chore: Fix IaC test exit code when issues are found

[ofekatr]

• Follows CONTRIBUTING rules

What does this PR do?

• Fixes the exit code for the new IaC test flow to be 1 instead of 0, as is expected by the Snyk CLI (source).

Where should the reviewer start?

src/lib/iac/test/v2/output.ts

How should this be manually tested?

• Run snyk iac test with a directory/file with issues, in all three formats: text, JSON, SARIF.
• Ensure the exist code is 1.
• Run snyk iac test --experimental with a directory/file with issues, in all three formats: text, JSON, SARIF.
• Ensure the exist code is 1.
• Run snyk iac test with a directory/file without issues, in all three formats: text, JSON, SARIF.
• Ensure the exist code is 0.
• Run snyk iac test --experimental with a directory/file without issues, in all three formats: text, JSON, SARIF.
• Ensure the exist code is 0.

Any background context you want to provide?

• At the moment when the new test flow returns issues, the exit code is 0, but based on the status codes list in the CLI’s help doc:

Exit codes
  Possible exit codes and their meaning:

  0: success, no vulnerabilities found
  1: action_needed, vulnerabilities found
  2: failure, try to re-run command
  3: failure, no supported projects detected

We should receive 1 when issues were found.
Running snyk iac test in all output formats confirms it, as it currently returns exist code 1.

Additional information

• Slack thread
• Snyk CLI docs

[YairZ101]

LGTM
the rest of the exit codes are working as expected?

[ofekatr]

the rest of the exit codes are working as expected?

@YairZ101 The exit code for failures is 0, which is incorrect.
IIUC, we intend to have additional work on failures, after which we ensure the correct exit code, which is 2

[YairZ101]

IIUC, we intend to have additional work on failures, after which we ensure the correct exit code, which is 2

What stops us from fixing the other 2 error codes now as well?

[ofekatr]

• When there are no issues, we get 0 as expected.
• With this PR, when there are issues, we would get 1 as expected.
• When the CLI fails, we automatically get 2 as expected. However, in case all of the tested files failed, we should likely return 2 like in local-execution, but we should discuss with the team about how this should be first.
• When only scanning unsupported files, we need to return 3, which we currently don't.

In general I would separate these to their own PRs to ensure we review these cautiously and decouple the changes.

[YairZ101]

In general I would separate these to their own PRs

okay, please make sure to open a ticket for this bug so we could track it.

[ofekatr]

In general I would separate these to their own PRs

• For exit code 2: CFG-2076
• For exit code 3: CFG-2077

cc @YairZ101