sentinello 3.0.0 → 3.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +7 -3
- package/dist/cli.cjs +576 -392
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -76,12 +76,16 @@ Run `sentinello --help` for the full list. The ones people reach for:
|
|
|
76
76
|
| `--fail-on <level>` | exit 2 when matched, for CI |
|
|
77
77
|
| `--out <file\|->` | where the advisory goes |
|
|
78
78
|
| `--json` | machine-readable output |
|
|
79
|
-
| `-y, --yes` | accept the first-run download without asking |
|
|
79
|
+
| `-y, --yes` | accept the first-run download without asking. Required on a non-TTY |
|
|
80
80
|
| `--offline` | use the cache as-is, no network |
|
|
81
81
|
| `--doctor` | cache status, resolved settings, and what was skipped and why |
|
|
82
82
|
|
|
83
|
-
Exit codes: `0` completed, `1` a scan or configuration error
|
|
84
|
-
Findings alone are not a failure.
|
|
83
|
+
Exit codes: `0` completed, `1` a scan or configuration error — including a `--fail-on` run that could
|
|
84
|
+
not consult one of its sources, `2` the `--fail-on` threshold was met. Findings alone are not a failure.
|
|
85
|
+
|
|
86
|
+
In CI, pass both: `npx --yes sentinello --yes --fail-on high`. The first `--yes` answers npm's own
|
|
87
|
+
"Ok to proceed?" prompt for an uncached package; the second accepts the first-run advisory download,
|
|
88
|
+
which is refused on a non-interactive terminal.
|
|
85
89
|
|
|
86
90
|
## Requires
|
|
87
91
|
|