V2 by vishnu-deepsource · Pull Request #264 · DeepSourceCorp/cli

vishnu-deepsource · 2026-01-27T05:17:38Z

No description provided.

…features

Move utility packages from root `utils/` and `configvalidator/` into organized `internal/` subdirectories: - utils/prompt.go → internal/cli/prompt/ - utils/colors.go → internal/cli/style/ - utils/cmd_validator.go → internal/cli/args/ - utils/fetch_oidc_token.go → internal/oidc/ - utils/remote_resolver.go → internal/vcs/ - utils/fetch_remote.go → internal/vcs/remotes.go - configvalidator/* → internal/configvalidator/ - utils/fetch_analyzers_transformers.go → internal/configdata/ Add shell completion support via internal/cli/completion package. Update all import paths across commands and services to reflect new structure. This improves code organization and follows Go's internal package conventions for better encapsulation.

- Add new `auth whoami` command to display authenticated user info - Add new `issues browse` command for opening issues in browser - Add GetViewer API method to fetch authenticated user details - Refactor output messages to use pterm.Print* instead of pterm.Info for consistency across auth, config, issues, and repo commands - Update dependencies (pterm, testify, bubbletea, lipgloss)

- Add `runs list` command to display analysis runs for a repository - Add `runs issues` command to show issues for a specific run - Add GetAnalysisRuns and GetRunIssues API methods to client - Add GraphQL schema and queries for runs and run issues - Refactor whoami command to use boxed output format - Remove issues browse command - Add runs domain types and query helpers

Update all Go dependencies to their latest versions including: - github.com/spf13/cobra: v1.5.0 → v1.10.2 - github.com/spf13/viper: v1.7.1 → v1.21.0 - github.com/getsentry/sentry-go: v0.6.0 → v0.41.0 - github.com/stretchr/testify: v1.8.4 → v1.11.1 - github.com/fatih/color: v1.12.0 → v1.18.0 - github.com/google/go-cmp: v0.5.5 → v0.6.0 Also includes improvements to issues display: - Add terminal width-aware table rendering with column wrapping - Improve issue location formatting (single line vs range) - Add color-coded severity formatting - Add JSON export capability for run issues with --json and --output-file flags

Add support for filtering issues by analyzer, category, severity, code, and path. Filters can be specified multiple times to match any of the provided values. New flags: - --analyzer: filter by analyzer shortcode - --category: filter by issue category - --severity: filter by severity level - --code: filter by issue code - --path: filter by file path (supports partial matching) Also refactor runs command to accept commit-oid argument and wire up issue flags via AddRunIssueFlags for better flag reusability.

- Replace Makefile with justfile, add VERSION file for version tracking - Replace goreleaser release pipeline with build-and-deploy workflow - Add install script template - Move version/ package to buildinfo/ - Swap DataDog/zstd (cgo) for klauspost/compress/zstd (pure Go) - Replace deprecated io/ioutil usage with os and io - Bump Go version to 1.25 in CI - Update SARIF schema URL to official OASIS source - Add TCP readiness check for mock server in tests - Update README with auth docs and current command list

- Drop config generate/validate commands and supporting packages - Drop issues list command and related services - Remove configvalidator, configdata, and issues service packages - Update root command registrations and dependencies - Clean up justfile test targets

- Add top-level issues, metrics, and vulnerabilities commands with SDK queries - Add transparent token refresh in GraphQL client (removes need for auth refresh) - Remove version, auth refresh, and auth whoami commands - Add UserError type to skip user-correctable errors from Sentry - Improve Sentry setup with panic recovery, release tagging - Add YAML output format and source filter for run issues - Auto-open browser on login instead of waiting for user input - Update GraphQL schema to use issues instead of occurrences - Use --version flag instead of version subcommand - Clean up error messages and stale code

