Demo: simulated malicious patterns for scanner testing

.github/workflows/sentinel-pr-bot.yml

@@ -37,14 +37,16 @@ jobs:
 
       - name: Run Sentinel local scan
         id: scan
+        shell: bash {0}
         env:
           SENTINEL_REPO: ${{ github.repository }}
           SENTINEL_PR: ${{ github.event.pull_request.number }}
           SENTINEL_AUTHOR: ${{ github.event.pull_request.user.login }}
         run: |
-          node dist/cli/pr_scan.js /tmp/pr_diff.txt > /tmp/sentinel_result.json
-          echo "FINDINGS=$(jq '.findings | length' /tmp/sentinel_result.json)" >> "$GITHUB_OUTPUT"
-          echo "DECISION=$(jq -r '.verdict.decision' /tmp/sentinel_result.json)" >> "$GITHUB_OUTPUT"
+          node dist/cli/pr_scan.js /tmp/pr_diff.txt > /tmp/sentinel_result.json || true
+          echo "FINDINGS=$(jq '.findings | length // 0' /tmp/sentinel_result.json)" >> "$GITHUB_OUTPUT"
+          echo "DECISION=$(jq -r '.verdict.decision // "PASS"' /tmp/sentinel_result.json)" >> "$GITHUB_OUTPUT"
+          echo "ERROR=$(jq -r '.error // "null"' /tmp/sentinel_result.json)" >> "$GITHUB_OUTPUT"
 
       - name: Post comment with results
         id: comment
@@ -54,6 +56,17 @@ jobs:
             const fs = require('fs');
             const result = JSON.parse(fs.readFileSync('/tmp/sentinel_result.json', 'utf8'));
 
+            const serverUrl = context.serverUrl || 'https://github.com';
+            const owner = context.repo.owner;
+            const repoName = context.repo.repo;
+            const headSha = context.payload.pull_request.head.sha;
+
+            function fileUrl(file, line) {
+              const base = `${serverUrl}/${owner}/${repoName}/blob/${headSha}`;
+              const encoded = file.startsWith('/') ? file.substring(1) : file;
+              return line ? `${base}/${encoded}#L${line}` : `${base}/${encoded}`;
+            }
+
             if (result.error) {
               await github.rest.issues.createComment({
                 ...context.repo,
@@ -86,31 +99,58 @@ jobs:
             if (highCrit.length > 0) {
               body += `### ⚠️ HIGH/CRITICAL (${highCrit.length})\n\n`;
               for (const f of highCrit) {
-                body += `- **${f.severity}** \`${f.type}\` — ${f.file}:${f.line}\n`;
+                const link = fileUrl(f.file, f.line);
+                body += `- **${f.severity}** \`${f.type}\` — [${f.file}:${f.line}](${link})\n`;
                 body += `  > ${f.description}\n`;
                 if (f.snippet) {
-                  body += `  \`\`\`\n${f.snippet}\n\`\`\`\n`;
+                  const truncated = f.snippet.length > 60 ? f.snippet.substring(0, 57) + '...' : f.snippet;
+                  body += `  \`${truncated}\`\n`;
                 }
                 body += '\n';
               }
             }
 
             if (lowMed.length > 0) {
               body += `### ℹ️ LOW/MEDIUM (${lowMed.length})\n\n`;
-              const byType = {};
               for (const f of lowMed) {
-                byType[f.type] = (byType[f.type] || 0) + 1;
-              }
-              for (const [type, count] of Object.entries(byType)) {
-                body += `- \`${type}\`: ${count}\n`;
+                const link = fileUrl(f.file, f.line);
+                body += `- \`${f.type}\` ${f.severity} — [${f.file}:${f.line}](${link})\n`;
               }
               body += '\n';
             }
 
-            if (highCrit.length === 0) {
+            // Supply chain section
+            const supplyChain = result.supplyChain ?? [];
+            if (supplyChain.length > 0) {
+              body += `### 📦 Supply Chain Scan\n\n`;
+              for (const pkg of supplyChain) {
+                const icon = pkg.verdict === 'MALICIOUS' ? '🔴' : pkg.verdict === 'SUSPICIOUS' ? '🟡' : pkg.verdict === 'SKIPPED' ? '⚪' : '🟢';
+                body += `${icon} **\`${pkg.package}\`** — ${pkg.verdict}`;
+                if (pkg.findings?.length) {
+                  body += ` — ${pkg.findings.length} finding(s)`;
+                } else {
+                  body += ` — ${pkg.fileCount} files scanned`;
+                }
+                body += '\n\n';
+                if (pkg.findings?.length > 0) {
+                  for (const f of pkg.findings.slice(0, 3)) {
+                    body += `  - \`${f.type}\` ${f.severity} — ${f.file}:${f.line}\n`;
+                  }
+                  if (pkg.findings.length > 3) {
+                    body += `  - _(+ ${pkg.findings.length - 3} more)_\n`;
+                  }
+                  body += '\n';
+                }
+              }
+            }
+
+            if (highCrit.length === 0 && supplyChain.length === 0) {
               body += `### ✅ No threats detected\n\n`;
             }
 
+            body += `#### 💡 Inline Bypass\n`;
+            body += `Añade \`// sentinel-disable-line RULE\` al final de la línea ofensiva para ignorarla:\n\n`;
+            body += `\`\`\`js\neval('data'); // sentinel-disable-line UNSAFE_EVAL\n\`\`\`\n\n`;
             body += `---\n`;
             body += `_Scanned locally by Sentinel CLI v4 LiteScanner | `;
             body += `Hash: \`${(result.contentHash ?? '').substring(0, 12)}\`_`;

.gitignore

@@ -1,4 +1,5 @@
 node_modules/
+dist/
 *.tsbuildinfo
 .env*
 *.db