v0.52.0

Added

• ignore on a repository removes paths from a scan. Gitignore-shaped, applied after
  paths, so it can carve fixtures out of a subtree you selected:

  repositories:
    - url: https://github.com/acme/monorepo.git
      paths: [services/web]
      ignore: ["**/testdata/**", vendor/]

  Not the same tool as config.exclude: ignore narrows what is scanned, so nothing is
  reported about those files at all. exclude narrows what is counted — the finding is still
  made and still in the report, marked suppressed with the reason someone gave. Use ignore for
  code that is not yours to answer for; use exclude for a finding you have looked at.

Fixed

• --allow-scan-errors can no longer pass a scan that ran nothing. A descriptor enabling no
  control reported no controls ran and failed, as it should — and the flag the error message
  recommended turned that into a green PASS over a scan that had checked nothing.

  The flag accepts a scanner that failed, when other controls did run and you choose to proceed
  on those. A planning failure is not a scanner, so there is no partial result to accept. It now
  says so instead of offering the flag. A failed SBOM stays waivable: that is missing evidence,
  not a missing check.

• A failure's explanation is wrapped rather than cut. The one-line clamp is right for a
  tool's own stderr, which can be a usage screen, but it was also truncating Draugr's own
  sentences at the clause that said what to do.

• dast works. The Nuclei template download never ran: the prewarm passed -duc alongside
  -update-templates, and on that command -duc disables the update itself. Nuclei exits 0
  either way, so nothing noticed — every dast run then failed with Nuclei's own
  no templates provided for scan, which reads like a mistake in your descriptor.

  The flag is gone, and the download is now verified rather than assumed: Draugr asks Nuclei what
  template set it has afterwards, because an exit code that is 0 on both outcomes cannot answer
  that. If there is still no template set, the control's error says so instead of relaying the
  symptom.

• draugr doctor reports a tool that is installed but cannot run. Being on PATH is not the
  same as being able to work — Nuclei needs its template set — so doctor now probes for a tool's
  data and fails when it is missing, with how to get it:

  nuclei  ✗ no data  3.11.0  run `nuclei -update-templates`
  

• A scanner's prewarm failure is now logged. It was recorded as a trace span event and
  nowhere else, so the only thing a user ever saw was whatever the scanner said later about a
  consequence of it.

• paths on a repository now scopes the scan. It was accepted, documented and carried into
  the scan target, and no scanner ever read it — every repository control scanned the whole tree.
  A monorepo scoped to one service reported findings against a component that does not own the
  code.

  Draugr now checks out only the selected directories, so a large repository is cheaper to scan
  as well. Files at the repository root always come with them, whatever paths says:
  go.mod, package.json, Dockerfile, .trivyignore and their kin are how a scanner knows
  what it is looking at, and a tool that cannot find the manifest reports less rather than
  failing.

  Scope is now part of a target's identity. Two components on different subtrees of one
  repository previously shared a cache entry and collapsed into a single scan whose findings both
  received.

• A publishing failure no longer hides the gate's verdict. A run that both failed its gate
  and could not deliver its reports named only the publisher — so a red build read as "fix your
  token" when what actually happened is that it should not ship. The verdict leads and the
  publishing failure follows it:

  draugr: policy verdict: fail (publishing also failed: github publisher missing: $GITHUB_TOKEN)