[SizzleUnrlsd]

Closes #206.

With --check given a relative directory, findings located in dependency files (uv.lock, poetry.lock, pyproject.toml, requirements*.txt) and configuration files (config-secrets) were reported relative to the working directory instead of the analysed root, unlike module findings. Their baseline fingerprints carried the same prefix, so a baseline recorded with --check proj did not match a check of the same project by absolute path.

Change

• engine.analyze_project resolves root, and the explicit --advisories and --policy paths, once, before any file is named. Module sources were already loaded by their resolved path (SourceManager.load_file); manifests, configuration files, the default and explicit advisory files and the policy file now follow the same convention, so Report.locate and the baseline place them under the root. A root reached through a symbolic link is covered by the same resolution.
• The fix sits where the root enters the engine rather than in each reporter or in config_literals, so every SourceId keeps a single naming convention.

Validation

• New tests/test_relative_root.py (no existing test changed): dependency and configuration findings are located at uv.lock and settings.json for a relative and an absolute root, and through a symbolic link; syntax-error notes of explicit --policy and --advisories files are located relative to the root; a baseline recorded with a relative root matches an absolute check. The relative cases failed before the fix for the expected reason (the explicit-file cases were added after review and failed on the first version of this branch).
• Full suite: 1652 passed, 1 failed. The failure, test_packaging::test_the_version_has_one_source_of_truth, comes from a stale local editable install (metadata 0.8.0 vs 0.21.0) and fails identically without this change.
• ruff check and mypy pass. ruff format --check reports pre-existing formatting of engine.py, not the added lines.
• mitmproxy at be75825, enterprise plugins at ac35460, [email protected], no baseline: the same 87 results as the 2026-10-02 reference (rule, line, severity, confidence, message); only the 36 paths prefixed with tests-project/mitmproxy/ are now root-relative. Plugin digests and SBOM are identical; the VEX differs only by its timestamp.

Release note

Baselines recorded with a relative root hold entries such as proj/uv.lock; after this change those findings are located at uv.lock, so they resurface once and the baseline should be re-recorded. A cache built with a relative root misses once for the same reason. Plugins that name files from ProjectContext.root (config-secrets, Enterprise serverless-declarations) now receive the resolved root.

Not covered

syntax-error messages still embed the absolute path of the file in their text. That is message content, not a location, and is left out of this change.