feat: send commit SHA with scan dispatch

[joshkotrous]

• Add getCommitShaEnvVar() to auto-detect from GITHUB_SHA, CI_COMMIT_SHA, BITBUCKET_COMMIT, or PENSAR_COMMIT_SHA
• Add commitSha to DispatchScanParams and RunScanParams interfaces
• Include commitSha in /ci/dispatch POST body
• Auto-resolve commitSha in runScan() from env when not explicitly provided
• Add -c/--commit CLI option to pentest command
• Read CI_COMMIT_SHA in GitLab integration and forward to runScan()
• Document --commit option and new env vars in README

---

Note

Low Risk
Small, additive change that only extends request payloads and parameter plumbing; main risk is compatibility if the backend rejects/ignores the new commitSha field.

Overview
Pentest dispatches now include an optional commitSha field, plumbed through RunScanParams/DispatchScanParams and sent in the /ci/dispatch POST body.

The CLI gains -c/--commit and the CI helpers auto-detect the SHA from common provider env vars (GitHub/GitLab/Bitbucket) with a PENSAR_COMMIT_SHA override; the GitLab integration forwards CI_COMMIT_SHA. Documentation is updated to reflect the new option and env vars.

^{Written by Cursor Bugbot for commit cf0893d. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: PENSAR_COMMIT_SHA override has lowest priority instead of highest
  • Moved PENSAR_COMMIT_SHA to the first position in the nullish coalescing chain so it can properly override CI-specific environment variables as documented.

[cursor]

PENSAR_COMMIT_SHA override has lowest priority instead of highest

High Severity

PENSAR_COMMIT_SHA is documented as a "Commit SHA override" in the README, but in getCommitShaEnvVar() it's checked last in the ?? chain — after GITHUB_SHA, CI_COMMIT_SHA, and BITBUCKET_COMMIT. Since those CI-specific env vars are always set automatically in their respective CI platforms, PENSAR_COMMIT_SHA can never take effect, making it impossible for users to override the commit SHA via env var.

Additional Locations (1)

• README.md#L39-L40

 

[cursor]

GitLab bypasses centralized commit SHA resolution

Medium Severity

The GitLab integration reads CI_COMMIT_SHA directly and passes it explicitly as commitSha to CI.runScan(). Since runScan() uses params.commitSha ?? getCommitShaEnvVar(), the explicitly-passed value always takes precedence and getCommitShaEnvVar() is never called. This means the documented PENSAR_COMMIT_SHA override can never work for GitLab users, even after fixing the priority order in getCommitShaEnvVar(). The reading is also redundant since getCommitShaEnvVar() already checks CI_COMMIT_SHA.

Additional Locations (1)

• src/lib/gitlab.ts#L53-L54