feat(cli): add fail-on-findings option

[deepujain]

Summary

• add an opt-in --fail-on-findings gate for active findings below the aggregate risk threshold
• apply the gate to single and recursive scans after reports are written
• cover the low-risk single-scan and recursive cases

Validation

• ruff format --check src/skillspector/cli.py tests/unit/test_cli.py
• ruff check src/skillspector/cli.py tests/unit/test_cli.py
• git diff --check
• python3 -m py_compile src/skillspector/cli.py tests/unit/test_cli.py
• focused pytest could not collect locally because the temporary Python environment did not retain package metadata; CI is the remaining test surface

Fixes #448

Signed-off-by: Deepak Jain deepujain@gmail.com

[rng1995]

[SkillSpector Review]

Reviewed current head d4e5942508223db05163b02c1dfc38d6d3bd733f. --fail-on-findings is applied after report output, aggregates recursive child findings, and preserves execution-failure exit-code precedence. The regressions cover both single-scan and recursive low-score modes. I found no required code or test changes.

All hosted required checks pass. The branch is behind main, so it must be updated and revalidated before merging.

[rng1995]

[SkillSpector Review]

Corrective re-review of current head 768ff663d2fde2813c5501b9fb6f8cbc9df4cfa7 after the force-push/rebase and latest main synchronization. The ordinary single-skill and recursive gates remain correctly placed after report generation and below execution-failure precedence, but the new public flag is silently ignored in the supported MCP Registry scan path. The required correction and regression are detailed inline; please also update the documented stable exit-code contract.

changes, lint, DCO, and docker-smoke pass; test-unit is still running. This is not merge-ready.

[rng1995]

scan accepts --fail-on-findings together with --mcp-registry, but that branch returns at lines 561-588 before either new finding check. scan_registry() exposes a findings list, and a single unpinned package contributes a risk score of 30, so this command exits 0 even though the requested gate has a finding to block. Apply the flag to registry findings or reject this option combination explicitly, and add a below-threshold registry regression. Please also update the README's stable exit-code contract to include the new opt-in exit-1 condition.

[rng1995]

[SkillSpector Review]

Re-reviewed current head ca2ce8b8391476dc87ba6ebbf0033859e6d1b121 after the author force-push. The PR-owned cli.py and test_cli.py blobs are byte-identical to previously reviewed head 768ff663d2fde2813c5501b9fb6f8cbc9df4cfa7; the existing inline thread remains unresolved and has no reply. The required correction therefore remains: --fail-on-findings is accepted with --mcp-registry, but that branch returns before applying the gate, so a below-threshold registry finding can still exit 0. Apply the gate or reject the option combination, add the registry regression, and update the README's stable exit-code contract.

All hosted checks pass, but this head is not merge-ready.

[rng1995]

[SkillSpector Review]

Re-reviewed current head 9bd7bd500d0eb07d41310f08d507d32ca64383e6 after the force-push. The two PR-owned blobs are byte-for-byte identical to the last marked changes-requested head.

The existing blocker remains: scan accepts --fail-on-findings with --mcp-registry, but the registry path returns at lines 561-588 before applying the new gate. A below-threshold registry finding can therefore still exit 0. Apply the gate or reject the option combination, add the registry regression, and update README's stable exit-code contract.

All hosted checks pass, but the current review thread remains unresolved and GitHub reports mergeStateStatus=BLOCKED.