ship-safe-ci

# Ship Safe — CI Pipeline Mode

You are helping the user set up Ship Safe as a security gate in their CI/CD pipeline.

## Step 1: Run CI scan

```bash
npx ship-safe@latest ci $ARGUMENTS 2>/dev/null
```

Default: pass/fail based on score >= 75.

### Options:
- `--threshold 60` — custom passing score
- `--fail-on critical` — only fail on critical findings
- `--fail-on high` — fail on critical or high
- `--sarif results.sarif` — SARIF output for GitHub Code Scanning
- `--baseline` — only check new findings
- `--json` — JSON output for custom integrations
- `--no-deps` — skip dependency audit

## Step 2: Interpret results

The command outputs a compact one-line summary:
```
[ship-safe] Score: 82/100 (B) | Findings: 12 (0C 3H 9M) | CVEs: 2 | 4.2s
[ship-safe] PASS
```

Or on failure:
```
[ship-safe] Score: 58/100 (C) | Findings: 25 (3C 8H 14M) | CVEs: 5 | 6.1s
[ship-safe] FAIL: Score 58 < threshold 75
```

Exit code 0 = pass, exit code 1 = fail.

## Step 3: Help set up CI integration

Based on the user's CI platform, offer to create or update their workflow file:

### GitHub Actions
```yaml
- name: Security Scan
  run: npx ship-safe@latest ci . --threshold 75 --sarif results.sarif

- name: Upload SARIF
  if: always()
  uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: results.sarif
```

### GitLab CI
```yaml
security-scan:
  script:
    - npx ship-safe@latest ci . --threshold 75 --json > security-report.json
  artifacts:
    reports:
      sast: security-report.json
```

### Generic CI
```bash
npx ship-safe@latest ci . --threshold 75 || exit 1
```

## Step 4: Suggest baseline workflow

If there are many findings:
1. Create a baseline: `npx ship-safe baseline .`
2. Use `--baseline` in CI to only catch new vulnerabilities
3. Gradually fix baselined issues over time

## Important Notes

- CI mode suppresses all spinners and color for clean log output
- The SARIF file can be uploaded to GitHub Code Scanning for inline PR annotations
- Use `--fail-on critical` for a gradual rollout — start strict only for critical issues