chore: share one SeverityRank between scanner and cli

internal/cli/check.go

@@ -69,10 +69,10 @@ func runCheckCommand(args []string, stdout, stderr io.Writer, scannerInstance *s
 	result.Version = Version
 
 	if minSev != "" {
-		minRank := severityRank(minSev)
+		minRank := scanner.SeverityRank(minSev)
 		filtered := make([]scanner.Finding, 0, len(result.Findings))
 		for _, f := range result.Findings {
-			if severityRank(f.EffectiveSeverity()) >= minRank {
+			if scanner.SeverityRank(f.EffectiveSeverity()) >= minRank {
 				filtered = append(filtered, f)
 			}
 		}

internal/cli/scan.go

@@ -37,21 +37,6 @@ func parseSeverity(s string) (scanner.Severity, bool) {
 	}
 }
 
-func severityRank(sev scanner.Severity) int {
-	switch sev {
-	case scanner.SeverityInfo:
-		return 0
-	case scanner.SeverityWarning:
-		return 1
-	case scanner.SeverityHigh:
-		return 2
-	case scanner.SeverityCritical:
-		return 3
-	default:
-		return 0
-	}
-}
-
 func runScanCommand(args []string, stdout, stderr io.Writer, scannerInstance *scanner.Scanner) int {
 	fs := flag.NewFlagSet("scan", flag.ContinueOnError)
 	fs.SetOutput(stderr)
@@ -112,10 +97,10 @@ func runScanCommand(args []string, stdout, stderr io.Writer, scannerInstance *sc
 
 	// Filter by minimum severity if specified
 	if minSev != "" {
-		minRank := severityRank(minSev)
+		minRank := scanner.SeverityRank(minSev)
 		filtered := make([]scanner.Finding, 0, len(result.Findings))
 		for _, f := range result.Findings {
-			if severityRank(f.EffectiveSeverity()) >= minRank {
+			if scanner.SeverityRank(f.EffectiveSeverity()) >= minRank {
 				filtered = append(filtered, f)
 			}
 		}

internal/scanner/finding.go

@@ -20,6 +20,23 @@ const (
 	SeverityInfo Severity = "info"
 )
 
+// SeverityRank orders severities from least (0) to most (3) severe.
+// Shared by the scanner and CLI so ranking cannot diverge.
+func SeverityRank(sev Severity) int {
+	switch sev {
+	case SeverityInfo:
+		return 0
+	case SeverityWarning:
+		return 1
+	case SeverityHigh:
+		return 2
+	case SeverityCritical:
+		return 3
+	default:
+		return 0
+	}
+}
+
 // SecretMatch represents a single detected secret instance within a Finding's file.
 // Its Severity is independent of the parent Finding's severity.
 type SecretMatch struct {
@@ -68,7 +85,7 @@ type Result struct {
 func (f Finding) EffectiveSeverity() Severity {
 	max := f.Severity
 	for _, m := range f.SecretMatches {
-		if severityRank(m.Severity) > severityRank(max) {
+		if SeverityRank(m.Severity) > SeverityRank(max) {
 			max = m.Severity
 		}
 	}

internal/scanner/scanner.go

@@ -250,22 +250,6 @@ func (s *Scanner) matchSeverityOverride(relPath string) (Severity, bool) {
 	return "", false
 }
 
-// severityRank orders severities from least (0) to most (3) severe.
-func severityRank(sev Severity) int {
-	switch sev {
-	case SeverityInfo:
-		return 0
-	case SeverityWarning:
-		return 1
-	case SeverityHigh:
-		return 2
-	case SeverityCritical:
-		return 3
-	default:
-		return 0
-	}
-}
-
 // scanSecrets inspects relPath's content for embedded secrets and returns the
 // resulting SecretMatches, with severity floored by git status and capped by
 // any configured Severity Override for the file.
@@ -290,7 +274,7 @@ func (s *Scanner) scanSecrets(absDir, relPath string, status git.FileStatus) ([]
 		floor = SeverityCritical
 	}
 
-	if override, ok := s.matchSeverityOverride(relPath); ok && severityRank(override) < severityRank(floor) {
+	if override, ok := s.matchSeverityOverride(relPath); ok && SeverityRank(override) < SeverityRank(floor) {
 		floor = override
 	}
 

internal/scanner/scanner_test.go

@@ -814,3 +814,24 @@ func TestScannerWithConfig(t *testing.T) {
 		t.Errorf("expected .env.test to be overridden to Critical, got %+v", f)
 	}
 }
+
+func TestSeverityRank(t *testing.T) {
+	cases := []struct {
+		sev  Severity
+		rank int
+	}{
+		{SeverityInfo, 0},
+		{SeverityWarning, 1},
+		{SeverityHigh, 2},
+		{SeverityCritical, 3},
+		{Severity("unknown"), 0},
+	}
+	for _, tc := range cases {
+		if got := SeverityRank(tc.sev); got != tc.rank {
+			t.Errorf("SeverityRank(%q) = %d, want %d", tc.sev, got, tc.rank)
+		}
+	}
+	if SeverityRank(SeverityCritical) <= SeverityRank(SeverityHigh) {
+		t.Fatal("critical should rank above high")
+	}
+}