- Rename `repo` to `repository` and `runs` to `analysis` - Rename `--run` flag to `--commit` across issues, metrics, and vulnerabilities - Update default hostname from deepsource.io to deepsource.com - Add `human` output format as new default, keep `table` as explicit option - Add `--output-file`, `--verbose`, `--analyzer` filter, and `--limit` flags - Remove legacy YAML config support and debug logging infrastructure - Add `GetEnabledAnalyzers` API endpoint and repository analyzers command - Fix report service using Errorf instead of Printf for info messages

- Rename "human" output format to "pretty" in issues, metrics, and vulnerabilities - Simplify issues table: remove boxed style, drop wrapText, conditionally show SOURCE column - Humanize displayed values (severity, status, reachability, ecosystem) - Add ECOSYSTEM column to vulnerabilities table - Use helper functions for formatting location, severity, and analyzer names

- Rename telemetry → sentry across adapters, interfaces, and container - Introduce cmddeps.Deps struct for injectable config, client, and stdout - Add NewCmd*WithDeps constructors to all commands for testability - Add --output json flag to analysis command - Add golden-file-based tests for analysis, issues, metrics, vulnerabilities, repo status, repo analyzers, and auth status commands - Add NewWithGraphQLClient and NewTestService test helpers - Always show auth URL in login flow regardless of browser open result - Update justfile with new test paths

- Change table headers from ALL CAPS to Title Case across all commands - Normalize status labels to Title Case in analysis output - Rename default output format from "table" to "pretty", keeping "table" as alias - Add "pretty" to shell completion candidates

- Introduce buildinfo app identity vars (AppName, ConfigDirName, KeychainSvc, KeychainKey) with prod defaults - Override identity at startup when buildMode=dev via ldflags, giving dev builds their own binary name, config dir, and keychain entries - Update build-and-deploy workflow to pass buildMode and use dynamic binary names per environment - Replace hardcoded "deepsource" strings with buildinfo vars in config, keychain, and root command - Remove shell completion generation (gen-completions.sh deleted, references stripped from workflows and Homebrew formula) - Add just install step to CI workflow - Rename deploy -> deploy-prod in justfile, add build alias

- Add the three info-level progress lines that the report service now emits (preparing, compression check, uploading)

- Update report golden file with info-level progress lines - Fix case mismatches in OIDC tests (failed -> Failed, can not -> cannot, provider -> Provider)

- Add environment check to codesign, notarize, and verify signing steps - Only run Apple signing workflow when building for prod

- GitHub Actions blocks job outputs that match secret values - Move bucket resolution from resolve-env outputs to deploy step - Reference secrets directly in deploy job based on environment

- Point dev base_url to cli.deepsource.one subdomain instead of deepsource.one/cli - Drop cli/ key prefix for dev R2 uploads since the subdomain serves the bucket root - Fix manifest path in install script (/manifest.json, not /build/manifest.json)

deepsource-io · 2026-02-26T01:18:57Z

cmd/deepsource/main.go

+	}()
+
+	exitCode := run()
+	os.Exit(exitCode)


`os.Exit` skips deferred function execution

The call to os.Exit(exitCode) stops all goroutines and the main program immediately without running deferred functions. This means defer statements for resource cleanup or finalization won't execute, possibly leading to resource leaks or inconsistent state.

Refactor to avoid direct os.Exit calls in functions with defer. Use return statements combined with a deferred os.Exit at a higher level to ensure defer calls run before program termination.

deepsource-io · 2026-02-26T01:18:57Z

command/cmdutil/resolve_run.go

+// used by the issues, metrics, and vulnerabilities commands. It detects the
+// current branch, checks for an open PR, waits for in-progress runs, and
+// handles fallback/timeout scenarios.
+func ResolveAutoBranch(


High cyclomatic complexity reduces code maintainability

The function ResolveAutoBranch has a cyclomatic complexity above recommended thresholds, indicating many independent execution paths. This complexity increases the chance of bugs and makes the function difficult to maintain or test.

