feat: Baseline file support to suppress known findings in CI pipelines

[Nanle-code]

Overview

Teams adopting ChainProof mid-project face a painful onboarding problem: the first scan surfaces dozens of pre-existing findings that can't all be fixed immediately. Without a suppression mechanism, the CI gate fails permanently. A baseline file lets teams acknowledge existing findings and only fail CI on newly introduced issues.

Problem Scenario

1. First scan surfaces 40 pre-existing findings, 15 of which are high severity
2. CI is configured to fail on high severity
3. Team cannot ship anything until all 15 are fixed
4. Team disables ChainProof

A baseline file solves this by saying: "These 15 issues are known. Alert me on anything new."

Proposed Design

Creating a Baseline

chainproof scan contracts/ --create-baseline .chainproof-baseline.json

{
  "version": "1.0",
  "createdAt": "2025-06-19T00:00:00Z",
  "entries": [
    {
      "fingerprint": "sha256-of-ruleId+file+line+snippet",
      "ruleId": "CP-107",
      "file": "contracts/Vault.sol",
      "line": 42,
      "title": "Reentrancy vulnerability"
    }
  ]
}

Using a Baseline

chainproof scan contracts/ --baseline .chainproof-baseline.json

• Baselined findings are marked suppressed: true in the result
• Suppressed findings appear in reports (dimmed) for transparency but do not trigger exit code 1
• Exit code 1 only fires on new (non-baselined) critical/high findings

Fingerprinting

SHA-256(ruleId + normalized_file_path + line_number + first_30_chars_of_snippet)

Stable across minor formatting changes but invalidates when vulnerable code moves or changes.

Acceptance Criteria

• --create-baseline CLI flag
• --baseline CLI flag
• ScanConfig.baselinePath?: string field
• Fingerprinting algorithm deterministic and documented
• Suppressed findings marked in all report formats
• GitHub Action supports baseline-file input
• VS Code extension has chainproof.baselineFile setting
• Stale baseline entries (no longer matching any finding) reported as warnings

[Babigdk]

Proposal: Baseline Suppression Feature for ChainProof

I’d like to implement the baseline mechanism for scan suppression as described.

Work includes:

• Add --create-baseline and --baseline CLI flags
• Implement deterministic fingerprinting (ruleId + file + line + snippet)
• Support ScanConfig.baselinePath
• Mark matched findings as suppressed: true without failing CI
• Ensure only new high/critical issues trigger exit code 1
• Add baseline support to GitHub Action + VS Code setting
• Report stale baseline entries as warnings

Deliverables:

• CLI baseline generation + usage support
• Core suppression logic integrated into scanner
• Docs for fingerprinting algorithm
• CI + VS Code integration updates

[444notdotun]

hi, i would love to work on this project

[madisonsc52-del]

Hi maintainer i can work on this, I'll make sure to work on the issue asap