feat(ci): baseline diff + strict mode + diff-scan flags (closes #57 phase 1+2)

[Wolfvin]

Issue #57 — CI/CD integration suite, Phase 1 + Phase 2

Closes #57 (partial — Phase 1 + Phase 2 only).

Scope of this PR

Issue #57 has 7 phases. This PR implements Phase 1 (baseline + diff scan) and Phase 2 (strict mode + thresholds). Phases 3–7 (codelens ci command, manifest tests, golden snapshots, git hooks, agent benchmark) will be separate PRs.

Phase 1 — baseline + diff scan

New files:

• scripts/git_integration.py — thin wrapper over git_aware._run_git with CI/CD-specific helpers: list_staged_files, list_working_tree_changes, list_diff_vs, resolve_baseline_sha (resolution order: explicit arg → $CODELENS_BASELINE_SHA env → HEAD~1), detect_ci_environment (GitHub/GitLab/Jenkins/Bitbucket/CircleCI).
• scripts/baseline_diff.py — finding identity hash (rule_id|file|line|severity) (deliberately excludes message text and column for stability across parser updates), diff_findings() classifying into new/preexisting/resolved, save_baseline()/load_baseline() persisting to .codelens/baseline_<SHA>.json, filter_to_changed_files().

Modified:

• scripts/commands/check.py — new flags:
  • --baseline-commit <SHA> — only NEW findings fail the gate; preexisting ones are surfaced in output but don't fail
  • --save-baseline — persist current findings as the baseline for a future --baseline-commit run
  • --diff-scan — restrict to working-tree changes (vs HEAD)
  • --staged — restrict to staged files (git diff --cached)
  • --diff-vs <ref> — restrict to files changed vs ref (branch/tag/SHA)
• scripts/formatters/sarif.py — to_sarif() / format_sarif() accept automation_guid param, emitted as SARIF automationDetails.guid so CI dashboards (GitHub code scanning, SonarQube) can group related runs.

Phase 2 — strict mode + thresholds

New file:

• scripts/exit_policy.py — ExitDecision dataclass + evaluate_exit_policy() implementing:
  • --strict → threshold = low (any finding fails)
  • --error → threshold = high
  • --severity-threshold <level> → explicit
  • --max-findings N → cap (0 = no cap)
  • Priority: explicit threshold > strict > error
  • Pure function — does NOT call sys.exit; the existing codelens.py exit-on-gate-failed dispatcher handles it via the gate field.

Modified:

• scripts/commands/check.py — --strict / --error / --severity-threshold flags wired in. When none of the new flags are set, the legacy --severity / --max-findings / --health-min gate runs unchanged (backward-compat for existing CI configs).

Acceptance criteria

Phase 1+2 subset:

• codelens check --baseline-commit <SHA> reports only new findings
• codelens check --strict --error exits non-zero on any high-severity finding
• SARIF automationDetails.guid emitted when --baseline-commit is set
• --diff-scan / --staged / --diff-vs narrow to git-changed files

Phase 3+ acceptance criteria (out of scope):

• codelens ci auto-detects GitHub Actions and uploads SARIF — Phase 3 (separate PR)
• codelens install-ci generates workflow file — Phase 3 (separate PR)
• Manifest test suite runs 50+ cases — Phase 4 (separate PR)
• Rule quality harness catches regression — Phase 5 (separate PR)

Tests

File	Tests	Coverage
tests/test_baseline_diff.py	33	identity stability, diff classification, save/load round-trip, filter_to_changed_files
tests/test_exit_policy.py	32	strict/error/threshold modes, max-findings cap, priority resolution, ExitDecision shape
tests/test_git_integration.py	21	staged/working-tree/diff-vs against real temp git repos, CI env detection, non-git graceful failure
tests/test_check_ci_flags.py	13	end-to-end codelens check with new flags, real git repos, SARIF guid emission
Total new	99	all green

Test results

tests/test_baseline_diff.py:     33 passed
tests/test_exit_policy.py:       32 passed
tests/test_git_integration.py:   21 passed
tests/test_check_ci_flags.py:    13 passed

Full suite (excluding test_integration.py per CONTEXT.md,
and tree-sitter-dependent tests that require optional deps):
  1294 passed, 90 skipped, 4 pre-existing failures

The 4 pre-existing failures are unrelated to this PR (verified via git stash + rerun on unmodified main):

• test_codelensignore::test_actual_target_dir_is_ignored
• test_universal_grammar_loader::test_auto_installs_when_env_var_set
• test_universal_grammar_loader::test_returns_language_after_successful_install
• test_universal_grammar_loader::test_available_languages_returns_list

All four fail identically on unmodified main (caused by missing optional tree_sitter dependency and an unrelated target/ ignore-rule quirk).

Design notes

• Finding identity excludes message and column. Per issue [FEATURE] CI/CD integration suite — baseline scan, diff scan, strict mode, manifest tests, golden snapshots #57 worker consensus (UBS [ARCH] Replace flat registry with true graph data model (nodes + edges) #7): identity = hash of (rule_id, file, line, severity). This means parser updates that change message wording or shift a column by 1–2 chars will NOT re-flag the same issue as "new" against the baseline.
• Baselines stored in .codelens/baseline_<SHA>.json. Human-readable JSON so they can be committed to a repo or attached as CI artifacts. The SHA in the filename makes it easy to find the right baseline for a given PR base.
• $CODELENS_BASELINE_SHA env var. Phase 3 (codelens ci command) will set this automatically from the PR base SHA. For now users can set it manually in their CI workflow.
• Pure exit_policy. The decision logic is a pure function — no sys.exit side effect. This makes it trivially testable and reusable by Phase 3's codelens ci orchestrator.
• Backward-compat preserved. Running codelens check with none of the new flags behaves identically to before (legacy severity/max-findings gate runs unchanged).

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[sonarqubecloud]

Quality Gate passed

Issues
11 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud