Kjell Tore Guttormsen c4471617a4 test(ci): give policy.json ci.failOn / ci.compact a real test ... The "--fail-on via policy.json" block wrote a policy.json into a tmp root it never scanned and passed --fail-on on the CLI, so ci.failOn / ci.compact had no test at all. The rewrite scans a copy of grade-a-project as the process's own working tree (the only place policy.json is honored since v8.1.0): WARNING with 0 critical exits 1 by default, and exits 0 only if `ci.failOn: 'critical'` is read from the policy. Measured: each branch of main() mutated away turns exactly its own test red (fail 1), real code 4/4. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>		2026-09-22 21:00:31 +02:00
..
e2e	test(llm-security): build poisoned fixtures at test time, never on disk	2026-09-22 13:07:38 +02:00
fixtures	test(ast-taint): materialize the ast-scan fixtures at test time	2026-09-22 14:11:27 +02:00
golden	refactor(llm-security): build the SIG ruleset from vendored commons (malware-signatures 0.1.0)	2026-08-13 21:28:14 +02:00
helpers	fix(policy): read policy.json only from the caller's own working tree	2026-09-22 20:15:17 +02:00
hooks	refactor(llm-security): build the secret table from vendored commons (secret-egress 0.3.0)	2026-08-13 21:10:14 +02:00
lib	fix(policy): read policy.json only from the caller's own working tree	2026-09-22 20:15:17 +02:00
scanners	test(ci): give policy.json ci.failOn / ci.compact a real test	2026-09-22 21:00:31 +02:00
av-surface.test.mjs	test(ast-taint): materialize the ast-scan fixtures at test time	2026-09-22 14:11:27 +02:00