feat(cli): add --fail-on flag for CI/CD gating on new CVEs

[dmchaledev]

Problem

The package README markets sbom-diff as "perfect for CI/CD gates and audit trails," but the CLI always exited with code 0 no matter what the diff found. That makes the primary advertised use case — failing a pipeline when a risky dependency change is introduced — impossible without extra scripting to parse the output.

Change

Add a --fail-on flag that turns the diff into a pass/fail gate:

--fail-on	Fails when…
none (default)	never — always exits 0
any	any new CVE is introduced
low / medium / high / critical	a new CVE appears at or above that severity

When the policy is triggered, the report is still printed to stdout and a short reason is written to stderr, and the process exits with code 3 (deliberately distinct from the 1 used for usage/runtime errors, so CI can tell a policy failure from a crash).

# GitHub Actions
- name: Gate on new high/critical CVEs
  run: npx @hailbytes/sbom-diff sbom.base.json sbom.pr.json --fail-on high

Notes

• Backward compatible. The default policy is none, preserving the prior always-exit-0 behaviour. Existing --format handling and output are unchanged.
• A new CVE with an unknown severity only trips the any gate, since it can't be compared against a severity threshold.
• parseArgs and the new pure gateFailures() helper are unit-tested (9 new tests: flag parsing, threshold selection, unknown-severity handling). Full suite: 38 passing. lint, tsc --noEmit, and build all clean.

Files

• src/cli.ts — --fail-on parsing, gateFailures(), exit-code logic
• src/__tests__/cli.test.ts — parsing + gate-evaluation tests
• README.md, CHANGELOG.md — documentation

🤖 Generated with Claude Code

https://claude.ai/code/session_01BtfgewzoZwjEmGChLPtzHy

---

Generated by Claude Code