Add global --skip-tls-verify flag for self-signed certs

[jai-deepsource]

• Add --skip-tls-verify persistent flag on root command, available to all subcommands
• Resolution priority: CLI flag > DEEPSOURCE_SKIP_TLS_VERIFY env var > config file
• Add SkipTLSVerify field to CLIConfig, persisted as skip_tls_verify in TOML
• Wire all commands (issues, metrics, runs, reportcard, vulnerabilities, auth) to pass resolved value to API client
• Build custom http.Transport with InsecureSkipVerify when enabled
• Deprecate report's --skip-verify flag in favor of the global flag
• Pass SkipTLSVerify through auth service for device registration and PAT requests
• Add tests for TLS resolution logic, config env/file loading, client transport, and login behavior
• Remove .deepsource.toml

[deepsource-io]

DeepSource Code Review

We reviewed changes in 92bfa5a...b322041 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade   Focus Area: Security

Security   Reliability   Complexity   Hygiene   Coverage

Feedback

• Insecure TLS default
  • InsecureSkipVerify was treated as a convenient default in client initialization, letting certificate validation be bypassed; make TLS validation secure-by-default and require an explicit, audited opt-in to disable it.
• Dev-only toggles leaked to production
  • Local/test conveniences (skip verification) were left in committed configs, so runtime behavior differs by environment; separate environment configs and enforce a production-safe build/runtime guard to prevent accidental enablement.
• Tests depend on real services
  • Low coverage and ad-hoc verification toggles imply tests hit live endpoints, driving developers to relax TLS; replace networked tests with mocks or local TLS test servers so security flags aren’t needed and coverage improves.

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
Go		Mar 7, 2026 11:28a.m.	Review ↗
Secrets		Mar 7, 2026 11:28a.m.	Review ↗
Test coverage		Mar 7, 2026 11:28a.m.	Review ↗

Code Coverage Summary

Language	Line Coverage (New Code)	Line Coverage (Overall)
Aggregate	27.3% [⤫ below threshold]	21.7% [▲ up 2.3% from master]
Go	27.3% [⤫ below threshold]	21.7% [▲ up 2.3% from master] [✓ above threshold]

➟ Additional coverage metrics may have been reported. See full coverage report ↗