PR #6: Exit Code Standardization & --fail-on Flag

[shivasurya]

Summary

Implements standardized exit codes and the --fail-on flag for both scan and ci commands, enabling selective CI/CD pipeline failures based on security finding severities.

Changes

Core Exit Code Logic (output/exit_code.go)

• Exit Code Constants:
  • ExitCodeSuccess (0): No findings or no --fail-on match
  • ExitCodeFindings (1): Findings match --fail-on severities
  • ExitCodeError (2): Configuration or execution errors
• DetermineExitCode(): Calculates appropriate exit code with error precedence
• ParseFailOn(): Parses comma-separated severity values
• ValidateSeverities(): Validates severity names (case-insensitive)
• InvalidSeverityError: Custom error type for validation failures

Command Integration

• scan command: Add --fail-on flag and integrate exit code logic
• ci command: Add --fail-on flag and integrate exit code logic
• Both commands now:
  • Exit 0 by default (regardless of findings)
  • Exit 1 only when findings match --fail-on severities
  • Exit 2 on configuration/execution errors
  • Support case-insensitive severity validation

Bug Fixes

• Fixed SARIF output always exiting 0 (now respects --fail-on)

Testing

Unit Tests (output/exit_code_test.go)

• 16 tests for DetermineExitCode() covering all exit scenarios
• 12 tests for ParseFailOn() covering edge cases
• 13 tests for ValidateSeverities() covering validation
• All tests verify case-insensitive behavior

Integration Tests (cmd/exit_code_integration_test.go)

• Tests actual binary exit codes for both scan and ci commands
• Tests all output formats (SARIF, JSON, CSV)
• Tests invalid severity handling
• Tests case-insensitive severity matching
• Requires INTEGRATION=1 and pre-built binary

Test Results: All tests passing ✅

$ gradle testGo
ok  	.../output	0.223s
ok  	.../cmd	0.317s

Examples

# Default: no exit on findings
pathfinder scan --rules rules/ --project .
# Exit: 0 (even if vulnerabilities found)

# Fail on critical findings
pathfinder scan --rules rules/ --project . --fail-on critical
# Exit: 1 if critical findings, 0 otherwise

# Fail on critical or high findings
pathfinder ci --rules rules/ --project . --output sarif --fail-on critical,high
# Exit: 1 if critical/high findings, 0 otherwise

# Case insensitive
pathfinder scan --rules rules/ --project . --fail-on CRITICAL,High,MeDiUm
# Exit: 1 if any match

# Invalid severity
pathfinder scan --rules rules/ --project . --fail-on invalid
# Error: invalid severity 'invalid', must be one of: critical, high, medium, low, info

Migration Notes

Breaking Changes

• Default behavior changed: Previously, any findings caused exit 1. Now requires explicit --fail-on flag.
• CI/CD pipelines: Add --fail-on critical,high to maintain previous fail-on-findings behavior.

Non-Breaking

• Existing commands without --fail-on continue to work (exit 0)
• All output formats work identically with exit codes

Checklist

• Core exit code logic implemented
• Integrated with scan command
• Integrated with ci command
• Unit tests (95%+ coverage)
• Integration tests
• All tests passing
• Linter passing
• Binary builds successfully
• Documentation in commit messages

Stacked PRs

This PR stacks on top of:

• PR Created automated Github Action for building binary #5: SARIF Formatter (PR #5: Enhanced SARIF Formatter with Code Flows #395)

🤖 Generated with Claude Code

[safedep]

SafeDep Report Summary

No dependency changes detected. Nothing to scan.

_{This report is generated by SafeDep Github App}

[codecov]

Codecov Report

❌ Patch coverage is 63.79310% with 21 lines in your changes missing coverage. Please review.
✅ Project coverage is 79.76%. Comparing base (40c3ebe) to head (8eda45b).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
sourcecode-parser/cmd/ci.go	8.33%	11 Missing ⚠️
sourcecode-parser/cmd/scan.go	9.09%	10 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #396      +/-   ##
==========================================
- Coverage   79.76%   79.76%   -0.01%     
==========================================
  Files          78       79       +1     
  Lines        7799     7846      +47     
==========================================
+ Hits         6221     6258      +37     
- Misses       1333     1343      +10     
  Partials      245      245              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[shivasurya]

• PR #7: Command Cleanup & Documentation #397
• PR #6: Exit Code Standardization & --fail-on Flag #396 👈 (View in Graphite)
• PR #5: Enhanced SARIF Formatter with Code Flows #395
• PR #4: Add JSON and CSV Output Formatters for CI Mode #394
• PR #3: Text Formatter for Scan Command #393
• PR #2: Structured Logging System #392
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[shivasurya]

Merge activity

• Nov 22, 12:38 AM UTC: A user started a stack merge that includes this pull request via Graphite.
• Nov 22, 12:45 AM UTC: Graphite rebased this pull request as part of a merge.
• Nov 22, 12:46 AM UTC: @shivasurya merged this pull request with Graphite.