Refactor ResolveAutoBranch by splitting into smaller functions or simplifying control flow. This reduces complexity and improves code clarity and testability.

deepsource-io · 2026-02-26T01:18:57Z

command/auth/login/login.go

+	if err != nil {
+		return
+	}


Error from `deepsource.New` is silently ignored during token verification

The error returned by deepsource.New is not handled. If client instantiation fails due to a misconfiguration or network issue, the token verification process is silently aborted, and the application continues assuming the token is valid. This can mask underlying problems and lead to confusing errors later.

Consider treating a client creation failure as a token verification failure by setting opts.TokenExpired = true. This would force a re-login, allowing the user to correct the configuration.

deepsource-io · 2026-02-26T01:22:36Z

cmd/deepsource/main.go

+	}()
+
+	exitCode := run()
+	os.Exit(exitCode)


`os.Exit` skips deferred calls, causing resource leaks

Using os.Exit directly in a function with deferred calls prevents execution of those deferred calls, leading to unclosed resources or incomplete cleanup steps. This abrupt termination skips all deferred functions concluding the program instantly.

Replace direct calls to os.Exit with structured returns and a top-level deferred os.Exit or handle cleanup explicitly before exiting to ensure all deferred functions run.

deepsource-io · 2026-02-26T01:22:36Z

command/cmdutil/resolve_run.go

+// used by the issues, metrics, and vulnerabilities commands. It detects the
+// current branch, checks for an open PR, waits for in-progress runs, and
+// handles fallback/timeout scenarios.
+func ResolveAutoBranch(


Function `ResolveAutoBranch` has excessive decision points

The ResolveAutoBranch function has high cyclomatic complexity, indicating numerous decision points and independent paths. This complexity increases the risk of bugs and makes the function harder to understand and maintain.

Break down ResolveAutoBranch into smaller, simpler functions or refactor complex control flow to reduce complexity and improve code clarity and testability.

deepsource-io · 2026-02-26T01:22:36Z

command/cmdutil/resolve_run.go

+		if runErr == nil {
+			result.CommitOid = run.CommitOid
+		}
+		return result, nil


The error `runErr` from `ResolveLatestRunForBranch` is ignored

In the pull request resolution path, if ResolveLatestRunForBranch returns an error, it is effectively ignored. The function proceeds to return a nil error with a result where CommitOid is not set, which can lead to unexpected behavior in the calling commands that might assume CommitOid is always present if a PR is found.

The error runErr should be checked immediately after the call to ResolveLatestRunForBranch and propagated to the caller to ensure robust error handling.

- Use dynamic base URL for legacy install script instead of hardcoded deepsource.io/cli - Remove prod/dev prefix branching in R2 upload, always use empty prefix - Extract mainRun() with named return so defer handles panic exit code without calling os.Exit in deferred func - Split ResolveAutoBranch into resolveWithPR/resolveWithoutPR helpers - Handle os.Setenv/os.Unsetenv errors in report test setup - Add unit tests for detectProvider, extractRepoName, extractOwner, extractADSOwner - Add GitLab, Bitbucket, and unsupported provider cases for GetRemoteMap - Add tests for testutil helpers (LoadGoldenFile, MockQueryFunc, CreateTestConfigManager)

- Replace hardcoded "deepsource" with resolve-env binary_name output - Keeps legacy install script consistent with the rest of the workflow

- Prefix "branch " to scope labels in issues, metrics, reportcard, and vulnerabilities commands so output reads "branch main" instead of "main" - Switch deploy tags from annotated (-a) to signed (-s) in justfile

- Homebrew formula generation and push to homebrew-cli repo no longer needed

Signed-off-by: Jai Pradeesh <jai@deepsource.io>

- Add detailed usage, flags, and examples to the root cobra command using heredoc - Replace manual CODE_PATH env save/restore with t.Setenv in report tests - Add report service tests: no-compression, server error, HTTP error, cert skip, sentry capture - Add edge case tests for ADS/SSH owner extraction in remotes_test

