feat(cli): add fail-on-findings option - #469
Conversation
f568fed to
3b3e81a
Compare
rng1995
left a comment
There was a problem hiding this comment.
[SkillSpector Review]
Reviewed current head d4e5942508223db05163b02c1dfc38d6d3bd733f. --fail-on-findings is applied after report output, aggregates recursive child findings, and preserves execution-failure exit-code precedence. The regressions cover both single-scan and recursive low-score modes. I found no required code or test changes.
All hosted required checks pass. The branch is behind main, so it must be updated and revalidated before merging.
1b64afd to
de383ec
Compare
rng1995
left a comment
There was a problem hiding this comment.
[SkillSpector Review]
Corrective re-review of current head 768ff663d2fde2813c5501b9fb6f8cbc9df4cfa7 after the force-push/rebase and latest main synchronization. The ordinary single-skill and recursive gates remain correctly placed after report generation and below execution-failure precedence, but the new public flag is silently ignored in the supported MCP Registry scan path. The required correction and regression are detailed inline; please also update the documented stable exit-code contract.
changes, lint, DCO, and docker-smoke pass; test-unit is still running. This is not merge-ready.
| bool, | ||
| typer.Option( | ||
| "--fail-on-findings", | ||
| help="Exit 1 when the scan reports one or more active findings.", |
There was a problem hiding this comment.
scan accepts --fail-on-findings together with --mcp-registry, but that branch returns at lines 561-588 before either new finding check. scan_registry() exposes a findings list, and a single unpinned package contributes a risk score of 30, so this command exits 0 even though the requested gate has a finding to block. Apply the flag to registry findings or reject this option combination explicitly, and add a below-threshold registry regression. Please also update the README's stable exit-code contract to include the new opt-in exit-1 condition.
768ff66 to
ca2ce8b
Compare
rng1995
left a comment
There was a problem hiding this comment.
[SkillSpector Review]
Re-reviewed current head ca2ce8b8391476dc87ba6ebbf0033859e6d1b121 after the author force-push. The PR-owned cli.py and test_cli.py blobs are byte-identical to previously reviewed head 768ff663d2fde2813c5501b9fb6f8cbc9df4cfa7; the existing inline thread remains unresolved and has no reply. The required correction therefore remains: --fail-on-findings is accepted with --mcp-registry, but that branch returns before applying the gate, so a below-threshold registry finding can still exit 0. Apply the gate or reject the option combination, add the registry regression, and update the README's stable exit-code contract.
All hosted checks pass, but this head is not merge-ready.
Signed-off-by: Deepak Jain <[email protected]>
ca2ce8b to
3a6de37
Compare
Summary
Validation
Fixes #448
Signed-off-by: Deepak Jain [email protected]