fix(upload): a 200 that stored nothing is not a publish

Publishing a report under the shared community credential returns HTTP
200 with no IngestionSnapshot: the server enriches and deliberately
persists nothing, because that credential is shared by every
unauthenticated user. The CLI falls back to it whenever a real credential
cannot be read — an unset VULNETIX_API_KEY, or a keyring it cannot unlock
in a headless session — so the run printed "[OK] published", named a
category, counted findings, and left no ScannerRun anywhere.

That is the same green-job-no-data failure this publish path exists to
remove, and it was invisible: the two cases are identical in the HTTP
status, and only the absence of a snapshot URL distinguished them.

Each result now carries `persisted`, `gha upload --json` reports
`notRecorded`, and both commands say so in plain output. It is not counted
as a failure — the request did succeed, and failing the build here would
break every unauthenticated user's pipeline — but it is no longer silent.

Author: 0x73746F66

cmd/gha.go

@@ -270,6 +270,14 @@ func runGHAUpload(cmd *cobra.Command, args []string) error {
 		}
 	}
 
+	// Every file accepted and none recorded is the failure mode this command
+	// was built to remove, wearing a green tick. Say it once, loudly, rather
+	// than once per file in a log nobody reads to the end.
+	if n := countNotRecorded(results); n > 0 {
+		dctx.Logger.Warnf("%d of %d file(s) were accepted but no scan was recorded.", n, len(results))
+		dctx.Logger.Warn(notPersistedReason)
+	}
+
 	if err := emitGHAJSON(results, env); err != nil {
 		return err
 	}
@@ -377,6 +385,11 @@ func emitGHAJSON(results []ghaFileResult, env vdb.CliEnv) error {
 		"success":   uploaded,
 		"failed":    failed,
 		"skipped":   skipped,
+		// Additive, and the number worth watching: a file the server accepted
+		// and did not record. It is not a failure — the request succeeded — but
+		// it means the run produced no scan, and nothing else in this summary
+		// would tell you that.
+		"notRecorded": countNotRecorded(results),
 	}
 	if env.CI != nil {
 		output["ci"] = map[string]any{
@@ -573,3 +586,15 @@ func tallyGHAResults(results []ghaFileResult) (uploaded, failed, skipped int) {
 	}
 	return uploaded, failed, skipped
 }
+
+// countNotRecorded counts files the server accepted without storing a scan.
+func countNotRecorded(results []ghaFileResult) int {
+	n := 0
+	for _, r := range results {
+		if r.Status == "uploaded" && !r.Persisted && r.Reason == notPersistedReason {
+			n++
+		}
+	}
+
+	return n
+}

cmd/gha_submit.go

@@ -53,6 +53,18 @@ type ghaFileResult struct {
 
 	SnapshotUuid string `json:"snapshotUuid,omitempty"`
 	SnapshotURL  string `json:"snapshotUrl,omitempty"`
+
+	// Persisted reports whether the server recorded the report as a scan, as
+	// opposed to accepting it, enriching it and returning nothing.
+	//
+	// The two are indistinguishable from the HTTP status: both are 200. The
+	// server declines to persist under the shared community credential, which
+	// the CLI falls back to whenever a real credential cannot be read — an
+	// unset VULNETIX_API_KEY, or a keyring it cannot unlock in a headless
+	// session. The result was a run that printed "published", listed a category
+	// and a finding count, and left no ScannerRun anywhere: the same
+	// green-job-no-data failure this whole path exists to remove.
+	Persisted bool `json:"persisted"`
 }
 
 // ghaSubmitter holds everything the per-file publishers need.
@@ -188,9 +200,20 @@ func (s *ghaSubmitter) publishSARIF(res ghaFileResult, artifactName string, data
 	res.SnapshotUuid = snapshotUuid
 	res.SnapshotURL = snapshotURL
 	res.PipelineID = snapshotUuid
+	res.Persisted = snapshotUuid != ""
+	if !res.Persisted {
+		res.Reason = notPersistedReason
+		s.warnf("  %s/%s %s", artifactName, res.File, notPersistedReason)
+	}
 	return res
 }
 
