9.0 KiB
9.0 KiB
phase, plan, type, wave, depends_on, files_modified, autonomous, requirements, must_haves
| phase | plan | type | wave | depends_on | files_modified | autonomous | requirements | must_haves | |||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 06-output-reporting | 06 | execute | 2 |
|
|
true |
|
|
Purpose: Surfaces all four output formats through scan --output= and enforces OUT-06 exit-code contract for CI/CD consumers.
Output: Updated cmd/scan.go, a small test file covering format dispatch and exit codes.
<execution_context> @$HOME/.claude/get-shit-done/workflows/execute-plan.md @$HOME/.claude/get-shit-done/templates/summary.md </execution_context>
@.planning/phases/06-output-reporting/06-CONTEXT.md @.planning/phases/06-output-reporting/06-01-PLAN.md @cmd/scan.go @cmd/root.go From Plans 06-01..03: ```go output.Get(name string) (Formatter, error) // returns ErrUnknownFormat wrapped output.Names() []string output.Options{ Unmask, ToolName, ToolVersion } ```Current scan.go ends with:
switch flagOutput {
case "json":
// inline jsonFinding encoder
default:
output.PrintFindings(findings, flagUnmask)
}
if len(findings) > 0 { os.Exit(1) }
return nil
2. Replace with:
```go
// Output via the formatter registry (OUT-01..04).
formatter, err := output.Get(flagOutput)
if err != nil {
return fmt.Errorf("%w (valid: %s)", err, strings.Join(output.Names(), ", "))
}
if err := formatter.Format(findings, os.Stdout, output.Options{
Unmask: flagUnmask,
ToolName: "keyhunter",
ToolVersion: versionString(), // see step 4
}); err != nil {
return fmt.Errorf("rendering %s output: %w", flagOutput, err)
}
// OUT-06 exit codes: 0=clean, 1=findings, 2=error (errors returned via RunE -> root.Execute).
if len(findings) > 0 {
os.Exit(1)
}
return nil
```
Add `"strings"` import if missing.
3. Update the --output flag help text:
```go
scanCmd.Flags().StringVar(&flagOutput, "output", "table", "output format: table, json, sarif, csv")
```
4. Version helper: if cmd/root.go doesn't already export a version constant, add (in cmd/scan.go or a new cmd/version.go):
```go
// versionString returns the compiled tool version. Set via -ldflags "-X github.com/salvacybersec/keyhunter/cmd.version=...".
var version = "dev"
func versionString() string { return version }
```
If a version constant already exists elsewhere, reuse it instead of adding a new one.
5. Confirm the rootCmd.Execute() path in cmd/root.go already handles errors by `os.Exit(1)` on non-nil. For the OUT-06 "exit 2 on error" requirement, update cmd/root.go Execute():
```go
func Execute() {
if err := rootCmd.Execute(); err != nil {
// cobra already prints the error message. Exit 2 signals scan/tool error
// per OUT-06. (Exit 1 is reserved for "findings present".)
os.Exit(2)
}
}
```
This is a one-line change from `os.Exit(1)` to `os.Exit(2)`. Any subcommand returning an error will now exit 2, which matches the CI contract (findings=1, error=2, clean=0).
6. Verify the old inline jsonFinding struct (and its imports — check if "encoding/json" is still used anywhere in scan.go; if not, remove the import).
2. Create cmd/scan_output_test.go:
```go
package cmd
import (
"bytes"
"encoding/json"
"errors"
"strings"
"testing"
"github.com/salvacybersec/keyhunter/pkg/engine"
"github.com/salvacybersec/keyhunter/pkg/output"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
)
func TestScanOutput_FormatNamesIncludeAll(t *testing.T) {
names := output.Names()
for _, want := range []string{"table", "json", "csv", "sarif"} {
assert.Contains(t, names, want)
}
}
func TestRenderScanOutput_UnknownReturnsError(t *testing.T) {
err := renderScanOutput(nil, "bogus", false, &bytes.Buffer{})
require.Error(t, err)
assert.True(t, errors.Is(err, output.ErrUnknownFormat))
assert.Contains(t, err.Error(), "valid:")
}
func TestRenderScanOutput_JSONSucceeds(t *testing.T) {
var buf bytes.Buffer
err := renderScanOutput([]engine.Finding{}, "json", false, &buf)
require.NoError(t, err)
var out []any
require.NoError(t, json.Unmarshal(buf.Bytes(), &out))
assert.Len(t, out, 0)
}
func TestRenderScanOutput_TableEmpty(t *testing.T) {
var buf bytes.Buffer
err := renderScanOutput(nil, "table", false, &buf)
require.NoError(t, err)
assert.True(t, strings.Contains(buf.String(), "No API keys found"))
}
```
<success_criteria>
- scan --output dispatches to the formatter registry for all four formats
- Unknown format error lists valid names
- Exit codes: clean=0, findings=1, error=2
- OUT-05 masking default respected via flagUnmask -> Options.Unmask </success_criteria>