Use Emendant in CI

Emendant’s exit codes are designed for CI:

0: scan completed, no findings.
1: scan completed, findings present.
2: the scan could not complete.

A minimal GitHub Actions step after the public npm release is:

- name: Scan for breaking API changes
  run: npx --yes emendant scan --no-color

This fails the job when affected code is found. That is usually the right default for a required check.

Keep a JSON report

When another step needs the report, capture the status explicitly so exit code 1 is not mistaken for an interrupted scan:

- name: Run Emendant
  id: emendant
  shell: bash
  run: |
    set +e
    npx --yes emendant scan --json > emendant-report.json
    status=$?
    set -e
    echo "status=$status" >> "$GITHUB_OUTPUT"
    if [ "$status" -eq 2 ]; then
      exit 2
    fi

- name: Upload Emendant report
  if: always()
  uses: actions/upload-artifact@v4
  with:
    name: emendant-report
    path: emendant-report.json

- name: Fail on findings
  if: steps.emendant.outputs.status == '1'
  run: exit 1

Choose a stable scope

Commit emendant.json so local and CI scans use the same package, severity, and ignore rules. Use command-line flags only for deliberate one-off overrides.

Treat warnings as part of the result

Coverage warnings print by default and appear in JSON. Do not discard them: a clean finding count plus a coverage warning means part of the repository could not be checked.