Provide a way to report warnings only from some files/directories while scanning the full app

Context:

We maintain a large Rails app with some optional customer-specific extensions. While the main app lives in a single git monorepo, the extensions have their own repositories.

We are already using Brakeman for the main Rails app and running it as part of our CI pipelines, but we would like to also implement automatic Brakeman scanning for the extensions.

I 've experimented with using brakeman --force to scan just the extension code, but that seems to only apply a rather limited set of checks. To do a proper full-app scan, I've implemented a setup where I shallow clone the main app repo in the extension CI pipeline, add some symlinks to make the extension code appear where it should be and then run Brakeman on the full app + extension. This actually seems to work.

Problem:

Both the main app and the extensions have some false positive warnings that we want to ignore. We also want to provide a convenient way for developers to update the ignore entries.

Alternatives considered:

We currently have a brakeman.ignore file in the main app repo, which also gets picked up and applied when scanning the main app + extensions. However, this file does not contain any entries for the extension, nor do I want to maintain them in this file. (Not only would that require changing the main repo to ignore new warnings in an extension, but those entries would also easily get removed by accident when developers run brakeman -I for the main repo without extensions.)

Alternatively, I could copy the main app's brakeman.ignore file to each extension repo and add any false positives for the extension to the copy. But that would then require updating each extension repo whenever the brakeman.ignore file for the main app is changed.

I have also considered using some command-line JSON manipulation tool like jq in my CI pipeline script to merge the brakeman.ignore files from the main app and the extension together before running Brakeman in CI. However, this would make maintaining the partial brakeman.ignore file in the extension repo using brakeman -I quite awkward.

Suggested solution:

Add new command-line / config options similar to --skip-files and --only-files to Brakeman. Unlike --skip-files and --only-files, the new options should not fully exclude any files from processing, but should only cause warnings from the excluded files not to be reported (or considered by brakeman -I).

A tentative suggestion for the new option names would be --ignore-files and --report-only-files.

With such options, I could have the CI pipeline for the extension repos scan the full app (including the extension) but only report warnings for files that are part of the extension.

Ideally, this would also allow developers to run brakeman -I with an extension present, using the config from the extension repo, and have it update the brakeman.ignore for the extension with only warnings for files in that extension.