+// notPersistedReason explains a 200 that recorded nothing. Community-tier
+// credentials get enrichment without persistence by design, and the CLI falls
+// back to the shared community credential whenever a real one cannot be read.
+const notPersistedReason = "accepted but not recorded: the request authenticated as the shared community credential, " +
+	"so no scan was stored. Set VULNETIX_ORG_ID and VULNETIX_API_KEY, or run 'vulnetix auth login'."
+
 // postSARIFChunks sends the document, splitting large ones so no single request
 // exceeds the server's body limit. Chunk 0 creates the run and snapshot; the
 // rest append under the uuid it returned.
@@ -488,6 +511,11 @@ func (s *ghaSubmitter) postSCA(res ghaFileResult, packages []vdb.CliPackageEntry
 	res.SnapshotUuid = snapshotUuid
 	res.SnapshotURL = snapshotURL
 	res.PipelineID = snapshotUuid
+	res.Persisted = snapshotUuid != ""
+	if !res.Persisted {
+		res.Reason = notPersistedReason
+		s.warnf("  %s %s", res.File, notPersistedReason)
+	}
 	return res
 }
 

cmd/gha_submit_test.go

@@ -388,3 +388,37 @@ func TestWorkspacePrefersCIOverGit(t *testing.T) {
 		t.Errorf("workspace = %q, want the git root as fallback", got)
 	}
 }
+
+// A 200 that stored nothing is not a publish. The server returns exactly that
+// under the shared community credential, which the CLI falls back to whenever a
+// real one cannot be read — an unset VULNETIX_API_KEY, or a keyring it cannot
+// unlock in a headless session. Before this, such a run printed "published",
+// a category and a finding count, and left no ScannerRun anywhere.
+func TestNotRecordedIsCountedSeparatelyFromSuccess(t *testing.T) {
+	results := []ghaFileResult{
+		{Name: "gosec", File: "gosec.sarif", Status: "uploaded", Persisted: true, SnapshotUuid: "abc"},
+		{Name: "semgrep", File: "semgrep.sarif", Status: "uploaded", Persisted: false, Reason: notPersistedReason},
+		{Name: "readme", File: "README.md", Status: "skipped"},
+		{Name: "broken", File: "broken.sarif", Status: "error", Error: "invalid"},
+	}
+
+	if got := countNotRecorded(results); got != 1 {
+		t.Errorf("countNotRecorded = %d, want 1", got)
+	}
+
+	// The not-recorded file still counts as a success for the exit code: the
+	// request did succeed, and failing the build on a community credential
+	// would break every unauthenticated user's pipeline.
+	uploaded, failed, skipped := tallyGHAResults(results)
+	if uploaded != 2 || failed != 1 || skipped != 1 {
+		t.Errorf("tally = (%d, %d, %d), want (2, 1, 1)", uploaded, failed, skipped)
+	}
+
+	// A dry run reports uploaded with no snapshot, and must not be mistaken for
+	// the community-credential case.
+	if got := countNotRecorded([]ghaFileResult{
+		{Status: "uploaded", Persisted: false, Reason: "dry run; nothing was sent"},
+	}); got != 0 {
+		t.Errorf("a dry run must not count as not-recorded, got %d", got)
+	}
+}

cmd/upload.go

@@ -199,6 +199,13 @@ func printPublishResult(t *display.Terminal, filePath string, res ghaFileResult,
 	if res.Status == "duplicate" {
 		mark, suffix = display.WarningMark(t), " already published (same scan)"
 	}
+	// A 200 that stored nothing is not a publish. The server returns exactly
+	// that for the shared community credential, which the CLI falls back to
+	// whenever a real one cannot be read — so this said "published", printed a
+	// category and a finding count, and left no record anywhere.
+	if res.Status == "uploaded" && !res.Persisted && res.Reason == notPersistedReason {
+		mark, suffix = display.WarningMark(t), " accepted, but no scan was recorded"
+	}
 	b.WriteString(mark + " " + display.Bold(t, filepath.Base(filePath)) + suffix + "\n")
 
 	kv := []display.KVPair{{Key: "Category", Value: res.Category}}