--disable leaves rules out of the output and the exit code, and says what it left out

[avison9]

What it changes

--disable RULE[,RULE] (comma-separated or repeated) drops a rule's findings from the output and from the exit code. It is the output filter RefuseRadar's tools/cdclint.sh asks for, to decide by 2026-10-21 whether its 161 source-column-not-captured lines stay.

On RefuseRadar today:

$ cdclint --migrations db/migrations --connector analytics/cdc/postgres-source.json --sink analytics/schema
... 0 error(s), 0 warning(s), 161 info

$ cdclint ... --disable source-column-not-captured
ok: nothing to report outside the disabled rules
not shown (--disable): source-column-not-captured 161

(161, not the 159 in the notes: RefuseRadar's #994 to #998 added columns; main without this change also reports 161.)

Design choices

• A filter never reads as a clean run. The text output ends with what was left out, per rule. When every finding was hidden it says ok: nothing to report outside the disabled rules, not source, connector and sink agree, which would claim more than was checked.
• JSON keeps its shape. The array consumers parse is unchanged; the same note goes to stderr.
• An unknown rule name is an error that lists the rules. A typo that silently hid nothing would look like a clean filter. engine.Rules is the list, and the corpus test fails if any finding's rule is missing from it, so a new rule cannot be missed.
• Disabling schema-before-connector skips the base, exactly as leaving out --base. Filtering its findings afterwards would lose the columns it raised, because source-column-not-captured leaves raised columns out of its inventory; they would appear nowhere.
• The action gains a disable input.

What this does not solve, on purpose

RefuseRadar's script also says to go back to --fail-on warning at the PR gate "when that filter is pinned here". A per-rule filter cannot do that job: a column left off the include list on purpose (PII) and one forgotten raise the same schema-before-connector warning, and disabling the rule at the gate would switch off the check that exists to stop the forgotten one. That needs a per-column acknowledgement, which is a separate design question raised with the owner, not folded in here.

Verified

• run() now takes its output streams, and cmd/cdclint/main_test.go drives the real command line against corpus entries: a rule hidden with the note, a disabled error no longer failing the run (exit 1 to 0), commas and repeats giving the same output, an unknown name (exit 2, rules listed), --base no-such-ref failing unless the diff rule is disabled, and JSON's stderr note with an unchanged array.
• Every corpus entry unchanged; every finding's rule is in engine.Rules.
• action.yml parses (checked with Ruby's YAML loader, since a YAML mistake fails the action in 0 seconds).
• gofmt -l . clean, go vet, go test ./... pass. RefuseRadar as shown above.

Next for you

Merge when happy. It ships in the next release; RefuseRadar can then pass --disable source-column-not-captured from tools/cdclint.sh if the 2026-10-21 decision goes that way.