v3.6.2

v3.6.2 — diff-aware scans no longer miss findings with a relative --code

A coverage-integrity patch. In v3.6.1 and earlier, a diff-aware scan with a
relative code path such as "." scanned none of the changed files in Semgrep
and the native text scanner, while the coverage table still showed both as ok.
The composite Action's default pull-request check and the pre-commit hook
could therefore pass a change that a full scan blocks.

Fixed:

• Diff-aware scans (--diff, --staged) with a relative --code such as "." or
  "./" now scope the native scanners correctly: a relative and an absolute
  --code report the same findings at the same paths.
• The composite Action's default pull-request setup (code: ".", diff: auto)
  no longer misses text-scanner and Semgrep findings because of the
  relative-root path conversion. A pull request adding a privileged
  Kubernetes container now blocks, as it does with an absolute code path or
  diff: 'false'.
• The pre-commit hook written by fendix hook install
  (fendix scan --code . --staged --fast) no longer misses staged
  text-scanner findings, and rejects such a commit.

Safety behaviour: when a diff scope cannot be represented safely, Fendix
widens to a full scan and logs "diff-aware scan: file scope could not be
represented safely — falling back to full scan", rather than risk a silent
miss.

Temporary behaviour: with --code set to a subdirectory of the repository, the
changed paths cannot yet be mapped under it, so a diff-mode scan falls back to
a full scan of --code. Final subdirectory diff semantics are planned for
v3.7.0.

Unchanged: the secrets scanner and the Python engine (which were not
affected), report schema, SARIF, fingerprints, exit codes, finding paths, and
the Action's inputs and outputs.

Upgrading: pull requests using the Action's defaults and commits checked by the
pre-commit hook can now report findings and block where v3.6.1 passed; these
are findings v3.6.1 should have reported. The v3.6.1 workarounds (an absolute
code path or diff: 'false') remain valid and can be removed.

Full notes: CHANGELOG.md, section 3.6.2.

What's Changed

• docs: pin the published v3.6.1 artifacts by @Abdel-RahmanSaied in #116
• docs(install): trust the tap formula and keep published file names by @Abdel-RahmanSaied in #117
• fix(examples): run the reference workflow on v3.6.1 without the jq step by @Abdel-RahmanSaied in #118
• fix(diff): scope diff-aware scans correctly for a relative --code by @Abdel-RahmanSaied in #119
• chore(release): prepare v3.6.2 by @Abdel-RahmanSaied in #120

Full Changelog: v3.6.1...v3.6.2