Status codes for different status messages

I am planning to have bundler-audit in my CI and would like to stop/fail the build if there are any vulnerabilities found in my existing gems in Gemfile. So, instead of using regex/string match for "Vulnerabilities found!" etc. it would be good to have status codes for different messages.

I don't know if we have something like this in the roadmap or I can chime into it with some guidance.

bundler-audit already exits with status code 1 if any vulnerabilities are found, which should cause any CI test suite to fail once any of the commands fail. bundler-audit also exits with 1 if any other errors occur (ex: No such file or directory: or Unknown format:), so maybe I should assign separate error codes for those errors.

bundler-audit/lib/bundler/audit/cli.rb

Lines 50 to 88 in 017d1f5

    
           unless File.directory?(dir) 
        
             say_error "No such file or directory: #{dir}", :red 
        
             exit 1 
        
           end 
        
           begin 
        
             extend Formats.load(options[:format]) 
        
           rescue Formats::FormatNotFound 
        
             say_error "Unknown format: #{options[:format]}", :red 
        
             exit 1 
        
           end 
        
           if !Database.exists?(options[:database]) 
        
             download(options[:database]) 
        
           elsif options[:update] 
        
             update(options[:database]) 
        
           end 
        
           database = Database.new(options[:database]) 
        
           scanner  = begin 
        
                        Scanner.new(dir,options[:gemfile_lock],database, options[:config]) 
        
                      rescue Bundler::GemfileLockNotFound => exception 
        
                        say exception.message, :red 
        
                        exit 1 
        
                      end 
        
           report = scanner.report(ignore: options.ignore) 
        
           output = if options[:output] 
        
                      File.new(options[:output],'w') 
        
                    else 
        
                      $stdout 
        
                    end 
        
           print_report(report,output) 
        
           output.close if options[:output] 
        
           exit(1) if report.vulnerable?

I'd be satisfied with meaningful non-zero exit statuses, or flags similar to brakeman's --no-exit-on-warn and --no-exit-on-error which allow you to suppress exit codes for CI purposes. Thanks!

Going to close this since I answered OP's question.

However, @komidore64 could you explain how those codes would work? bundler-audit does not "warn", it only indicates that issue(s) were found or no issues were found. If an advisory is explicitly ignored then it is omitted from the report output and will cause bundler-audit to exit successfully. I am assuming --no-exit-on-error would suppress any non-zero exit codes? That could also be accomplished by appending || true to the bundle-audit command.

However, @komidore64 could you explain how those codes would work?

Mentioning brakeman's flags may have caused more confusion than necessary since bundle-audit doesn't exactly have "warnings" like you described. I apologize.

I would like a flag that I can pass to bundle-audit to suppress non-zero exits even if issues/vulnerabilities are discovered.

I feel I may be high-jacking this issue. I would be happy to open a new issue if this is something you're interested in exploring.

I would like a flag that I can pass to bundle-audit to suppress non-zero exits even if issues/vulnerabilities are discovered.

Luckily, bash already supports that: bundler-audit ... || true

I would like a flag that I can pass to bundle-audit to suppress non-zero exits even if issues/vulnerabilities are discovered.

Luckily, bash already supports that: bundler-audit ... || true

That's not the same thing. bundle-audit ... || true suppresses any and all non-zero exits from bundle-audit. I just want > 0 vulnerabilities found to exit as zero, signifying to CI that bundle-audit completed successfully. I still want all other errors (file read errors, runtime errors, etc) to trigger as normal.

@komidore64 I'm curious how you would identify that bundler-audit found errors if it returns 0? I'm guessing you use a regex on the full CI output?

@komidore64 I'm curious how you would identify that bundler-audit found errors if it returns 0? I'm guessing you use a regex on the full CI output?

I can tell if bundler-audit discovered vulnerabilities by parsing its JSON output.

I can tell if bundler-audit discovered vulnerabilities by parsing its JSON output.

AH HA! In that case we could suppress the exit status code when writing the report output to a file?

AH HA! In that case we could suppress the exit status code when writing the report output to a file?

I'm reading the JSON from stdout, but it wouldn't be much work for me to write it to a file instead.

I'm open to that.

	unless File.directory?(dir)
	say_error "No such file or directory: #{dir}", :red
	exit 1
	end

	begin
	extend Formats.load(options[:format])
	rescue Formats::FormatNotFound
	say_error "Unknown format: #{options[:format]}", :red
	exit 1
	end

	if !Database.exists?(options[:database])
	download(options[:database])
	elsif options[:update]
	update(options[:database])
	end

	database = Database.new(options[:database])
	scanner = begin
	Scanner.new(dir,options[:gemfile_lock],database, options[:config])
	rescue Bundler::GemfileLockNotFound => exception
	say exception.message, :red
	exit 1
	end

	report = scanner.report(ignore: options.ignore)

	output = if options[:output]
	File.new(options[:output],'w')
	else
	$stdout
	end

	print_report(report,output)

	output.close if options[:output]

	exit(1) if report.vulnerable?