fix(report): omit SARIF provenance for multiple repos

Co-authored-by: Ahmed Allam <ahmed39652003@gmail.com>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Ahmed Allam <49919286+0xallam@users.noreply.github.com>

.github/workflows/build-release.yml

@@ -16,7 +16,7 @@ jobs:
             target: macos-arm64
           - os: macos-15-intel
             target: macos-x86_64
-          - os: ubuntu-latest
+          - os: ubuntu-22.04
             target: linux-x86_64
           - os: windows-latest
             target: windows-x86_64

strix/report/state.py

@@ -438,30 +438,37 @@ class ReportState:
         targets = self.run_record.get("targets_info") or []
         if not isinstance(targets, list):
             return None
-        for target in targets:
+        repo_targets = [
-            if not isinstance(target, dict) or target.get("type") != "repository":
+            target
-                continue
+            for target in targets
-            details = target.get("details") or {}
+            if isinstance(target, dict) and target.get("type") == "repository"
-            if not isinstance(details, dict):
+        ]
-                continue
+        # Provenance binds the whole run to one repo; with multiple repo targets
-            uri = details.get("target_repo")
+        # that's ambiguous, so omit it rather than mis-attributing later repos'
-            if not isinstance(uri, str) or not uri.strip():
+        # findings to the first repo's URI/commit.
-                continue
+        if len(repo_targets) != 1:
+            return None
+        target = repo_targets[0]
+        details = target.get("details") or {}
+        if not isinstance(details, dict):
+            return None
+        uri = details.get("target_repo")
+        if not isinstance(uri, str) or not uri.strip():
+            return None
 
-            context: dict[str, Any] = {"repositoryUri": uri.strip()}
+        context: dict[str, Any] = {"repositoryUri": uri.strip()}
-            full_name = _parse_repo_full_name(uri)
+        full_name = _parse_repo_full_name(uri)
-            if full_name:
+        if full_name:
-                context["repositoryFullName"] = full_name
+            context["repositoryFullName"] = full_name
-            cloned = details.get("cloned_repo_path")
+        cloned = details.get("cloned_repo_path")
-            if isinstance(cloned, str) and cloned.strip():
+        if isinstance(cloned, str) and cloned.strip():
-                commit, branch = _git_head(cloned.strip())
+            commit, branch = _git_head(cloned.strip())
-                if commit:
+            if commit:
-                    context["commitSha"] = commit
+                context["commitSha"] = commit
-                if branch:
+            if branch:
-                    context["branch"] = branch
+                context["branch"] = branch
-                    context["ref"] = f"refs/heads/{branch}"
+                context["ref"] = f"refs/heads/{branch}"
-            return context
+        return context
-        return None
 
     def _sync_llm_usage_record(self) -> None:
         self.run_record["llm_usage"] = self._build_llm_usage_record()

strix/telemetry/logging.py

@@ -63,6 +63,18 @@ _HANDLER_TAG = "_strix_scan_handler"
 # ``openai.agents`` is the openai-agents SDK's canonical logger root.
 _TRACKED_ROOTS: tuple[str, ...] = ("strix", "openai.agents")
 
+_STDOUT_QUIET_ROOTS: frozenset[str] = frozenset({"openai.agents"})
+
+
+class _StdoutQuietFilter(logging.Filter):
+    def filter(self, record: logging.LogRecord) -> bool:
+        if record.levelno >= logging.WARNING:
+            return True
+        return not any(
+            record.name == root or record.name.startswith(root + ".")
+            for root in _STDOUT_QUIET_ROOTS
+        )
+
 
 def configure_dependency_logging() -> None:
     """Quiet dependency logging/warnings that obscure Strix scan logs."""
@@ -119,6 +131,7 @@ def setup_scan_logging(run_dir: Path, *, debug: bool | None = None) -> Callable[
     stream_handler.setLevel(logging.DEBUG if debug else logging.ERROR)
     stream_handler.setFormatter(formatter)
     stream_handler.addFilter(context_filter)
+    stream_handler.addFilter(_StdoutQuietFilter())
     setattr(stream_handler, _HANDLER_TAG, True)
 
     tracked_loggers = [logging.getLogger(name) for name in _TRACKED_ROOTS]

tests/test_state_repo_context.py

@@ -41,6 +41,15 @@ def test_repository_context_uri_only_without_clone() -> None:
     }
 
 
+def test_repository_context_none_for_multiple_repository_targets() -> None:
+    state = ReportState(run_name="t")
+    state.run_record["targets_info"] = [
+        {"type": "repository", "details": {"target_repo": "https://github.com/acme/widget"}},
+        {"type": "repository", "details": {"target_repo": "https://github.com/acme/api"}},
+    ]
+    assert state._sarif_repository_context() is None
+
+
 def test_repository_context_derives_commit_and_branch_from_clone(tmp_path: Path) -> None:
     repo = tmp_path / "widget"
     repo.mkdir()