Advisory CI

Keep the pre-prod analyzer advisory. Preserve reports and exit codes for review; do not treat this documentation as a default blocking policy.

Pin the environment and inputs#

Use the same owner-provided product revision and compatible macOS toolchain as the documentation. Review build authorization for the package and locked dependencies. Run the small tutorial first; arbitrary hosted runners or Linux environments are not qualified by the macOS source-scan example.

Preserve the report and the process result#

A shell step can record the result without replacing an incomplete analysis with a clean status:

if "$ANALYZER" source-scan \
  --package-path "$PACKAGE_PATH" --product "$PRODUCT_NAME" \
  --allow-build --format json > analysis.json 2> analysis.stderr
then
  analyzer_exit=0
else
  analyzer_exit=$?
fi
printf '%s\n' "$analyzer_exit" > analysis.exit

Set PACKAGE_PATH and PRODUCT_NAME to reviewed inputs in your CI configuration. Store all three files as job artifacts. Read the exit file before consuming JSON; a failed acquisition or invalid request may not produce the document you expected. Report degraded and unavailable states explicitly to reviewers.

Avoid an accidental gate#

The manifest scan command exposes an explicit --gate option and workflow inputs. Their existence does not authorize blocking adoption or define a baseline for your project. Decide an application-specific policy only after qualifying the selected snapshot and rules. Source-scan has no --gate flag in this revision.

JSON and exit codes distinguishes incomplete capability, invalid input, toolchain failure and a configured findings gate failure.