cairnlock

FAQ

Questions that come up on day three of using any security tool.

A finding is wrong. How do I silence it?
Three levels, quietest first: add cairnlock:ignore RULEID on the offending line, add the rule id to disabled_rules in cairnlock.toml, or set --fail-on never for one run. If the pattern itself is wrong, please open a false-positive report using the issue template — that fixes it for everyone.
Why does scan exit 1 on the first low-severity finding?
The default threshold is low, which fails on anything. Teams adopting on a large repo usually start with --fail-on high, record a baseline with --write-baseline, and tighten over time.
What is the difference between core and extended?
They are exclusive rule sets. core covers agent context files with agent-specific rules. extended swaps in the generic rules and also widens discovery to source files (Python, JavaScript, TypeScript) and dependency files, because those rules were written for code. See the rule reference for the exact split.
Can a pull request hide an edit by rehashing the lockfile?
Not with verify --base. It reads the lockfile as it exists at the base ref with git show, so a rehash in the same change is its own finding and fails the run. Add CODEOWNERS on cairnlock.lock so a human also reviews that file.
Does cairnlock send my files anywhere?
No. No network calls at scan time, ever. Base verification reads from the local git clone only. Nothing it scans is executed, imported, or installed.
What do the exit codes mean?
0 clean, 1 findings or changes, 2 usage or environment error — bad ref, missing base lockfile, shallow clone. Scripts can rely on 1 meaning "look at this" and 2 meaning "fix how you called it".
Verify says my lockfile is missing. I deleted it by accident.
Run cairnlock init again to rebuild it from the current tree, then review the diff before committing. If the old lockfile is in git history, git show HEAD:cairnlock.lock shows what was tracked, and git checkout HEAD -- cairnlock.lock restores it exactly.
How do I adopt this on a repository with a long history of unreviewed agent files?
Run scan --write-baseline to record today's findings, commit the baseline, and gate on new findings only. Fix the backlog at your own pace; new problems still fail CI.
Does the SARIF output work with GitHub Code Scanning?
Yes. scan --format sarif --output cairnlock.sarif produces SARIF 2.1.0 with rule help URIs and partial fingerprints, and the README shows the upload step. The composite action does the verify and scan for you.
Why is the tool called cairnlock?
A cairn is a stack of stones marking a path. Each reviewed agent file is a stone; the lockfile is the stack. Someone moving a stone without you noticing is the problem this tool exists to stop.