feat: add Code Quality finding type with comment-on-issue workflow (#159)

* feat: add Code Quality finding type with comment-on-issue workflow

Code Quality is a new value in the FindingType enum. When a finding has
type "Code Quality", the details panel hides severity, difficulty, exploit
scenario, and recommendation fields. The "Open Remote Issue" flow posts
a comment on a single designated GitHub issue instead of creating a new
issue per finding. The CQ issue number is stored per-workspace-root,
shared across sibling roots with the same audit repo, and editable from
both the command palette and the Repository Configuration panel.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* style: fix biome formatting in codeMarker and messageHandlers test

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: address Code Quality PR review feedback

- Add title and ignoreFocusOut to CQ QuickPick menus for consistency
- Add "Open Settings" button to CQ confirmation dialog
- Move CodeQuality from FindingType to FindingSeverity so selecting it
  in the first dropdown naturally hides subsequent fields

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: improve Code Quality UX — reorder dropdown and clarify settings prompt

Move Code Quality before Informational in the severity dropdown and
add explanatory text to the confirmation dialog so users understand
why the Settings button is there.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: prevent double prompt in Code Quality issue setup and add GitLab support

The "Create a new issue" path fell through into the "Enter existing
issue number" input, causing two consecutive prompts. Wrapping the
second path in an `else` clause fixes this.

Also adds GitLab issue URL support (using /-/issues/ path format)
alongside the existing GitHub URL handling.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: jvdprng

esbuild.js

@@ -79,7 +79,11 @@ const watchPlugin = {
             console.log("build complete");
         }
     } catch (err) {
-        process.stderr.write(err.stderr);
+        if (err.stderr) {
+            process.stderr.write(err.stderr);
+        } else {
+            console.error(err);
+        }
         process.exit(1);
     }
 })();

package.json

@@ -272,6 +272,10 @@
             {
                 "command": "weAudit.boundaryMoveDown",
                 "title": "weAudit: Move Finding Down"
+            },
+            {
+                "command": "weAudit.editCodeQualityIssueNumber",
+                "title": "weAudit: Set Code Quality Issue Number"
             }
         ],
         "keybindings": [
@@ -601,6 +605,11 @@
                         "type": "boolean",
                         "default": false,
                         "description": "Sort findings and notes alphabetically by name in the tree view."
+                    },
+                    "weAudit.general.skipCodeQualityConfirmation": {
+                        "type": "boolean",
+                        "default": false,
+                        "description": "Skip the confirmation dialog when opening a Code Quality comment. The comment will be copied to clipboard and the issue opened immediately."
                     }
                 }
             },

src/codeMarker.ts

@@ -8,6 +8,7 @@
         <span class="detailSpan">Severity:</span>
         <vscode-dropdown position="below" id="severity-dropdown">
             <vscode-option></vscode-option>
+            <vscode-option>Code Quality</vscode-option>
             <vscode-option>Informational</vscode-option>
             <vscode-option>Undetermined</vscode-option>
             <vscode-option>Low</vscode-option>

src/panels/findingDetails.html

@@ -16,4 +16,9 @@
         <span class="detailSpan">Commit Hash:</span>
         <vscode-text-field id="commit-hash"></vscode-text-field>
     </div>
+
+    <div class="detailsDiv">
+        <span class="detailSpan">Code Quality Issue #:</span>
+        <vscode-text-field id="cq-issue-number" placeholder="e.g. 42"></vscode-text-field>
+    </div>
 </div>

src/panels/gitConfig.html

@@ -26,14 +26,15 @@ class GitConfigProvider implements vscode.WebviewViewProvider {
 
         vscode.commands.registerCommand(
             "weAudit.setGitConfigView",
-            (rootPathAndLabel: RootPathAndLabel, clientRepo: string, auditRepo: string, commitHash: string) => {
+            (rootPathAndLabel: RootPathAndLabel, clientRepo: string, auditRepo: string, commitHash: string, cqIssueNumber?: string) => {
                 this.currentRootPathAndLabel = rootPathAndLabel;
                 const msg: UpdateRepositoryMessage = {
                     command: "update-repository-config",
                     rootLabel: rootPathAndLabel.rootLabel,
                     clientURL: clientRepo,
                     auditURL: auditRepo,
                     commitHash,
+                    cqIssueNumber: cqIssueNumber ?? "",
                 };
                 this._view?.webview.postMessage(msg);
             },
@@ -142,7 +143,14 @@ class GitConfigProvider implements vscode.WebviewViewProvider {
                             );
                             return;
                         }
-                        vscode.commands.executeCommand("weAudit.updateGitConfig", rootPath, message.clientURL, message.auditURL, message.commitHash);
+                        vscode.commands.executeCommand(
+                            "weAudit.updateGitConfig",
+                            rootPath,
+                            message.clientURL,
+                            message.auditURL,
+                            message.commitHash,
+                            message.cqIssueNumber,
+                        );
                         return;
                     case "choose-workspace-root":
                         rootPath = this.dirToPathMap.get(message.rootLabel);

src/panels/gitConfigPanel.ts

@@ -31,6 +31,7 @@ export enum FindingSeverity {
     Low = "Low",
     Medium = "Medium",
     High = "High",
+    CodeQuality = "Code Quality",
     Undefined = "",
 }
 
