ignore-all</code>. "
                 f"To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.</p>"
             ) if show_ignore else ""

socketsecurity/core/scm_comments.py

@@ -37,10 +37,10 @@ def remove_alerts(comments: dict, new_alerts: list) -> list:
             if ignore_all:
                 break
             else:
-                full_name = f"{alert.pkg_type}/{alert.pkg_name}"
-                purl = (full_name, alert.pkg_version)
-                purl_star = (full_name, "*")
-                if purl in ignore_commands or purl_star in ignore_commands:
+                if any(
+                    Comments.is_ignore(alert.pkg_name, alert.pkg_version, name, version, alert.pkg_type)
+                    for name, version in ignore_commands
+                ):
                     log.info(f"Alerts for {alert.pkg_name}@{alert.pkg_version} ignored")
                 else:
                     log.info(f"Adding alert {alert.type} for {alert.pkg_name}@{alert.pkg_version}")
@@ -66,20 +66,28 @@ def get_ignore_options(comments: dict) -> [bool, list]:
                         ignore_all = True
                     else:
                         command = command.lstrip("ignore").strip()
-                        name, version = command.split("@")
-                        data = (name, version)
+                        name, separator, version = command.rpartition("@")
+                        if not separator or not name or not version:
+                            raise ValueError("Expected package@version")
+                        data = (name.strip(), version.strip())
                         ignore_commands.append(data)
                 except Exception as error:
                     log.error(f"Unable to process ignore command for {comment}")
                     log.error(error)
         return ignore_all, ignore_commands
 
     @staticmethod
-    def is_ignore(pkg_name: str, pkg_version: str, name: str, version: str) -> bool:
-        result = False
-        if pkg_name == name and (pkg_version == version or version == "*"):
-            result = True
-        return result
+    def is_ignore(
+            pkg_name: str, pkg_version: str, name: str, version: str,
+            pkg_type: str = ""
+    ) -> bool:
+        package_names = {pkg_name}
+        if pkg_type:
+            package_names.add(f"{pkg_type}/{pkg_name}")
+        target_names = {name}
+        if not pkg_type and "/" in name:
+            target_names.add(name.split("/", 1)[1])
+        return bool(package_names & target_names) and (pkg_version == version or version == "*")
 
     @staticmethod
     def is_heading_line(line) -> bool:
@@ -187,7 +195,7 @@ def process_updated_security_comment(
                 # Extract package name and version from the comment
                 try:
                     start_marker = stripped[len("<!-- start-socket-alert-"):-4]  # Strip the comment markers
-                    pkg_name, pkg_version = start_marker.split("@")  # Extract pkg_name and pkg_version
+                    pkg_name, pkg_version = start_marker.rsplit("@", 1)
                 except ValueError:
                     pkg_name, pkg_version = "", ""
 

tests/unit/test_disable_ignore.py

@@ -82,6 +82,25 @@ def test_remove_alerts_suppresses_matching_alert(self):
         result = Comments.remove_alerts(comments, [alert])
         assert len(result) == 0
 
+    def test_bare_package_name_remains_supported(self):
+        alert = _make_alert()
+        ignore_comment = _make_comment("SocketSecurity ignore lodash@4.17.21")
+        comments = Comments.check_for_socket_comments({ignore_comment.id: ignore_comment})
+
+        assert Comments.remove_alerts(comments, [alert]) == []
+
+    def test_scoped_package_name_is_parsed_from_the_right(self):
+        alert = _make_alert(
+            pkg_name="@socketsecurity/example",
+            purl="pkg:npm/@socketsecurity/example@4.17.21",
+        )
+        ignore_comment = _make_comment(
+            "SocketSecurity ignore npm/@socketsecurity/example@4.17.21"
+        )
+        comments = Comments.check_for_socket_comments({ignore_comment.id: ignore_comment})
+
+        assert Comments.remove_alerts(comments, [alert]) == []
+
     def test_alerts_preserved_when_no_ignore_comments(self):
         """With --disable-ignore the caller skips remove_alerts entirely,
         which is equivalent to passing empty comments."""
@@ -123,6 +142,12 @@ def test_ignore_instructions_shown_by_default(self):
         assert "@SocketSecurity ignore" in comment
         assert "Mark as acceptable risk" in comment
 
+    def test_ignore_instruction_uses_ecosystem_qualified_package(self):
+        diff = self._make_diff_with_alert()
+        comment = Messages.security_comment_template(diff, _FakeConfig())
+
+        assert "@SocketSecurity ignore npm/lodash@4.17.21" in comment
+
     def test_ignore_instructions_hidden_when_disabled(self):
         diff = self._make_diff_with_alert()
         config = _FakeConfig(disable_ignore=True)

tests/unit/test_pr_comment_rendering.py

@@ -155,6 +155,13 @@ def test_alert_markers_are_preserved(self):
         assert "<!-- start-socket-alert-lodash@4.17.21 -->" in body
         assert "<!-- end-socket-alert-lodash@4.17.21 -->" in body
 
+    def test_copy_is_provider_neutral(self):
+        body = Messages.security_comment_template(
+            _make_diff([_make_alert()]), _FakeConfig(scm="gitlab")
+        )
+        assert "Socket for GitHub" not in body
+        assert "Learn more about [Socket]" in body
+
 
 class TestSecurityCommentTemplateWithNoAlerts:
     def test_no_alerts_omits_the_empty_table(self):
@@ -232,6 +239,23 @@ def test_ignoring_every_alert_individually_collapses_too(self):
 
         assert "No dependency alerts to report" in new_body
 
+    def test_qualified_scoped_package_ignore_matches_comment_marker(self):
+        security = _security_comment_with([
+            _make_alert(
+                pkg_name="@socketsecurity/example",
+                purl="pkg:npm/@socketsecurity/example@4.17.21",
+            )
+        ])
+        comments = {
+            "security": security,
+            "ignore": [_make_comment(
+                "SocketSecurity ignore npm/@socketsecurity/example@4.17.21",
+                comment_id=2,
+            )],
+        }
+
+        assert "No dependency alerts to report" in Comments.process_security_comment(security, comments)
+
     def test_no_ignore_commands_leaves_alerts_in_place(self):
         security = self._two_alert_comment()
         comments = {"security": security, "ignore": []}