🐛 fix: match selected security policies by exact path

checks/fileparser/listing.go

@@ -41,8 +41,9 @@ func isMatchingPath(fullpath string, matchPathTo PathMatcher) (bool, error) {
 		return false, sce.WithMessage(sce.ErrScorecardInternal, fmt.Sprintf("%v: %v", errInternalFilenameMatch, err))
 	}
 
-	// No match on the fullpath, let's try on the filename only.
-	if !match {
+	// No match on the fullpath, optionally try on the filename only.
+	// ExactPath callers have already selected a specific repository path.
+	if !match && !matchPathTo.ExactPath {
 		if match, err = path.Match(pattern, filename); err != nil {
 			return false, sce.WithMessage(sce.ErrScorecardInternal, fmt.Sprintf("%v: %v", errInternalFilenameMatch, err))
 		}
@@ -63,6 +64,9 @@ func isTestdataFile(fullpath string) bool {
 type PathMatcher struct {
 	Pattern       string
 	CaseSensitive bool
+	// ExactPath disables the filename fallback and matches Pattern only against
+	// the complete repository path.
+	ExactPath bool
 }
 
 // DoWhileTrueOnFileReader takes a filepath, its reader and

checks/fileparser/listing_test.go

@@ -185,13 +185,34 @@ func Test_isMatchingPath(t *testing.T) {
 		pattern       string
 		fullpath      string
 		caseSensitive bool
+		exactPath     bool
 	}
 	tests := []struct {
 		name    string
 		args    args
 		want    bool
 		wantErr bool
 	}{
+		{
+			name: "exact path does not fall back to matching a filename",
+			args: args{
+				pattern:       "SECURITY.md",
+				fullpath:      ".review-pro/node/security.md",
+				caseSensitive: false,
+				exactPath:     true,
+			},
+			want: false,
+		},
+		{
+			name: "exact path still matches the selected file",
+			args: args{
+				pattern:       "SECURITY.md",
+				fullpath:      "SECURITY.md",
+				caseSensitive: false,
+				exactPath:     true,
+			},
+			want: true,
+		},
 		{
 			name: "matching path",
 			args: args{
@@ -317,6 +338,7 @@ func Test_isMatchingPath(t *testing.T) {
 			got, err := isMatchingPath(tt.args.fullpath, PathMatcher{
 				Pattern:       tt.args.pattern,
 				CaseSensitive: tt.args.caseSensitive,
+				ExactPath:     tt.args.exactPath,
 			})
 			if (err != nil) != tt.wantErr {
 				t.Errorf("isMatchingPath() error = %v, wantErr %v", err, tt.wantErr)

checks/raw/security_policy.go

@@ -50,6 +50,7 @@ func SecurityPolicy(c *checker.CheckRequest) (checker.SecurityPolicyData, error)
 			err := fileparser.OnMatchingFileContentDo(c.RepoClient, fileparser.PathMatcher{
 				Pattern:       data.files[idx].File.Path,
 				CaseSensitive: false,
+				ExactPath:     true,
 			}, checkSecurityPolicyFileContent, &data.files[idx].File, &data.files[idx].Information)
 			if err != nil {
 				return checker.SecurityPolicyData{}, err
@@ -89,6 +90,7 @@ func SecurityPolicy(c *checker.CheckRequest) (checker.SecurityPolicyData, error)
 			err := fileparser.OnMatchingFileContentDo(client, fileparser.PathMatcher{
 				Pattern:       filePattern,
 				CaseSensitive: false,
+				ExactPath:     true,
 			}, checkSecurityPolicyFileContent, &data.files[idx].File, &data.files[idx].Information)
 			if err != nil {
 				return checker.SecurityPolicyData{}, err