feat(findings): show vulnerable dependency import chains

[alerizzo]

Summary

• findings (list) and finding (detail) now render the vulnerable dependency's import chain from the new SCA dependencyChains field.
• Each finding is labelled Direct (Update <pkg> to <fixedVersion>) or Transitive (<pkg> → … → <pkg> (Fixed in <fixedVersion>)); chains with 4+ packages collapse their middle to <first> → ... N more ... → <last>. The list shows the first chain + ... and X more; the detail lists every chain aligned under one label. When chains are present, the redundant version segment is dropped from the status line. dependencyChains is also included in --output json.
• Rendering lives in three shared helpers in src/utils/formatting.ts (formatDependencyChain, formatDependencyChainsLine, formatDependencyChainsBlock). No API-client regeneration needed — the field was already in the generated SrmItem model.
• Also updates the personal /ship-it command to wait for the AI reviewers and auto-run /pr-fixup after opening a PR.

Test plan

• npm test (17 new tests, 390 total — unit tests for the helpers plus list/detail command tests)
• npm run build (strict-mode type-check)
• Manual: npx ts-node src/index.ts findings gh <org> <repo> --scan-types SCA and npx ts-node src/index.ts finding gh <org> <findingId> against an SCA finding with transitive deps; confirm the Direct/Transitive line, the ... and X more suffix, and middle collapse. Add --output json to confirm dependencyChains is present.

🤖 Generated with Claude Code

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 8 duplication

Metric	Results
Duplication	8

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[gemini-code-assist]

Code Review

This pull request introduces support for displaying vulnerable dependency import chains (SCA findings) in both the findings list and finding detail commands, utilizing a new dependencyChains field. It adds formatting utilities, comprehensive unit tests, and updates the corresponding specifications and documentation. Additionally, the .claude/commands/ship-it.md command has been updated to support waiting for AI reviews and automatically running /pr-fixup by default. There are no review comments to address, so I have no additional feedback to provide.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[codacy-production]

Pull Request Overview

The implementation successfully adds dependency import chain visibility to SCA findings; however, the PR includes significant scope expansion into the /ship-it automation tool that is unrelated to the core feature. While the project remains up to standards according to Codacy, there is a lack of verification for the complex bash logic introduced in .claude/commands/ship-it.md. Additionally, code duplication exists in how version transitions are formatted across different command outputs, which should be consolidated to ensure consistency.

About this PR

• The complex bash script added to .claude/commands/ship-it.md for polling GitHub reviews is not covered by any automated tests or verification logic, posing a maintenance risk.
• This PR contains significant scope expansion. Changes to the /ship-it automation tool should ideally be handled in a separate PR to maintain focused review cycles and clear history.

Test suggestions

• Unit test formatDependencyChain to verify arrow joining and middle-collapse logic for 4+ packages.
• Unit test formatDependencyChainsLine to verify single-line summary with 'more' suffix and correct labeling.
• Unit test formatDependencyChainsBlock to verify multi-line aligned output for finding details.
• Command test for findings (list) ensuring the version segment is suppressed when SCA chains are present.
• Command test for finding (detail) ensuring all chains are rendered and redundant versions are suppressed.
• Verification that dependencyChains is present in the pickDeep whitelist for JSON output in both commands.
• Verification of the bash polling logic in ship-it.md (checking bot logins and submitted_at timestamps).

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verification of the bash polling logic in `ship-it.md` (checking bot logins and `submitted_at` timestamps).

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}

[codacy-production]

_{🟡 MEDIUM RISK}

Suggestion: The logic for calculating and formatting the version transition (affectedVersion -> fixedVersion) while suppressing it when dependency chains are present is duplicated between finding.ts and findings.ts. Since you've already introduced dependency chain helpers in src/utils/formatting.ts, this logic should also be centralized to ensure consistency.

Try running the following prompt in your IDE agent:

In src/utils/formatting.ts, create a helper formatVersionSegment(affectedVersion?: string, fixedVersion?: string[], options?: { includeUpdatePrefix?: boolean }) that handles the logic seen in src/commands/finding.ts (lines 83-89) and src/commands/findings.ts (lines 117-123). Then refactor both files to use it.

[alerizzo]

Good call — extracted formatVersionSegment(affectedVersion, fixedVersion, { includeUpdatePrefix }) in utils/formatting.ts and refactored both finding.ts and findings.ts to use it (the list passes includeUpdatePrefix: true; the detail omits it). Fixed in d0c8341.

_{🤖 Generated by /pr-fixup command}

[Copilot]

Pull request overview

This PR enhances the findings (list) and finding (detail) commands to display SCA vulnerable dependency import chains using the dependencyChains field, including Direct vs Transitive labeling, chain collapsing for long paths, and inclusion in --output json.

Changes:

• Added shared dependency-chain formatting helpers (formatDependencyChain, formatDependencyChainsLine, formatDependencyChainsBlock) and unit tests for them.
• Updated findings and finding command output to render dependency chains (and omit the redundant affected→fixed segment when chains are present), plus expanded JSON projections.
• Updated specs/docs, changeset, and the repo’s .claude/commands/ship-it.md workflow instructions.

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/utils/formatting.ts	Adds shared helpers to render dependency chains consistently (collapsed display, Direct/Transitive labeling).
src/utils/formatting.test.ts	Adds unit tests covering chain formatting, list-line rendering, and detail-block alignment/collapsing.
src/commands/findings.ts	Renders the first dependency chain in list output and includes dependencyChains in JSON output.
src/commands/findings.test.ts	Adds command-level tests validating list rendering for direct/transitive chains and multi-chain suffix.
src/commands/finding.ts	Renders all dependency chains in detail output and includes dependencyChains in JSON output.
src/commands/finding.test.ts	Adds command-level tests validating multi-chain block rendering, collapse behavior, and JSON inclusion.
src/commands/AGENTS.md	Documents the new shared dependency-chain helpers and the commands’ rendering rules.
SPECS/README.md	Adds a changelog entry describing the new dependency-chain output behavior and tests count.
SPECS/commands/findings.md	Updates the findings command spec to describe the dependency-chain line and rules.
SPECS/commands/finding.md	Updates the finding command spec to describe the dependency-chains block and rules.
.claude/commands/ship-it.md	Updates ship-it instructions to wait for AI reviews and optionally run /pr-fixup.
.changeset/findings-dependency-chains.md	Adds a minor changeset documenting the new CLI behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[alerizzo]

Thanks for the reviews. Addressing the review-level points from the Codacy overview:

• CI type-check failure (build-and-test): fixed. The generated API client (src/api/client/) and api-v3/api-swagger.yaml are gitignored and regenerated in CI via npm run update-api, which fetches the spec from the URL in package.json. That URL was still pointing at spec 55.12.1, which has no dependencyChains — so CI generated a client without the field and the type-check failed. Bumped the spec to 56.1.1 (the version that introduces dependencyChains) in d0c8341. Verified locally by running the exact CI flow (npm run update-api → npx tsc --noEmit).
• Scope expansion (/ship-it): intentional for this PR — the maintainer opted to include the /ship-it command update here. Point taken that command/tooling changes are generally cleaner as a separate PR.
• Untested bash in ship-it.md: ship-it.md is a Claude Code command (prompt/instructions), not executable code shipped in the package, so it's outside the repo's automated test scope. The polling logic was exercised end-to-end by using it to open and watch this very PR.

_{🤖 Generated by /pr-fixup command}