…letions - Replace server-side limit params with cursor-based auto-pagination for issues and vulnerabilities queries (new deepsource/pagination package) - --limit flag is now a client-side display cap (0 = fetch all) - Remove repo analyzers subcommand, fold analyzer listing into repo status - Add --install-completions flag to root command (bash, zsh, fish) - Update root help text and add test coverage for pagination

- Rename --hostname to --host in login, keep --hostname as deprecated alias - Rename --deepsource-host-endpoint to --host in report, keep old flag as deprecated - Resolve host from config when --host flag is not explicitly set - Replace --install-completions global flag with `completion` subcommand - Simplify README to focus on what the CLI does - Auto-run shell completion setup in install script

- Swap heredoc-based Long/Example for a custom rootHelpFunc with colored section headers and grouped commands - Add buildExampleText helper with gray comments - Add Bold, BoldCyan, Gray style functions - Customize help/version flag usage strings

- Cluster issues by title/severity/code and show occurrence count with compact file:line locations instead of repeating full blocks - Bump MaxResults from 500 to 1000 and warn when results are capped - Fix version flag init order in root command (InitDefaultVersionFlag before Lookup, add nil guard) - Add unit tests for grouping, line range formatting, and location collapsing, plus integration test for the cap warning

- Add tests for config manager (Load, Write, Delete, TokenRefresh) - Add tests for GraphQLError, TruncateQuery, and MockClient - Add tests for pagination, style, and errors packages - Replace unused function params with _ across test files - Use value receivers on captureSentry stub methods - Collapse repeated append calls in root.go buildExampleText - Tighten file permissions in completion install (750/600)

deepsource-io · 2026-02-27T00:47:46Z

command/cmdutil/resolve_run_test.go

+
+	callCount := 0
+	mock := graphqlclient.NewMockClient()
+	mock.QueryFunc = func(_ context.Context, query string, _ map[string]any, result any) error {


Parameter `result` is defined but unused

The function assigned to mock.QueryFunc defines a parameter result which is never used anywhere within the function body. This unused parameter can imply unfinished implementation or redundant code, making it harder to understand or maintain.

Rename the unused parameter to _ or remove it entirely if it's not needed to clarify the code intent and avoid unnecessary warnings.

- Pull config loading and client creation into a separate helper - Silence unused-parameter lint warnings in test files

- Change WriteFile mode from 0644 to 0600 - Config may contain auth tokens, so it should not be world-readable

jai-deepsource self-requested a review January 28, 2026 03:03

jai-deepsource self-assigned this Jan 28, 2026

This was referenced Jan 28, 2026

Upgrade Go to 1.25.3 and refresh dependencies #258

Closed

feat(issues): add severity filtering support to list command #259

Closed

vishnu-deepsource and others added 7 commits January 28, 2026 15:17

refactor: CLI architecture refactor, to improve DX, and to add newer …

55044ed

…features

jai-deepsource force-pushed the v2 branch from 7b371af to f9dafcb Compare January 28, 2026 09:47

jai-deepsource added 18 commits January 28, 2026 15:53

Bump version to 2.0.1

c3e6e01

Update report golden file with info log lines

2b1e881

- Add the three info-level progress lines that the report service now emits (preparing, compression check, uploading)

Fix test assertions to match actual error strings

7170740

- Update report golden file with info-level progress lines - Fix case mismatches in OIDC tests (failed -> Failed, can not -> cannot, provider -> Provider)

Bump version to 2.0.2

137acb9

Skip codesigning for non-prod builds

36ee8ff

- Add environment check to codesign, notarize, and verify signing steps - Only run Apple signing workflow when building for prod

Bump version to 2.0.3

3b69adb

Bump version to 2.0.4

d6bc6a9

Bump version to 2.0.5

eaeb9b6

Resolve R2 bucket name directly in deploy job

287ecef

- GitHub Actions blocks job outputs that match secret values - Move bucket resolution from resolve-env outputs to deploy step - Reference secrets directly in deploy job based on environment

