Exit codes: how the gate decides
The CLI is built to be a CI gate, so the verdict is the exit code. There is deliberately no state between pass and block, and an incomplete scan never reads as a pass.
| Code | Meaning | What it tells the pipeline |
|---|---|---|
0 | Pass | No blocking findings. The build may ship. |
1 | Block | At least one proven violation. The pipeline should stop. |
2 | Unknown | The scan could not complete. The gate fails closed: treat it as a block, never as a pass. |
The 2 case is the important one. A gate that turns a failed scan into a green
build is worse than no gate at all, so an incomplete scan is a block by design.
Next: wire this into your pipeline with The CI gate.