apply method

(List<AuditRunResult>, int, Set<String>) apply(List<AuditRunResult> results, ProjectContext context)

Returns a copy of results with baselined issues handled by severity: medium/low/info baselined issues are removed entirely (like IgnoreConfig), but critical/high baselined issues stay visible in the report — a serious finding shouldn't silently vanish just because it's pre-existing. Their ids are returned in exemptFromFailOn so they don't block the build a second time; the caller is responsible for excluding them from its fail-on check.

Maintenance findings (see maintenanceAuditIds) are always kept regardless of severity: they never affect the exit code in the first place, so there's nothing for the baseline to protect them from — hiding them would just make dependency/asset hygiene findings vanish silently the moment someone runs --update-baseline.

baselinedCount counts every baselined issue, visible or not — it's "how many were accepted via baseline," not "how many disappeared."

Implementation

(
  List<AuditRunResult> filtered,
  int baselinedCount,
  Set<String> exemptFromFailOn,
)
apply(List<AuditRunResult> results, ProjectContext context) {
  if (isEmpty) {
    return (results, 0, {});
  }

  var baselined = 0;
  final exemptFromFailOn = <String>{};
  final filtered = <AuditRunResult>[];

  for (final run in results) {
    final keptIssues = <SecurityIssue>[];

    for (final issue in run.result.issues) {
      final isBaselined = fingerprints.contains(
        fingerprintFor(run.audit.id, issue, context),
      );

      if (!isBaselined) {
        keptIssues.add(issue);
        continue;
      }

      baselined++;

      final isHighSeverity =
          issue.severity == Severity.critical ||
          issue.severity == Severity.high;

      if (isHighSeverity || maintenanceAuditIds.contains(run.audit.id)) {
        keptIssues.add(issue);
      }

      if (isHighSeverity) {
        exemptFromFailOn.add(issue.id);
      }
    }

    filtered.add(
      AuditRunResult(
        audit: run.audit,
        result: AuditResult(issues: keptIssues),
      ),
    );
  }

  return (filtered, baselined, exemptFromFailOn);
}