cloudsec: bind the SLA state selector and the due_at sort - #332
Draft
maximelb wants to merge 1 commit into
Draft
Conversation
Adds `sla` (breached | due_soon | on_track | exempt | none) and the `due_at` sort key to the cloudsec findings surface, keeping the SDK at full parity with the gateway's findings selectors. It rides the shared `_finding_query_pairs` / `_finding_filter_options` helpers, so it reaches all four surfaces those feed - `finding list`, `finding facets`, `finding causes`, and `export findings` - and a test asserts that explicitly: a surface that silently dropped the selector would return the unfiltered estate while the caller believed they had asked for the overdue slice. Docs record the two things about this dimension that are not guessable: the state is DERIVED at read time (there is no built-in default SLA, so every finding reads `none` until the org writes an `sla` policy), and `--sort due_at` is the one sort key that defaults to ASCENDING and places findings with no due date last rather than excluding them. The three existing exhaustive-kwargs assertions gained `sla=None` so they keep asserting the complete call rather than a subset. Tests: 3862 passed, 5 skipped (the CI invocation: pytest tests/unit/ tests/microbenchmarks/ --benchmark-disable). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y3AnxeGmcGA9scrsRZFtg9
lcbill
approved these changes
Aug 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What was asked
Bind the new cloud-security SLA selector so the SDK and CLI stay at full parity with the
gateway's findings surface.
What was done
Adds
sla(breached|due_soon|on_track|exempt|none) and thedue_atsortkey to the cloudsec findings surface.
It rides the shared
_finding_query_pairs/_finding_filter_optionshelpers, so itreaches all four surfaces those feed —
finding list,finding facets,finding causes,and
export findings— and a test asserts that explicitly. A surface that silently droppedthe selector would return the unfiltered estate while the caller believed they had asked
for the overdue slice.
The docstrings record the two things about this dimension that are not guessable from its
name:
so every finding reads
noneuntil the org writes anslapolicy record. A callerseeing all-
noneis looking at an unconfigured org, not a bug.--sort due_atis the one sort key that defaults to ascending (soonest due first)and places findings with no due date last rather than excluding them.
The three existing exhaustive-kwargs assertions gained
sla=Noneso they keep asserting thecomplete call rather than a subset.
Testing
pytest tests/unit/ tests/microbenchmarks/ --benchmark-disable(the CI invocation):3862 passed, 5 skipped.
🤖 Generated with Claude Code
https://claude.ai/code/session_01Y3AnxeGmcGA9scrsRZFtg9