Pipelines

Fail a build, without failing every build

Failing a build on any critical finding, in a repository that already has forty of them, fails every build from the first minute and gets switched off by the end of the week. Start narrow.

What to do

Run the scanner against only what changed, with --diff origin/main. What comes back is what this branch introduced.
```
ghscan review . --diff origin/main --fail-on secrets
```
Start with credentials only. Almost nobody argues with a build that fails because somebody committed a key, and it is the finding with the shortest fuse.
If you want the strongest possible signal and nothing else, use --fail-on verified-secrets. That fails only when the provider itself confirmed the key still works.
Add --fail-on critical once the backlog is dealt with, not before.
Write the SARIF file out and hand it to whatever already reads SARIF, so the findings that did not fail the build are still visible somewhere.
```
ghscan review . --format sarif > findings.sarif
```

A tip

Uploading SARIF to a code host uses the pipeline's own token, not this product's. That is how annotations appear on a pull request without the scanner ever holding write access to anything.