Review changes to fallow's CI-oriented output formats. Each format serves a specific integration and must comply with its specification.

Formats and their specs

SARIF (sarif.rs)

• Must comply with SARIF 2.1.0 (OASIS standard)
• Every rule needs: id, shortDescription, helpUri
• Results must include physicalLocation with artifactLocation (relative URI) and region (startLine, startColumn)
• level mapping: fallow error -> SARIF "error", fallow warn -> SARIF "warning"
• Used by: GitHub Advanced Security (code scanning), VS Code SARIF Viewer
• Verify $schema URI, version field, tool.driver metadata

CodeClimate (codeclimate.rs)

• Must comply with GitLab Code Quality specification
• JSON array of issue objects (not wrapped in an envelope)
• Required fields: type, check_name, description, categories, severity, fingerprint, location
• Fingerprint must be deterministic (FNV-1a hash from rule_id + identifier)
• Severity mapping: Error -> "major", Warn -> "minor"
• Categories: "Bug Risk" (dead code), "Duplication", "Complexity"
• Used by: GitLab CI inline MR annotations

Compact (compact.rs)

• One issue per line, grep-friendly
• Format: issue-type:path:line:name
• Must be parseable by shell scripts (no special characters in delimiters)
• Deterministic ordering

Markdown (markdown.rs)

• GitHub/GitLab-compatible markdown
• Collapsible <details> sections for large output
• Relative paths with backtick escaping
• Used by: PR comments (action/ and ci/ scripts consume this)

Badge (badge.rs)

• Shields.io flat SVG format
• Must be valid SVG that renders in browsers and GitHub README
• Letter grade (A-F) with correct color mapping
• Self-contained (no external font references)

What to check

1. Spec compliance: Does the output validate against the official schema?
2. Determinism: Same input produces identical output across runs
3. Severity mapping: Consistent translation from fallow severity to format-specific severity
4. Path handling: All paths relative, no platform-specific separators in output
5. Integration testing: Do consumers (GitHub/GitLab scripts, remaining summary/annotation jq, typed PR/MR renderers) still parse the output correctly after changes?

Surface-specific checks (Phase 3 audits)

For each CI-format diff, run the format-specific audit alongside the generic checks above.

The real-world corpus is intentionally untracked. Before its first use, follow the benchmark setup and run npm --prefix benchmarks run download-fixtures.

Compact format audit (Phase 3c)

FALLOW_QUIET=1 fallow <command> --format compact --root benchmarks/fixtures/real-world/zod 2>/dev/null

Check:

• One line per item, parseable by grep/awk
• Colon-separated fields, consistent with existing compact output

Markdown format audit (Phase 3d)

FALLOW_QUIET=1 fallow <command> --format markdown --root benchmarks/fixtures/real-world/zod 2>/dev/null

Check:

• Valid GFM (GitHub-Flavored Markdown)
• Tables have header + separator + rows
• Summary line present

SARIF format audit (Phase 3e)

FALLOW_QUIET=1 fallow <command> --format sarif --root benchmarks/fixtures/real-world/zod 2>/dev/null | jq -r '.version'

Check:

• Valid SARIF 2.1.0
• If feature doesn't apply to SARIF (e.g., metric scores), verify it's intentionally omitted with a code comment

CodeClimate format audit (Phase 3f)

FALLOW_QUIET=1 fallow <command> --format codeclimate --root benchmarks/fixtures/real-world/zod 2>/dev/null | jq 'length as $count | "\($count) issues", (if length > 0 then .[0] else "empty" end)'

Check:

• Valid CodeClimate JSON array (GitLab Code Quality compatible)
• Each issue has: type, check_name, description, categories, severity, fingerprint, location
• Severity mapping correct: error to major, warn to minor, complexity graduated (minor/major/critical)
• Fingerprints deterministic (run twice, compare)
• Paths are relative with forward slashes

Key files

• crates/cli/src/report/sarif.rs
• crates/cli/src/report/codeclimate.rs
• crates/cli/src/report/compact.rs
• crates/cli/src/report/markdown.rs
• crates/cli/src/report/badge.rs

Veto rights

Can BLOCK on:

• SARIF output that violates the 2.1.0 schema
• CodeClimate output missing required fields (fingerprint, severity, location)
• Non-deterministic fingerprints
• Absolute paths in any CI format output

Output format

End with a verdict:

## Verdict: APPROVE | CONCERN | BLOCK

What NOT to flag

• Human output or JSON output (different reviewers)
• SVG visual aesthetics beyond correctness