@@ -89,6 +90,8 @@ export interface SerializedData {
     // older versions do not have partiallyAuditedFiles
     partiallyAuditedFiles?: PartiallyAuditedFile[];
     resolvedEntries: Entry[];
+    // optional code quality issue number for the workspace root
+    codeQualityIssueNumber?: number;
 }
 
 /**
@@ -104,6 +107,8 @@ export interface FullSerializedData {
     // older versions do not have partiallyAuditedFiles
     partiallyAuditedFiles?: PartiallyAuditedFile[];
     resolvedEntries: FullEntry[];
+    // optional code quality issue number for the workspace root
+    codeQualityIssueNumber?: number;
 }
 
 /**

src/types.ts

@@ -25,7 +25,10 @@ function main(): void {
     titleField?.addEventListener("change", handlePersistentFieldChange);
 
     const severityDropdown = document.getElementById("severity-dropdown") as Dropdown;
-    severityDropdown?.addEventListener("change", handlePersistentFieldChange);
+    severityDropdown?.addEventListener("change", (e: Event) => {
+        handlePersistentFieldChange(e);
+        updateFieldVisibility(severityDropdown.value);
+    });
 
     const difficultyDropdown = document.getElementById("difficulty-dropdown") as Dropdown;
     difficultyDropdown?.addEventListener("change", handlePersistentFieldChange);
@@ -71,6 +74,7 @@ function main(): void {
                 descriptionArea.value = message.description;
                 exploitArea.value = message.exploit;
                 recommendationArea.value = message.recommendation;
+                updateFieldVisibility(message.severity as string);
                 break;
 
             case "hide-finding-details":
@@ -101,3 +105,21 @@ function handleFieldChange(e: Event, isPersistent: boolean): void {
     };
     vscode.postMessage(message);
 }
+
+const CODE_QUALITY_SEVERITY = "Code Quality";
+
+/**
+ * Shows or hides detail fields based on whether the finding severity is "Code Quality".
+ * Code Quality findings only show title, severity, and description.
+ */
+function updateFieldVisibility(severity: string): void {
+    const isCodeQuality = severity === CODE_QUALITY_SEVERITY;
+    const hiddenIds = ["difficulty-dropdown", "type-dropdown", "exploit-area", "recommendation-area"];
+    for (const id of hiddenIds) {
+        const element = document.getElementById(id);
+        const parentDiv = element?.parentElement;
+        if (parentDiv) {
+            parentDiv.style.display = isCodeQuality ? "none" : "";
+        }
+    }
+}

src/webview/findingDetailsMain.ts

@@ -28,6 +28,9 @@ function main(): void {
     const commitHash = document.getElementById("commit-hash") as TextField;
     commitHash?.addEventListener("change", handleFieldChange);
 
+    const cqIssueNumber = document.getElementById("cq-issue-number") as TextField;
+    cqIssueNumber?.addEventListener("change", handleFieldChange);
+
     // handle the message inside the webview
     window.addEventListener("message", (event) => {
         const message = event.data;
@@ -39,6 +42,7 @@ function main(): void {
                 clientURL.value = message.clientURL;
                 auditURL.value = message.auditURL;
                 commitHash.value = message.commitHash;
+                cqIssueNumber.value = message.cqIssueNumber ?? "";
                 break;
 
             case "set-workspace-roots":
@@ -67,6 +71,7 @@ function handleFieldChange(_e: Event): void {
     const clientURL = document.getElementById("client-url") as TextField;
     const auditURL = document.getElementById("audit-url") as TextField;
     const commitHash = document.getElementById("commit-hash") as TextField;
+    const cqIssueNumber = document.getElementById("cq-issue-number") as TextField;
     const rootDropdown = document.getElementById("workspace-root-list-dropdown") as Dropdown;
 
     const message: UpdateRepositoryMessage = {
@@ -75,6 +80,7 @@ function handleFieldChange(_e: Event): void {
         clientURL: clientURL.value,
         auditURL: auditURL.value,
         commitHash: commitHash.value,
+        cqIssueNumber: cqIssueNumber.value,
     };
     vscode.postMessage(message);
 }

src/webview/gitConfigMain.ts

@@ -13,6 +13,7 @@ export interface UpdateRepositoryMessage {
     clientURL: string;
     auditURL: string;
     commitHash: string;
+    cqIssueNumber: string;
 }
 
 export interface ChooseWorkspaceRootMessage {