Institut-du-Numerique-Responsable/perf-sentinel v0.36.0 on GitHub

What's new in v0.36.0

v0.36.0 is about a SARIF file that Jenkins dropped whole. Since v0.35.0, every SARIF result carried one location, without a physicalLocation when the finding had no source file. That is valid SARIF 2.1.0, but the Warnings NG parser throws a NullPointerException on such a location and rejects the whole file. One structural finding, or one finding from spans without code.* attributes, was enough to lose every issue in the Jenkins report.

A location only when there is a file to point at

A result now carries a location only when it has a physicalLocation, and that location still names the service and endpoint in its logicalLocations. Every result also carries both in the new properties.service and properties.endpoint, so a consumer reads them in the same place whether or not the finding has a source file. The output stays valid against the SARIF 2.1.0 schema. The simulation lab gains a scenario that hands the SARIF of the demo fixture to the parser Warnings NG runs, analysis-model 14.20.0 with violations-lib 3.0.2: v0.35.0 fails on the NullPointerException, v0.36.0 reads 11 issues out of 11, and the 7 with a source file keep their file and line. The chatty_service, excessive_fanout, pool_saturation and serialized_calls findings describe a trace, not a line of code, so they reach Jenkins without a file.

An acknowledgment that expires in the 7 days it was given

perf-sentinel ack create --expires 7d reported the expiry as "in 6 days". The hint measured the delay a moment after setting the expiry, then rounded it down. It now rounds up to the minute: 7 days reads "in 7 days", 1 day reads "in 1 day", and a delay under a minute reads "in less than a minute". The stored expiry itself never changed.

Upgrade impact

Breaking for SARIF consumers. Tools reading locations[0].logicalLocations on findings without a source file must read properties.service and properties.endpoint, and must accept a result with no locations.
Breaking, perf-sentinel-core only. SarifLocation.physical_location is no longer an Option, and SarifProperties gains service and endpoint.
No configuration key is added or removed, no route, metric or daemon wire format changes, the acknowledgment signatures and the detection verdicts are untouched, the disclosure schema stays v1.8, the embedded reference data keeps its vintages, and MSRV stays 1.99.1.

Full detail in CHANGELOG.md.

Verifying this release

# Binary integrity via SLSA build provenance attestation (Build Level 2)
gh attestation verify perf-sentinel-linux-amd64 \
  --repo Institut-du-Numerique-Responsable/perf-sentinel

# A periodic disclosure produced by this binary, with its attestation and bundle
perf-sentinel verify-hash --report perf-sentinel-report.json \
  --attestation perf-sentinel-report.intoto.jsonl --bundle perf-sentinel-report.sig \
  --expected-identity "https://github.com/Institut-du-Numerique-Responsable/perf-sentinel/.github/workflows/release.yml@refs/tags/v0.36.0" \
  --expected-issuer "https://token.actions.githubusercontent.com" \
  --verify-binary ./perf-sentinel-linux-amd64

gh CLI 2.49 or newer required for gh attestation verify. Releases up to v0.26.2 were attested under robintra/perf-sentinel and keep their own --repo and identity.