CLI-357 Add output formatting

[georgii-borovinskikh-sonarsource]

No description provided.

[hashicorp-vault-sonar-prod]

CLI-357

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
1 Accepted issue
0 New dependency risks

Measures
0 Security Hotspots
81.2% Coverage on New Code
0.0% Duplication on New Code

🛠️ Remediation Agent ready

• Fix automatically
  Creates a separate PR with fixes for eligible issues

See analysis details on SonarQube Cloud

[sonar-review-alpha]

Summary

This PR adds output formatting for dependency risk analysis results. It introduces two output formats (JSON and table) and a new --status-filter option to show either all risks or only unresolved ones.

What changed:

• Added --status-filter CLI option (defaults to 'open') with choices: 'all' or 'open'
• Created formatters for JSON output and human-readable table output
• Implemented filtering logic to separate resolved risks (SAFE, FIXED, ACCEPT) from unresolved ones
• Results are now properly displayed based on the selected format and filter

What reviewers should know

Start with:

1. src/cli/commands/analyze/dependency-risks.ts — main entry point showing how formatters and filters integrate
2. src/cli/commands/analyze/dependency-risk-helpers/analysis-response.ts — filtering and sorting logic (small, foundational)
3. src/cli/commands/analyze/dependency-risk-helpers/format-dependency-risks-table.ts — the largest change; implements complex table layout with issue chains, severity coloring, and summary stats

Key decisions to review:

• Status filter defaults to 'open' (hiding resolved issues). This is a good UX choice but worth confirming it matches product intent.
• Table formatter includes sophisticated handling of transitive dependency chains, excluded version codes, and severity ordering. The logic is data-heavy; tests are extensive (835 lines) so focus review on logic clarity rather than test coverage.
• JSON format is minimal (projects, releases, parsed files, errors only); filtering is applied but response structure stays flat.

Gotchas:

• The applyStatusFilter function modifies the releases array but preserves the full response object — unfiltered data is still accessible elsewhere (e.g., summary line counts total dependencies before filter is applied).
• Table formatter uses internal state (releaseByPurl map) to link transitive chains; this is implementation detail but matters if the data shape ever changes.

---

• Generate Walkthrough
• Generate Diagram

🗣️ Give feedback

[sonar-review-alpha]

LGTM! ✅

🗣️ Give feedback