feat: allow --sarif and --report together for dual CI output (#696)

* feat: allow --sarif and --report together for dual CI output

Lifts the mutual exclusion between --sarif and --report. The two code
paths write to independent files and have no technical conflict. Enables
CI workflows that upload SARIF to GitHub Code Scanning and simultaneously
produce an HTML report as a downloadable artifact.

Closes #681

* docs: update sarif and cli-reference to reflect --sarif + --report support

Author: sonukapoor

src/cli/args.ts

@@ -276,10 +276,6 @@ export function parseArgs(argv: string[]): {
     throw new Error(`Unexpected argument: ${arg}`);
   }
 
-  if (options.sarif && options.report) {
-    throw new Error("cannot combine --sarif and --report");
-  }
-
   if (options.cdx && options.report) {
     throw new Error("cannot combine --cdx and --report");
   }

tests/helpers.test.ts

@@ -168,6 +168,13 @@ describe("parseArgs", () => {
     expect(result.options.sarif).toBe(true);
   });
 
+  it("allows --sarif combined with --report for dual CI output", () => {
+    const result = parseArgs(["--sarif", "--report", "./cve-report", "--no-open"]);
+    expect(result.options.sarif).toBe(true);
+    expect(result.options.report).toBe("./cve-report");
+    expect(result.options.noOpen).toBe(true);
+  });
+
   it("parses --ratchet flag", () => {
     const { options } = parseArgs([".", "--ratchet"]);
     expect(options.ratchet).toBe(true);

website/docs/cli-reference.md

@@ -33,7 +33,7 @@ cve-lite install-skill
 |---|---|---|---|
 | `--verbose` | off | Full output: severity table, fix plan, findings table, coverage notes | `cve-lite . --verbose` |
 | `--json` | off | Machine-readable JSON output (suppresses all other output) | `cve-lite . --json` |
-| `--sarif` | off | Write SARIF 2.1.0 output to a timestamped `.sarif` file; can be combined with `--json`; cannot be combined with `--report` | `cve-lite . --sarif` |
+| `--sarif` | off | Write SARIF 2.1.0 output to a timestamped `.sarif` file; can be combined with `--json` and `--report` | `cve-lite . --sarif` |
 | `--cdx` | off | Write CycloneDX 1.4 SBOM to a timestamped `.cdx.json` file; can be combined with `--json` and `--sarif`; cannot be combined with `--report` | `cve-lite . --cdx` |
 | `--report[=<path>]` | off / `./cve-report` | Generate an HTML report; optional path sets output directory (default `./cve-report`); opens in browser by default; cannot be used with `--json` | `cve-lite . --report`<br/>`cve-lite . --report ./reports` |
 | `--no-open` | off | Generate the HTML report without opening it in the browser | `cve-lite . --report --no-open` |

website/docs/sarif.md

@@ -22,7 +22,7 @@ This writes a timestamped file (`cve-lite-scan-<timestamp>.sarif`) to the curren
 cve-lite . --sarif --json
 ```
 
-`--sarif` cannot be combined with `--report`.
+`--sarif` can be combined with `--report --no-open` to write both a SARIF file and an HTML report in one scan - useful for CI pipelines that upload to GitHub Code Scanning and also attach an HTML artifact for human review.
 
 ## GitHub Code Scanning integration