[lvj-repox]

Scope

Known C++ simple-var parser warning is narrowly advisory with explicit incomplete coverage. Unknown errors, missing reports, and real blockers remain enforced. Production scanner image unchanged.

Verified

• 139 Linux unit tests, including 13 focused cases (unknown errors, process failures, missing/malformed reports, retained blockers and partial summaries).
• Candidate CI passed: https://github.com/HYGON-AI/quality-gate/actions/runs/35569513712
• Original rocSHMEM source replay: all four jobs passed; advisory line 1136: https://github.com/HYGON-AI/open-source-governance/actions/runs/35569583189
• Malformed Python controls failed the overall gate as intended: https://github.com/HYGON-AI/open-source-governance/actions/runs/35569835447 and https://github.com/HYGON-AI/open-source-governance/actions/runs/35570109094
• Second control retained subprocess-shell-true finding alongside C++ advisory. Semgrep tolerated the malformed Python, so unknown parser failure enforcement is verified by focused unit tests, not claimed from this live control.
• Invalid test file removed; restored candidate replay: https://github.com/HYGON-AI/open-source-governance/actions/runs/35570334026

Do not merge test PR open-source-governance#33. Publish v2.0.6 and move stable only after final replay succeeds and this fix PR is merged.

[hygon-ai-reviewer]

AI Review

🟢 未发现有明确证据的问题

在已提供并完成审查的 diff 范围内未形成可确认问题。

变更概览

本次变更主要包含：

• 将质量门禁版本引用从 v2.0.5 升级至 v2.0.6，并在 quality-security 策略的 semgrep 配置中启用 C++ simple-var 兼容性告警的 advisory 开关，同时新增设计、复现与发布说明文档。
• 将 Semgrep 发现中的 C++ 解析器兼容性提示项从变更行过滤中豁免，并在其出现时把扫描状态标记为 partial（覆盖不完整），其余发现仍按变更行过滤保留。
• 渲染摘要新增 partial 状态图标、覆盖不完整警告及扫描执行异常下提示项的补充说明，并将包版本号升至 2.0.6。
• semgrep 解析器在策略开关控制下将已复现的 C++ 简单变量解析警告降级为不阻断的劝告级发现，同时收紧报告 results/errors 结构校验，并在模型中新增 partial 扫描器状态。

文件审查摘要

文件	变更	审查结果
tests/test_semgrep_cpp_coverage.py	新增 · +133/-0	—
tests/semgrep_cpp_probe.py	新增 · +81/-0	—
docs/plans/2026-09-21-semgrep-cpp-reproduction.md	新增 · +70/-0	—
tests/semgrep_cpp_gate_replay.py	新增 · +42/-0	—
src/hygon_quality_security/scanner_parsers.py	修改 · +32/-3	—
docs/plans/2026-09-21-semgrep-coverage-design.md	新增 · +29/-0	—
docs/releases/v2.0.6.md	新增 · +11/-0	—
src/hygon_pr_gate/local_executor.py	修改 · +10/-1	—
README.en.md	修改 · +7/-3	—
README.md	修改 · +6/-3	—
src/hygon_pr_gate/render_summary.py	修改 · +7/-0	—
.github/workflows/pr-quality-gate.yml	修改 · +1/-1	—
pyproject.toml	修改 · +1/-1	—
src/hygon_quality_security/models.py	修改 · +1/-1	—
policies/quality-security/hygon-quality-security-v1.1.yaml	修改 · +1/-0	—

审查信息

• 变更统计：15 个文件，+432/-13。
• 覆盖情况：共 15 个文件，已完整审查 15 个。
• 候选问题：0 项；证据复核过滤：0 项；发布前敏感信息保护：0 项。
• 本服务以 GitHub 提供的 PR diff 为审查主体，PR 描述与按相关性选取的仓库片段仅用于核验；未执行代码或重跑测试，结论仍需维护者核验。