[alerizzo]

Summary

codacy findings can now narrow to container scanning results (OD-1049).

• --scan-types accepts ContainerSCA. That is the API value (as SearchSRMItems.scanTypes lists it in api-v3/api-swagger.yaml), not ContainerScanning as the ticket names it. ContainerScanning and Container are accepted as aliases, normalized like the other scan types (case-insensitive, spaces/hyphens/underscores ignored). The normalized list is now de-duplicated, since several aliases resolve to the same value.
• New -i, --image <name> and -t, --image-tag <tag> map to the search body's containerImage (ContainerImageFilter) through parseImageFilter. Values are trimmed, and --image name:tag is split into name and tag; only a colon after the last / starts a tag, so registry:5000/app stays a name. Input the API would mishandle silently is refused before any request or git auto-detection: empty values (a truthiness check would drop --image "" and widen to the whole org), a tag without a name, a digest reference, or two different tags.
• Container findings show their image instead of the repository. The card's header line shows name:tag (just name when there is no tag) in the slot the repository uses in org-wide listings, since these findings are about an image, not a repository. It is shown in the single-repository view too, where the repository is hidden. finding <id> does the same on its header line, through the shared formatImageReference. Non-container findings are unchanged. Both commands' --output json gains imageName and imageTag.

Input	Request body
-T ContainerSCA / container-scanning / Container	scanTypes: ["ContainerSCA"]
-T ContainerSCA,container	scanTypes: ["ContainerSCA"] (de-duplicated)
--image nginx	containerImage: { name: "nginx" }
--image nginx --image-tag 1.25.3	containerImage: { name: "nginx", tag: "1.25.3" }
--image nginx:1.25.3	containerImage: { name: "nginx", tag: "1.25.3" }
--image registry:5000/app	containerImage: { name: "registry:5000/app" }
--image-tag 1.25.3	refused: Error: --image-tag requires --image <name>.
--image ""	refused: Error: --image needs an image name, but the value is empty.
--image nginx:1.25.3 --image-tag 1.26.0	refused: different tags
--image nginx@sha256:…	refused: digest reference

--image does not add ContainerSCA to the scan types by itself; the API applies the image filter on its own.

Test plan

• npx vitest run src/commands/findings.test.ts src/commands/finding.test.ts src/utils/formatting.test.ts: 25 new tests across the three files (scan-type aliases, image filter request bodies and refusals, parseImageFilter unit tests, image-in-place-of-repository rendering on both commands, JSON fields, formatImageReference)
• npm test: 823 passing
• npx tsc --noEmit -p .
• codacy findings gh <org> --scan-types ContainerSCA --image <name> --image-tag <tag> against an org with container findings

🤖 Generated with Claude Code

[codacy-production]

Not up to standards ⛔

🔴 Issues 1 medium

Alerts:
⚠ 1 issue (≤ 0 issues of at least minor severity)

Results:
1 new issue

Category	Results
Complexity	1 medium

View in Codacy

🟢 Metrics 70 complexity · 14 duplication

Metric	Results
Complexity	70
Duplication	14

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

✅ No blocking issues noticed

No blocking implementation issues were identified.

Codacy also found:

• Four expected test-fixture code clones in src/commands/findings.test.ts.
• No static-analysis issues; coverage data was unavailable.

Test suggestions

• ContainerSCA and its aliases normalize to ContainerSCA.
• Spaces, hyphens, underscores, and case variations are accepted during normalization.
• Repeated aliases are de-duplicated in the request body.
• ContainerImageFilter is not exposed as a CLI option.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. ContainerImageFilter is not exposed as a CLI option.

_{TIP How was this review? Give us feedback}

[alerizzo]

SHOULD fix before merge: an empty or padded --image silently drops or mangles the filter

if (opts.image) is a truthiness check, and Commander passes --image "" through as "". So codacy findings gh org --image "$IMG" with IMG unset sends no containerImage at all, and returns every finding in the organization instead of failing. That is the opposite of what a script narrowing to one image wants. The value is also never trimmed, so --image " nginx" sends " nginx" and matches nothing. The comma-list options trim via parseCommaList, so this one is inconsistent with them.

Verified locally: parsing --image "" gives {"image":""}. Refusing an empty or whitespace-only --image/--image-tag before the request, and trimming both, would close it.

_{🤖 Generated by /review-pr command}

[alerizzo]

Fixing. --image/--image-tag now go through parseImageFilter, which trims both values and refuses an empty or whitespace-only one before git auto-detection or any request, so an unset $IMG errors instead of widening to the whole org.

_{🤖 Generated by /pr-fixup command}

[alerizzo]

SHOULD fix before merge: --image nginx:1.25.3 is sent as the image name

Container cards now print the image as name:tag, so copying that value into --image is the natural next step. That whole string goes to the API as containerImage.name, which matches nothing, and the command quietly reports no findings. Nothing tells the user the tag belongs in --image-tag.

Either split a name:tag reference (the tag is what follows the last : after the last /, so a registry port like host:5000/app is not mistaken for a tag), or refuse it with a hint to use --image-tag. Both are local and run before the request.

_{🤖 Generated by /review-pr command}

[alerizzo]

Fixing. --image nginx:1.25.3 is now split into name and tag. Only a colon after the last / starts a tag, so registry:5000/app stays a name. Two different tags (--image nginx:1.25.3 --image-tag 1.26.0) and digest references (@sha256:) are refused rather than sent.

_{🤖 Generated by /pr-fixup command}

[alerizzo]

codacy-cloud-cli/src/commands/finding.ts

Line 66 in 4bac273

if (item.repository) line1Parts.push(ansis.dim(sanitizeText(item.repository)));

SHOULD fix before merge: finding <id> still says nothing about the container image

This PR makes findings show container findings by image:tag, and adds imageName/imageTag to its JSON. The detail command, which users run next with the id from that card, wasn't updated. Its header line still shows item.repository, and its pickDeep list has neither field. So codacy findings gh org --image nginx lists a finding as nginx:1.25.3, but codacy finding gh org <id> no longer says which image it is about, and --output json has no image fields for a script to read.

Matching findings (the header shows the image, JSON gains imageName/imageTag) keeps the list and detail views consistent.

_{🤖 Generated by /review-pr command}

[alerizzo]

Re #66 (comment) (finding <id> not showing the container image): fixing. finding now shows image:tag in the repository's slot on its header line, through a formatImageReference helper shared with findings, and its JSON gains finding.imageName / finding.imageTag.

_{🤖 Generated by /pr-fixup command}