Separating reports of multiple scans within the same datastore

[munntjlx]

What is the recommendation for reporting on a particular scan result (say hello repo when I have hello and goodbye repos in a single datastore)? Or is it just easier to keep each separate unless I want to summarise?

[bradlarsen]

@munntjlx If you want to keep the reports from two separate Git repositories separate, at this point, it is simplest to treat those as two separate inputs, scanning them in two different scan invocations with two different datastores.

Nosey Parker does support re-using its datastore for multiple scanning runs, but the semantics of that today is to combine all findings into one big set. There is not any easy built-in way of separating the findings out after the fact.

This use case (reusing a data store across multiple scan runs and doing something useful with the results) is something we may revisit in the future. It could be useful, for example, to be able to compare two runs, reporting the things that were introduced or eliminated between two points in time. For that, leaning more heavily into SARIF format (#33, #34) may be a sensible thing to do.