Register --only-uncommitted scans as partial scans

skills/corgea/SKILL.md

@@ -95,6 +95,8 @@ Removing, disabling or editing a project ignore rule (scan settings → File Ign
 
 `--only-uncommitted` and `--target` are mutually exclusive. `--fail-on`, `--fail`, and `--block-on` are mutually exclusive.
 
+On Corgea webapp v1.82.0 or newer, `--only-uncommitted` uploads the whole project and names the changed files, so the server records a partial scan and does not replace the branch's latest full scan. An older webapp is sent only the changed files — the previous behavior — which it records as the branch's latest scan. The CLI reads `GET /api/version` to choose; a missing or unreadable version takes the older upload, because that server would reject the partial-scan one.
+
 `--out-format`/`--out-file` and `--sbom` are honored regardless of the gate: the report and the SBOM are written before `--fail`/`--block-on` are evaluated, so a scan that exits 1 on a blocking rule still leaves the report file behind for the pipeline to ingest.
 
 `--skip-if-commit-scanned-recently` reuses the project's most recent reusable scan of the current commit instead of starting a duplicate, when one ran inside the `--scanned-within` window (default `24h`; accepts `90s`, `30m`, `4h`, `7d`, and a bare number as hours). The reused scan takes the new scan's place for the rest of the command — results table, `--block-on` gate and its exit code, `--out-file` report — so the pipeline behaves the same either way. It prints `CORGEA_SCAN_SKIPPED=true` plus `CORGEA_SCAN_ID=<id>` on a reuse and `CORGEA_SCAN_SKIPPED=false` when a scan runs, so a later step can branch on it.

src/main.rs

@@ -99,12 +99,15 @@ enum Commands {
         )]
         fail_on: Option<String>,
 
-        #[arg(long, help = "Only scan uncommitted changes.")]
+        #[arg(
+            long,
+            help = "Only scan uncommitted changes. On Corgea webapp v1.82.0 or newer, the whole project is still uploaded so the analysis has the surrounding code for context, but only staged, modified and untracked files are analyzed, and Corgea records this as a partial scan, like a pull request scan, so it never replaces the branch's latest full scan. An older webapp is sent only the changed files, which it records as the branch's latest scan."
+        )]
         only_uncommitted: bool,
 
         #[arg(
             long = "disable-incremental",
-            help = "Analyze every file, even when Corgea could have analyzed only what changed. Scans are incremental by default: the whole project is still uploaded, but only files that changed since this project's last scan are analyzed, and unchanged files keep their existing findings, so the result is a full picture either way. Use this to force a fresh analysis of every file — after changing scanner configuration outside corgea.yaml, for example. Incremental is skipped on its own, with a reason, when there is no git repository or commit to diff from, when the worktree is dirty, when no earlier scan of a clean worktree exists, or when the last scanned commit is missing from a shallow clone; and silently when --only-uncommitted or --target already narrow the upload to chosen files. With --exclude it still runs, from the stored file checksums of an earlier scan rather than a git diff."
+            help = "Analyze every file, even when Corgea could have analyzed only what changed. Scans are incremental by default: the whole project is still uploaded, but only files that changed since this project's last scan are analyzed, and unchanged files keep their existing findings, so the result is a full picture either way. Use this to force a fresh analysis of every file — after changing scanner configuration outside corgea.yaml, for example. Incremental is skipped on its own, with a reason, when there is no git repository or commit to diff from, when the worktree is dirty, when no earlier scan of a clean worktree exists, or when the last scanned commit is missing from a shallow clone; and silently when --target narrows the upload to chosen files or --only-uncommitted narrows the analysis to them. With --exclude it still runs, from the stored file checksums of an earlier scan rather than a git diff."
         )]
         disable_incremental: bool,
 

src/manifest.rs

@@ -40,12 +40,15 @@
 //! analyzed again.
 //!
 //! The archive has to be the whole project under whatever exclude set built
-//! it. A `--target` or `--only-uncommitted` run is not that: it names the files
-//! to pack, so the archive holds what someone pointed at this once, and a
-//! manifest of it reads as every other file having been deleted -- every one
-//! of their findings dropped without anything having looked at them. Those
-//! runs build no manifest, which is the same reason they already skip
-//! incremental.
+//! it. A `--target` run is not that: it names the files to pack, so the
+//! archive holds what someone pointed at this once, and a manifest of it reads
+//! as every other file having been deleted -- every one of their findings
+//! dropped without anything having looked at them. Those runs build no
+//! manifest, which is the same reason they already skip incremental. An
+//! `--only-uncommitted` run against a webapp that registers partial scans packs
+//! the whole project but is a partial scan, which the server never stores a
+//! manifest for, so it skips hashing too. An older webapp is sent only the
+//! changed files, the same shape as `--target`, and builds no manifest either.
 
 use flate2::read::GzDecoder;
 use flate2::write::GzEncoder;