Codex Security 0.8.0

Highlights

Codex Security 0.8.0 adds OpenGrep report imports and changes how scan results record scope and review details.

• OpenGrep imports. Import a native JSON or gzip-compressed report into the local workbench or publish it to Cloud with publish findings --provider opengrep. Supply --source-repository-url and enable external imports with CODEX_SECURITY_ENABLE_EXTERNAL_IMPORTS=1. Imported findings retain their scanner evidence and start as unassessed. See the OpenGrep guide.
• Scan recovery. Resume an interrupted Deep Scan after clearing its additional instructions. Read a completed Workbench scan’s saved artifacts even after moving or removing the original checkout.

Upgrade notes

• SDK and JSON consumers. Replace reads of ScanResult.coverage or the serialized coverage field with review for comparison exclusions. Read scan mode and scope from manifest.scan. Integrations that write drafts should put reviewed surfaces, unfinished work, and open questions in reviewState.
• Saved files and GitHub Actions. New scans no longer write coverage.json. Replace ScanResult.coveragePath with manifestPath and read scan.review in scan-manifest.json. Workflows that read the Action’s coverage-path output should switch to manifest-path. The legacy output is empty for current scans. Existing saved scans remain readable. See Action outputs.

All changes

What's Changed

Breaking changes

• refactor!: simplify scan completion and recovery by @ianw-oai in #1762

Features

• feat(container): add a local Wolfi build for Linux amd64 by @andy-tang-oai in #2053
• feat(imports): support OpenGrep reports locally and in Cloud by @mldangelo-oai in #1872

Fixes

• fix(knowledge-base): skip Office owner files in knowledge-base folders by @LittleYier in #1913
• fix(sdk): leave Git-ignored SECURITY.md files out of policy discovery by @ilaigold in #1535
• fix(scans): retain pre-seal warnings across publication failures by @JayYarlagadda in #1907
• fix(deps): bump fast-uri from 3.1.8 to 3.1.9 in /github-action/runtime by @dependabot[bot] in #1914
• fix(patch): stop source excerpts at the end of the file by @LittleYier in #2015
• fix(plugin): request fields when reading back GitHub issues by @mldangelo-oai in #2048
• fix(cli): resume deep scans after clearing their instructions by @mldangelo-oai in #2049
• fix(mcp): read completed scan artifacts after checkout removal by @mldangelo-oai in #2050
• fix(dedupe): continue hosted reviews after a missing submission by @kmbroai in #2090

Documentation

• docs(artifacts): clarify recovery for historical scan entries by @mldangelo-oai in #2027
• docs(imports): map scanner evidence and test cross-provider replay by @mldangelo-oai in #2080
• docs(imports): distinguish Snyk evidence changes from finding edits by @mldangelo-oai in #2081

Other changes

• chore(deps): bump fast-uri from 3.1.8 to 3.1.9 in /sdk/typescript by @dependabot[bot] in #2061
• chore(deps): bump fast-uri from 3.1.8 to 3.1.9 in /plugins/codex-security/mcp-app by @dependabot[bot] in #2062
• chore(deps): bump fast-uri from 3.1.8 to 3.1.9 in /evals/triage-finding by @dependabot[bot] in #2063
• chore(deps): update @inquirer/prompts to 8.7.4 in the SDK by @dependabot[bot] in #2072
• ci: skip container builds for SDK test-only pull requests by @mldangelo-oai in #2069
• perf(imports): count Cloud request bytes without reserializing batches by @mldangelo-oai in #2079
• perf(imports): avoid redundant SQLite reads and parsing on replay by @mldangelo-oai in #2083

New Contributors

• @JayYarlagadda made their first contribution in #1907
• @andy-tang-oai made their first contribution in #2053

Full Changelog: npm-v0.7.0...npm-v0.8.0