Exit codes

An exit code describes the command you ran. A successful preview is not the same as a passing scan.

Scan decisions

Separate blocking findings from missing analysis

scan exit codes
Code	Meaning	Next action
0	No policy blockers. Allowed warnings or incomplete results can still be present.	Read the complete report, including allowed incomplete checks.
1	Completed findings block under repository policy, with no blocking incomplete result taking precedence.	Address the attributable findings, stage intended changes, and rescan.
2	Required analysis or a prerequisite could not complete.	Resolve the diagnostic before relying on the gate.

A blocking incomplete result takes precedence over blocking findings. A scan can contain both and exit 2. Changing text, JSON, or SARIF output does not change that decision.

failOnIncomplete and explicit OSV outage policy affect which incomplete checks block. A warn-severity finding and a failed analyzer are different; setting severity to warn does not automatically make analyzer failure non-blocking.

Compare the incomplete-result policy scenarios

Managed fix exit status

Fix outcomes describe the plan and file operations

Managed-fix command outcomes
Code	Meaning	Can files have changed?
0	Preview/cancel completed without applying, or approved operations completed without a reported issue.	Only if application was approved. Read the applied state and result.
1	The plan or application is partial or has unresolved issues; safe operations may have succeeded.	Yes, if approved. Inspect changed and skipped files.
2	A trustworthy plan could not be prepared, or the command could not complete.	Do not infer rollback from the status alone. Inspect diagnostics and the working diff.

There is a preview nuance: when applicable fixes exist, declining them or printing a preview without --yes returns 0, even if the plan records unresolved issues. If no applicable fixes exist, the command returns the plan’s status. Read the plan as well as the process result.

After approved application, the command accounts for both plan issues and apply issues. A nonzero result does not mean every file was left untouched. Review conflicts, stale files, skipped edits, and durability warnings before retrying.

fix exit code 0 does not mean scan exit code 0.

Fixes do not stage or commit, and unsupported findings remain manual. Review the working diff, stage the changes you intend, and run a fresh scan.

Review fix selectors and approval behavior

Setup and diagnostics

Success is specific to each command

Other command results
Command	0	2
`init`	The preview, cancellation, or approved setup completed. Check whether changes were actually applied.	Setup could not complete. Read the failure details.
`checks`	Effective settings and applicability were inspected. No scan verdict is implied.	Inspection or configuration loading failed.
`doctor`	No diagnostic has fail status. Warning diagnostics can still be present.	At least one diagnostic failed, or diagnostics could not complete.

Invalid arguments and unknown flags are CLI usage errors, not policy findings. They can exit 1 before a command runs and may not produce structured output. Always read stderr; do not classify every nonzero process by the scan table alone.

For handled interruptions, SIGINT maps to 130 and SIGTERM to 143. Interrupted scans attempt snapshot cleanup before returning. Shell failures, unavailable executables, and forced termination can have other statuses and must not be treated as a passing scan.

Shell and CI

Save the report without losing the status

Prepare origin/main and the required history before using this example. It captures the scan status immediately, permits follow-up reporting, and returns the original status to CI.

Do not append || true to a quality gate or let a successful logging or upload command become the job’s final status. A pipeline through tee can also report the downstream command’s status unless your shell is configured to preserve failures.

Configure artifact upload to run on failed jobs as well as successful ones. Check that the report exists and is valid before upload; an invocation error can leave an empty redirected file.

Use the complete CI setup guide

set -eu

scan_status=0
npx zedbee scan \
  --base origin/main \
  --format sarif > zedbee.sarif || scan_status=$?

case "$scan_status" in
  0) echo "No policy blockers; inspect allowed incomplete results" ;;
  1) echo "Blocked findings or command usage error; inspect output" ;;
  2) echo "Required analysis or command prerequisites failed" ;;
  *) echo "Command interrupted or failed: $scan_status" ;;
esac

exit "$scan_status"