Institut-du-Numerique-Responsable/perf-sentinel v0.35.0 on GitHub

What's new in v0.35.0

v0.35.0 is about a SARIF file that code scanning refused. As soon as a run had one finding, the file failed SARIF 2.1.0 schema validation: the service and endpoint sat directly on each result, where the schema allows no such property, and the suggested fix used the SARIF fix object, which requires a source patch Perf Sentinel never produces. The release also aligns the GitLab and Jenkins CI templates with trials, one with gitlab-ci-local, the other on a real Jenkins.

A SARIF result shaped the way the schema expects

Each result now carries exactly one location. The service and endpoint move under locations[0].logicalLocations, next to a physicalLocation when the span had a usable code.filepath. The framework recommendation moves from fixes[0].description.text to the properties.suggestedFix string, since a SARIF fix must carry artifactChanges. A span reporting code.lineno = 0 no longer yields a region.startLine of 0, which the schema forbids. The output of the demo fixtures went from 18 and 29 schema errors to none, and a unit test now validates the SARIF against the vendored OASIS schema, with a negative case proving the validator catches the old shape. GitHub code scanning shows a result inline only when its location has a physicalLocation, so findings from spans without code.* attributes stay in the archived SARIF but not in the Security tab.

A GitLab template that installs where the tests run

A gitlab-ci-local trial on a Spring Boot service found a test image without curl, so the install never happened and the tests ran without capture. The template now installs in a .pre job that picks the release asset from uname -m and hands the binary to the test job as an artifact. The tests still run without capture when the download fails, a checksum mismatch still fails the pipeline, and a catch-all rule keeps the analysis on branch pipelines while only the merge request rule can block. The Code Quality report gains the check_name GitLab requires and a fingerprint built from the finding signature instead of a trace id, so the comparison against the target branch holds from one run to the next. Its line number stays at 1 or more.

A Jenkins template that runs under dash

Jenkins sh steps run /bin/sh, a dash that rejects set -o pipefail on Debian 12 and Ubuntu 24.04 agents. The template now uses set -eu, installs before the test stage instead of after it, picks the asset by architecture, and clears the previous build's binary, capture and reports, so a reused workspace can no longer feed stale files to the pull request gate. A trial on a real Jenkins drove these changes.

Documentation

The .NET guidance documents URL query redaction by target framework: the runtime redacts url.full on .NET 9 and later (DOTNET_SYSTEM_NET_HTTP_DISABLEURIREDACTION), the OpenTelemetry HTTP instrumentation does it before. The removed SetDbStatementForText option is gone from the .NET snippets, and the Django and FastAPI snippets register the tracer provider.

Upgrade impact

Breaking for SARIF consumers. Tools reading result.logicalLocations or result.fixes must read result.locations[0].logicalLocations and result.properties.suggestedFix.
Breaking, perf-sentinel-core only. SarifResult loses logical_locations and fixes, SarifFix is removed, SarifLocation.physical_location becomes an Option next to a new logical_locations, and SarifProperties gains suggested_fix.
CI templates. Teams that copied the GitLab or Jenkins template can diff it against the new one, the GitLab install now lives in its own job.
No configuration key is added or removed, no route, metric or daemon wire format changes, the acknowledgment signatures and the detection verdicts are untouched, the disclosure schema stays v1.8, the embedded reference data keeps its vintages, and MSRV stays 1.99.1.

Full detail in CHANGELOG.md.

Verifying this release

# Binary integrity via SLSA build provenance attestation (Build Level 2)
gh attestation verify perf-sentinel-linux-amd64 \
  --repo Institut-du-Numerique-Responsable/perf-sentinel

# A periodic disclosure produced by this binary, with its attestation and bundle
perf-sentinel verify-hash --report perf-sentinel-report.json \
  --attestation perf-sentinel-report.intoto.jsonl --bundle perf-sentinel-report.sig \
  --expected-identity "https://github.com/Institut-du-Numerique-Responsable/perf-sentinel/.github/workflows/release.yml@refs/tags/v0.35.0" \
  --expected-issuer "https://token.actions.githubusercontent.com" \
  --verify-binary ./perf-sentinel-linux-amd64

gh CLI 2.49 or newer required for gh attestation verify. Releases up to v0.26.2 were attested under robintra/perf-sentinel and keep their own --repo and identity.