feat: add severity gates and inline IaC suppressions

[axonstone]

Summary

Adds severity-aware prioritization and policy controls across CloudBurn's rules, SDK, and CLI.

• Assigns high, medium, or low severity to all 82 built-in rules and propagates it through findings, JSON/table output, and rules list --severity.
• Adds inclusive --fail-on <severity> gates to scan and discover, with per-mode fail-on config and preserved --exit-code behavior.
• Adds resource-local Terraform and CloudFormation YAML suppressions with optional reasons, retained suppressed output, and exclusion from CI gates.
• Adds coordinated package changesets and updates the public contracts, architecture docs, and examples.

Diagram

flowchart LR
  Rule["Rule metadata\nseverity"] --> Finding["Active findings"]
  IaC["Terraform / CFN YAML\nresource comments"] --> Parser["Parser suppression metadata"]
  Parser --> Partition{"Static result partition"}
  Finding --> Partition
  Partition -->|active| Output["Table / JSON output"]
  Partition -->|suppressed| Audit["suppressed array / count"]
  Output --> Gate{"--fail-on / fail-on / --exit-code"}
  Gate -->|qualifying active finding| Exit1["exit 1"]
  Gate -->|no qualifying finding| Exit0["exit 0"]
  Audit -. excluded .-> Gate

Loading

Validation

• pnpm verify
• 420 rules tests, 362 SDK tests, 123 CLI tests, and 14 documentation tests
• Final targeted review found no remaining actionable suppression paths

Related issues

Closes #101
Closes #102
Closes #103

Follow-ups reviewed but intentionally kept separate: #104, #105, #106, #107, and #122.

[axonstone]

roborev: Combined Review (59fca4a)

Verdict: Fail — one high-severity CI policy bypass remains.

High

• Inline suppressions bypass the CI trust boundary. Even when CI pins --fail-on, repository authors can add cloudburn-ignore-all; suppressed findings then do not affect the exit code. An untrusted change can therefore neutralize the policy gate. Define the approval boundary and add enforcement such as rejecting suppressions, failing when suppressions exist, or requiring centrally approved suppressions. (config-schema.md:48, README.md:133)

---

Reviewers: 3 done | Synthesis: codex, 14s | Total: 14m14s

[axonstone]

Re: comment 5118585392

Addressed in 1df381f. CI still intentionally skips implicit repository config as a trust boundary; the scan/discover help and CLI docs now clearly require --config .cloudburn.yml when CI should use that file, while workflows can pin --fail-on directly. The SDK now exports evaluateScanPolicy(), attaches threshold, qualifyingFindingCount, and violated under ScanResult.policy whenever effective failOn is configured for static or discovery scans, and the CLI consumes the shared evaluator. Added public policy and CloudBurnClient coverage; pnpm verify passes (420 rules, 366 SDK, 123 CLI, and 14 docs tests).

[axonstone]

Re: comment 5118585392

Already addressed in 1df381f. CI configuration trust behavior is now explicit in command help and CLI documentation, and the SDK exposes shared policy evaluation plus ScanResult.policy for configured failOn thresholds. The full verification suite passes.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1df381fca1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Do not open YAML quotes inside plain scalars

When a valid CloudFormation plain scalar contains an unmatched quote character—for example, Description: It's legacy before Resources—this branch sets state.quote even though YAML treats the apostrophe as ordinary plain-scalar content. That state persists across lines, so subsequent real # cloudburn-ignore... comments are treated as quoted text and discarded; the affected findings remain active and can incorrectly fail CI gates. Quote tracking should recognize actual quoted-scalar boundaries or use comment information from the parsed YAML document.

Useful? React with 👍 / 👎.

[axonstone]

Fixed in 59fca4a. YAML quote state now opens only where a quoted scalar can begin, so apostrophes inside plain scalars no longer hide later suppression comments. Added a CloudFormation regression test; pnpm verify passes with 367 SDK tests.