Output formats and exit codes

Every vulkro-live command that reports findings takes --format text|json|sarif and uses the same exit codes.

vulkro-live verify --format json lodahs
vulkro-live audit --format sarif > audit.sarif

Format	Output
text	A readable table (default)
json	A flat JSON array of findings
sarif	SARIF 2.1.0 for code scanning

--format works on verify, warden, inspect, audit, foresee, skillscan, memcheck, drift and provenance. lock and trustdb write files, and cardcheck prints text only.

JSON

$ vulkro-live verify --format json lodahs
[
    {
        "ecosystem": "npm",
        "name": "lodahs",
        "verdict": "MALICIOUS",
        "reason": "flagged malicious by OSV (MAL-2025-25502): Malicious code in lodahs (npm)",
        "latest_version": "0.0.1-security",
        "created": "2019-11-25T16:49:21.220Z",
        "malicious_ids": ["MAL-2025-25502"]
    }
]

SARIF

Rule ids are vulkro-live/<command>/<slug>, for example vulkro-live/verify/malicious, so they never clash with vulkro scanner rules in the same code scanning view.

Exit codes

Code	Meaning
0	Nothing flagged
1	Something flagged
2	Error (bad arguments, IO failure, no lock file for drift)

What counts as flagged: any package not OK (verify); a HIGH or MEDIUM finding (warden); REVIEW or AVOID (inspect, skillscan, cardcheck); a planted trap (foresee); any flagged item (audit); a poisoned memory (memcheck); any change since the lock (drift). lock and trustdb exit only 0 or 2.

In CI

- name: Install vulkro-live
  run: |
    curl -fsSL https://dist.vulkro.com/install-live.sh | bash -s -- --bin-dir "$HOME/.local/bin"
    echo "$HOME/.local/bin" >> "$GITHUB_PATH"
- name: Agent setup checks
  run: vulkro-live audit --format sarif > audit.sarif
- uses: github/codeql-action/upload-sarif@v3
  if: always()
  with:
    sarif_file: audit.sarif

A flagged result exits 1, so the step fails without parsing any output.