Bump version to 2.0.6

54b683a

deepsource-io bot reviewed Feb 26, 2026

View reviewed changes

jai-deepsource added 8 commits February 25, 2026 20:35

Bump version to 2.0.23

175bf9f

Use dynamic binary name in legacy install script

886dd9d

- Replace hardcoded "deepsource" with resolve-env binary_name output - Keeps legacy install script consistent with the rest of the workflow

Bump version to 2.0.24

849d86a

Add branch prefix to scope labels, use signed tags

2cc4cc2

- Prefix "branch " to scope labels in issues, metrics, reportcard, and vulnerabilities commands so output reads "branch main" instead of "main" - Switch deploy tags from annotated (-a) to signed (-s) in justfile

Bump version to 2.0.25

7bb50ae

Bump version to 2.0.26

2cd7dab

Remove publish-homebrew job from CI workflow

9ec57aa

- Homebrew formula generation and push to homebrew-cli repo no longer needed

jai-deepsource previously approved these changes Feb 26, 2026

View reviewed changes

Bump version to 2.0.27

fc3123b

Signed-off-by: Jai Pradeesh <jai@deepsource.io>

jai-deepsource dismissed their stale review via fc3123b February 26, 2026 16:02

jai-deepsource force-pushed the v2 branch from f28d302 to fc3123b Compare February 26, 2026 16:02

jai-deepsource added 9 commits February 26, 2026 11:13

Bump version to 2.0.28

5c2e0b0

Bump version to 2.0.29

12b56ce

Bump version to 2.0.30

824e934

deepsource-io bot reviewed Feb 27, 2026

View reviewed changes

jai-deepsource added 4 commits February 26, 2026 16:52

Extract initClientAndConfig from issues Run method

d5e9ff4

- Pull config loading and client creation into a separate helper - Silence unused-parameter lint warnings in test files

Bump version to 2.0.31

846c4c7

Restrict config file permissions to owner-only

1237059

- Change WriteFile mode from 0644 to 0600 - Config may contain auth tokens, so it should not be world-readable

Bump version to 2.0.32

f01631c

jai-deepsource merged commit b731e1f into master Feb 27, 2026
10 of 12 checks passed

jai-deepsource deleted the v2 branch February 27, 2026 03:05

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

V2#264

V2#264
jai-deepsource merged 92 commits intomasterfrom
v2

vishnu-deepsource commented Jan 27, 2026

Uh oh!

deepsource-io bot Feb 26, 2026

Uh oh!

deepsource-io bot Feb 26, 2026

Uh oh!

deepsource-io bot Feb 26, 2026

Uh oh!

deepsource-io bot Feb 26, 2026

Uh oh!

deepsource-io bot Feb 26, 2026

Uh oh!

deepsource-io bot Feb 26, 2026

Uh oh!

deepsource-io bot Feb 27, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

Conversation

vishnu-deepsource commented Jan 27, 2026

Uh oh!

deepsource-io bot Feb 26, 2026

Choose a reason for hiding this comment

`os.Exit` skips deferred function execution

Uh oh!

deepsource-io bot Feb 26, 2026

Choose a reason for hiding this comment

High cyclomatic complexity reduces code maintainability

Uh oh!

deepsource-io bot Feb 26, 2026

Choose a reason for hiding this comment

Error from `deepsource.New` is silently ignored during token verification

Uh oh!

deepsource-io bot Feb 26, 2026

Choose a reason for hiding this comment

`os.Exit` skips deferred calls, causing resource leaks

Uh oh!

deepsource-io bot Feb 26, 2026

Choose a reason for hiding this comment

Function `ResolveAutoBranch` has excessive decision points

Uh oh!

deepsource-io bot Feb 26, 2026

Choose a reason for hiding this comment

The error `runErr` from `ResolveLatestRunForBranch` is ignored

Uh oh!

deepsource-io bot Feb 27, 2026

Choose a reason for hiding this comment

Parameter `result` is defined but unused

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants