fix(report): omit SARIF provenance for multiple repos

Co-authored-by: Ahmed Allam <ahmed39652003@gmail.com>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Ahmed Allam <49919286+0xallam@users.noreply.github.com>

.github/workflows/build-release.yml

@@ -16,7 +16,7 @@ jobs:
             target: macos-arm64
           - os: macos-15-intel
             target: macos-x86_64
-          - os: ubuntu-latest
+          - os: ubuntu-22.04
             target: linux-x86_64
           - os: windows-latest
             target: windows-x86_64

containers/docker-entrypoint.sh

@@ -9,10 +9,24 @@ if [ ! -f /app/certs/ca.p12 ]; then
   exit 1
 fi
 
+# Caido enforces a Host allowlist (DNS-rebinding protection) and rejects requests
+# whose Host header is a hostname it doesn't recognize. To reach Caido over a
+# hostname (rather than an IP literal), set STRIX_CAIDO_ALLOWED_DOMAINS to a
+# comma-separated list of hostnames to allow. Unset by default.
+# See https://docs.caido.io/app/guides/domain_allowlist
+CAIDO_UI_DOMAIN_ARGS=()
+if [ -n "${STRIX_CAIDO_ALLOWED_DOMAINS:-}" ]; then
+  IFS=',' read -ra _caido_domains <<< "${STRIX_CAIDO_ALLOWED_DOMAINS}"
+  for _d in "${_caido_domains[@]}"; do
+    [ -n "$_d" ] && CAIDO_UI_DOMAIN_ARGS+=(--ui-domain "$_d")
+  done
+fi
+
 caido-cli --listen 0.0.0.0:${CAIDO_PORT} \
           --allow-guests \
           --no-logging \
           --no-open \
+          "${CAIDO_UI_DOMAIN_ARGS[@]}" \
           --import-ca-cert /app/certs/ca.p12 \
           --import-ca-cert-pass "" > "$CAIDO_LOG" 2>&1 &
 

strix/report/state.py

@@ -438,30 +438,37 @@ class ReportState:
         targets = self.run_record.get("targets_info") or []
         if not isinstance(targets, list):
             return None
-        for target in targets:
-            if not isinstance(target, dict) or target.get("type") != "repository":
-                continue
-            details = target.get("details") or {}
-            if not isinstance(details, dict):
-                continue
-            uri = details.get("target_repo")
-            if not isinstance(uri, str) or not uri.strip():
-                continue
+        repo_targets = [
+            target
+            for target in targets
+            if isinstance(target, dict) and target.get("type") == "repository"
+        ]
+        # Provenance binds the whole run to one repo; with multiple repo targets
+        # that's ambiguous, so omit it rather than mis-attributing later repos'
+        # findings to the first repo's URI/commit.
+        if len(repo_targets) != 1:
+            return None
+        target = repo_targets[0]
+        details = target.get("details") or {}
+        if not isinstance(details, dict):
+            return None
+        uri = details.get("target_repo")
+        if not isinstance(uri, str) or not uri.strip():
+            return None
 
-            context: dict[str, Any] = {"repositoryUri": uri.strip()}
-            full_name = _parse_repo_full_name(uri)
-            if full_name:
-                context["repositoryFullName"] = full_name
-            cloned = details.get("cloned_repo_path")
-            if isinstance(cloned, str) and cloned.strip():
-                commit, branch = _git_head(cloned.strip())
-                if commit:
-                    context["commitSha"] = commit
-                if branch:
-                    context["branch"] = branch
-                    context["ref"] = f"refs/heads/{branch}"
-            return context
-        return None
+        context: dict[str, Any] = {"repositoryUri": uri.strip()}
+        full_name = _parse_repo_full_name(uri)
+        if full_name:
+            context["repositoryFullName"] = full_name
+        cloned = details.get("cloned_repo_path")
+        if isinstance(cloned, str) and cloned.strip():
+            commit, branch = _git_head(cloned.strip())
+            if commit:
+                context["commitSha"] = commit
+            if branch:
+                context["branch"] = branch
+                context["ref"] = f"refs/heads/{branch}"
+        return context
 
     def _sync_llm_usage_record(self) -> None:
         self.run_record["llm_usage"] = self._build_llm_usage_record()

strix/telemetry/logging.py

@@ -63,6 +63,18 @@ _HANDLER_TAG = "_strix_scan_handler"
 # ``openai.agents`` is the openai-agents SDK's canonical logger root.
 _TRACKED_ROOTS: tuple[str, ...] = ("strix", "openai.agents")
 
+_STDOUT_QUIET_ROOTS: frozenset[str] = frozenset({"openai.agents"})
+
+
+class _StdoutQuietFilter(logging.Filter):
+    def filter(self, record: logging.LogRecord) -> bool:
+        if record.levelno >= logging.WARNING:
+            return True
+        return not any(
+            record.name == root or record.name.startswith(root + ".")
+            for root in _STDOUT_QUIET_ROOTS
+        )
+
 
 def configure_dependency_logging() -> None:
     """Quiet dependency logging/warnings that obscure Strix scan logs."""
@@ -119,6 +131,7 @@ def setup_scan_logging(run_dir: Path, *, debug: bool | None = None) -> Callable[
     stream_handler.setLevel(logging.DEBUG if debug else logging.ERROR)
     stream_handler.setFormatter(formatter)
     stream_handler.addFilter(context_filter)
+    stream_handler.addFilter(_StdoutQuietFilter())
     setattr(stream_handler, _HANDLER_TAG, True)
 
     tracked_loggers = [logging.getLogger(name) for name in _TRACKED_ROOTS]

tests/test_state_repo_context.py

@@ -41,6 +41,15 @@ def test_repository_context_uri_only_without_clone() -> None:
     }
 
 
+def test_repository_context_none_for_multiple_repository_targets() -> None:
+    state = ReportState(run_name="t")
+    state.run_record["targets_info"] = [
+        {"type": "repository", "details": {"target_repo": "https://github.com/acme/widget"}},
+        {"type": "repository", "details": {"target_repo": "https://github.com/acme/api"}},
+    ]
+    assert state._sarif_repository_context() is None
+
+
 def test_repository_context_derives_commit_and_branch_from_clone(tmp_path: Path) -> None:
     repo = tmp_path / "widget"
     repo.mkdir()