CI and exit codes¶

Razin supports CI gating by actionable severity and non-probabilistic review priority.

Exit code controls¶

# Fail if any high-severity finding exists
razin scan -r . --fail-on high --no-stdout

# Fail if review priority is 70 or above
razin scan -r . --fail-on-score 70 --no-stdout

# Either condition can fail the job
razin scan -r . --fail-on medium --fail-on-score 50 --no-stdout

Display filters vs gating¶

Display filters do not alter scanner execution:

--min-severity
--security-only
--summary-only

Gating behavior:

--fail-on evaluates security findings from the full scan (after rule overrides). Informational capability inventory cannot fail this gate.
--fail-on-score evaluates review priority from full findings. Priority is the strongest actionable signal, not a maliciousness probability, and does not combine correlated detector weights.
The audit profile is always non-blocking, even when fail flags are supplied.

Example:

# Output only medium/high rows, but still fail if any low security finding exists
razin scan -r . --min-severity medium --fail-on low --no-stdout

Rule overrides and CI¶

rule_overrides in config are policy-level controls and do affect CI thresholds.

rule_overrides:
  MCP_REQUIRED:
    max_severity: low

With this override, MCP_REQUIRED findings are capped before fail checks run.

Rule-disable controls also affect CI because disabled rules do not execute:

rule_overrides:
  MCP_REQUIRED:
    enabled: false

Equivalent one-run CLI controls:

razin scan -r . --disable-rule MCP_REQUIRED
razin scan -r . --only-rules SECRET_REF --only-rules OPAQUE_BLOB

Rulepack composition in CI¶

# Merge enterprise rules and fail on duplicate IDs
razin scan -r . -R ./enterprise-rules --rules-mode overlay --duplicate-policy error

# Merge enterprise rules and let custom duplicates override bundled rules
razin scan -r . -R ./enterprise-rules --rules-mode overlay --duplicate-policy override

Example GitHub Actions step¶

- name: Run Razin gate
  run: |
    razin scan \
      --root . \
      --output-dir output/ \
      --profile strict \
      --summary-only \
      --fail-on medium \
      --fail-on-score 50

Quiet mode in CI¶

Quiet mode is designed for CI and automation pipelines that need machine-ingestible output without terminal noise.

razin scan -r . --quiet-mode --quiet-output results.jsonl --fail-on medium

Gotcha: Output filters (--min-severity, --security-only) affect only what gets written to the quiet output file. Gate evaluation (--fail-on, --fail-on-score) always uses all findings from the full scan. The quiet summary record includes gate_scope: "all_findings" for auditability.

Quiet mode rejects conflicting output flags: -o, --output-format, --group-by, --summary-only. Use config-based quiet mode for persistent settings:

quiet_mode:
  enabled: true
  output_path: scan-results.jsonl
  write_mode: overwrite

Docs CI checks in this repository¶

uv run mkdocs build --strict
uv run mdformat --check README.md docs

Link checks run in CI workflow against README.md and docs/ markdown files.