Summary

deepsource issues list currently only shows issues from the repository's default branch. This PR adds a --commit flag that queries issues from the analysis run for a specific commit SHA, enabling users to see issues found on PR branches and non-default branches.

Motivation: When using DeepSource in CI pipelines or local pre-push hooks, it's useful to check what issues a specific commit introduced — particularly on feature branches where DeepSource already runs analysis via the GitHub App. Today the only way to see branch-specific results is through the web dashboard; this change brings that capability to the CLI.

NOTE: This PR is AI-written but seems to work. I don't know Go, otherwise I'd scrutinize myself. Please LMK if changes need to be made.

Usage

# List issues found in the analysis run for a specific commit
deepsource issues list --commit abc123def456

# Combine with existing flags
deepsource issues list --commit abc123 --analyzer python --limit 50
deepsource issues list --commit abc123 --json --output-file results.json

Changes

New file: deepsource/issues/queries/list_run_issues.go

• GraphQL query using run(commitOid:) → checks → occurrences to fetch issues from a specific analysis run
• Response types and Do() method following the existing patterns in list_issues.go and list_file_issues.go
• Total result count capped to the requested --limit (the GraphQL limit applies per-analyzer check, so without the cap, 3 analyzers × 100 limit = 300 results)

Modified: deepsource/client.go

• New GetIssuesByCommit(ctx, commitOID, limit) SDK method, mirroring the existing GetIssues and GetIssuesForFile

Modified: command/issues/list/list.go

• --commit flag (long form only — no shorthand to avoid -c conflicts with common --config conventions)
• Commit SHA validation (must be 6-40 hex characters)
• Mutual exclusion with --repo (commit lookup is repo-agnostic via the API)
• Skips ResolveRemote when --commit is specified (no git context needed)
• Existing --analyzer, --limit, --json/--csv/--sarif, and --output-file flags all work with --commit

Testing

• go build ./... passes
• go test ./command/issues/list/ passes (existing tests unaffected)
• Manually verified the run(commitOid:) GraphQL endpoint returns correct data via the DeepSource Cloud API (api.deepsource.io/graphql/)

Notes

• The GraphQL query uses the run(commitOid:) root query field and traverses checks.occurrences to collect issues. This field is documented in the DeepSource API but was not previously exposed by the CLI.
• All output formats (table, JSON, CSV, SARIF) work with the new flag since the issues are normalized into the same []issues.Issue slice used by the default code path.