feat: add dual-side diagnostic overview and gating to ensure both scans succeed

cve-diff.js

@@ -41,14 +41,24 @@ function loadReportsForArg(arg) {
     }
   }
 
+  if (filePaths.length === 0) {
+    console.error(`::error::No CVE JSON report files found for path: ${arg}`);
+    process.exit(1);
+  }
+
+  let loadedFiles = 0;
   for (const filePath of filePaths) {
     let stat;
     try {
       stat = fs.statSync(filePath);
-    } catch {
-      continue;
+    } catch (e) {
+      console.error(`::error::Failed to access report file ${filePath}: ${e.message}`);
+      process.exit(1);
+    }
+    if (stat.size === 0) {
+      console.error(`::error::CVE report file is empty (0 bytes): ${filePath}`);
+      process.exit(1);
     }
-    if (stat.size === 0) continue;
 
     const baseName = path.basename(filePath).toLowerCase();
     let arch = 'all';
@@ -62,14 +72,18 @@ function loadReportsForArg(arg) {
     try {
       const content = fs.readFileSync(filePath, 'utf8');
       data = JSON.parse(content);
-    } catch {
-      continue;
+    } catch (e) {
+      console.error(`::error::Invalid JSON in CVE report file ${filePath}: ${e.message}`);
+      process.exit(1);
     }
 
     if (!data || typeof data !== 'object' || !Array.isArray(data.Results)) {
-      continue;
+      console.error(`::error::Malformed Trivy report structure (missing Results array) in: ${filePath}`);
+      process.exit(1);
     }
 
+    loadedFiles++;
+
     for (const result of data.Results) {
       const target = result.Target || result.Type || 'App';
       const vulns = Array.isArray(result.Vulnerabilities) ? result.Vulnerabilities : [];
@@ -88,6 +102,11 @@ function loadReportsForArg(arg) {
     }
   }
 
+  if (loadedFiles === 0) {
+    console.error(`::error::No valid CVE reports could be loaded for path: ${arg}`);
+    process.exit(1);
+  }
+
   return cves;
 }