Add global --skip-tls-verify flag for self-signed certs

[jai-deepsource]

• Add --skip-tls-verify persistent flag on root command, available to all subcommands
• Resolution priority: CLI flag > DEEPSOURCE_SKIP_TLS_VERIFY env var > config file
• Add SkipTLSVerify field to CLIConfig, persisted as skip_tls_verify in TOML
• Wire all commands (issues, metrics, runs, reportcard, vulnerabilities, auth) to pass resolved value to API client
• Build custom http.Transport with InsecureSkipVerify when enabled
• Deprecate report's --skip-verify flag in favor of the global flag
• Pass SkipTLSVerify through auth service for device registration and PAT requests
• Add tests for TLS resolution logic, config env/file loading, client transport, and login behavior
• Remove .deepsource.toml

[deepsource-io]

DeepSource Code Review

We reviewed changes in 92bfa5a...33c43b3 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene   Coverage

Feedback

• [No single canonicalization boundary]
  • Inputs are accepted and interpreted differently across subsystems, letting subtle edge cases (addresses, paths, attribute URLs) behave inconsistently; normalize and validate untrusted data once at the boundary, then propagate canonical values to every layer.
• [Parsing and escaping duplicated across layers]
  • Multiple ad‑hoc parsers/escapers cause divergent behavior on corners; extract and centralize robust parsing/escaping primitives, provide thin validated wrappers, and replace in-place logic to prevent inconsistent interpretations.
• [Corner cases missing from automated tests]
  • Low-severity bugs recur because IPv6 literals, root-escape paths, and template-attribute contexts aren’t exercised; add targeted unit, table-driven, and fuzz/property tests for parsing, path resolution, and HTML contexts to catch regressions early.

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
Go		Mar 10, 2026 6:20a.m.	Review ↗
Secrets		Mar 10, 2026 6:20a.m.	Review ↗
Test coverage		Mar 10, 2026 6:20a.m.	Review ↗

Code Coverage Summary

Language	Line Coverage (New Code)	Line Coverage (Overall)
Aggregate	27.3% [⤫ below threshold]	21.7% [▲ up 2.3% from master]
Go	27.3% [⤫ below threshold]	21.7% [▲ up 2.3% from master] [✓ above threshold]

➟ Additional coverage metrics may have been reported. See full coverage report ↗