feat: add support for skipcq comments to ignore issues

[MashyBasker]

This PR introduces support for skipcq comments to ignore specific issues in the source code.

Checklist

• Implement support for basic skipcq functionality (ignores all checkers)
• Improve this feature to skip specific checkers by adding their namespace to the comment
• Add unit tests

Related to #135

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

1 Skipped Deployment

Name	Status	Preview	Comments	Updated (UTC)
globstar	⬜️ Ignored (Inspect)	Visit Preview		Mar 3, 2025 9:58am

[MashyBasker]

Current behavior

Testing with checkers/python/weak-ssl-version.yml

Test file (without skipcq comment)

import ssl
from pyOpenSSL import SSL

# <expect-error>
ssl.wrap_socket(ssl_version=ssl.PROTOCOL_SSLv2)
# <expect-error>
SSL.Context(method=SSL.SSLv2_METHOD)
# <expect-error>
SSL.Context(method=SSL.SSLv23_METHOD)

Globstar logs

Test file (with skipcq comment)

import ssl
from pyOpenSSL import SSL

# <expect-error>
ssl.wrap_socket(ssl_version=ssl.PROTOCOL_SSLv2)
# <expect-error>
SSL.Context(method=SSL.SSLv2_METHOD)
# <expect-error>
SSL.Context(method=SSL.SSLv23_METHOD) # skipcq

Globstar logs

[MashyBasker]

Current behaviour

• Using only skipcq ignores all checkers
• Using skipcq with checker namespace ignores only the checker whose name is provided
  • checkers with same but for different languages will be identified as separate checkers
  • language prefix for the checker is the file extension of the language. Eg. py for Python (a better way for name lookup needs to be added)

[sourya-deepsource]

Checking for skipcq can be done as a post-processor, after all the analysis has run.

It'd be best if you could add unit tests as well.

[sourya-deepsource]

Instead of regex-based search for a comment, I'd recommend using tree-sitter to search for all comments, and then using a function like this to match if it is a valid skipcq comment.

[sourya-deepsource]

Comment identifier should be based on the language.