A cdclint:ignore marker on the line that adds a column records a decision, so the finding stops failing the run

[avison9]

What it changes

Leaving a PII column off the include list is right, and schema-before-connector raises it all the same. So RefuseRadar keeps its PR gate at --fail-on error, and a forgotten column does not block either. A per-rule filter (#19) cannot tell the two apart; the decision has to be recorded against the column, where the pull request that makes it shows it:

ALTER TABLE users
    ADD COLUMN ssn_hash TEXT, -- cdclint:ignore schema-before-connector: PII, never streamed
    ADD COLUMN nickname TEXT;

The ssn_hash finding stops failing the run and is listed with its reason; nickname is still raised.

Proven on RefuseRadar

The probe pattern (a column added to reports in a temporary migration, removed afterwards), with the gate RefuseRadar wants:

$ cdclint ... --base origin/main --fail-on warning --disable source-column-not-captured
warning schema-before-connector db/migrations/9999_cdclint_probe.sql:2
  this change adds public.reports.cdclint_probe_pii to a captured table without adding it to column.include.list ...
  fix: add ... in the same change, or, if it is left off on purpose, say so on the line that adds it: -- cdclint:ignore schema-before-connector: <why>
exit=1

# the same line with: -- cdclint:ignore schema-before-connector: probe, PII left off on purpose
ok: nothing to report outside the disabled rules and what cdclint:ignore acknowledges
acknowledged (cdclint:ignore): schema-before-connector db/migrations/9999_cdclint_probe.sql:2: probe, PII left off on purpose
not shown (--disable): source-column-not-captured 161
exit=0

The rules of a marker

• Scope. After code, it covers its own line only; alone on a line, it covers the line below. Writing ignore-marker-pii's expectation by hand caught the first version, "this line or the next", acknowledging nickname through the ssn_hash marker: the forgotten column the gate exists for.
• One or more rules, comma-separated; -- or MySQL's #; in migrations and sink DDL (down migrations skipped).
• The reason is required: it is the record of the decision.
• Misuse is a warning (ignore-marker, in engine.Rules so it can be --disabled): no reason, a rule name that does not exist, or a marker covering no finding.
• Never "unused" for schema-before-connector: that rule judges the change, so its marker goes quiet once the pull request merges; nor for a rule that did not run (no --base, or disabled). The README shows naming both rules to keep the column out of the inventory afterwards.
• Output. Acknowledged findings do not count for the exit code and are listed with their reason; JSON keeps its array and notes them on stderr, as --disable does. When everything was acknowledged or disabled, the output says so rather than that the files agree.
• The diff rule's fix now points at the marker instead of "let this warning stand as the record of that (it blocks only under --fail-on warning)".

Verified

• Corpus, expectations written by hand: ignore-marker-pii (the diff rule, one column acknowledged and one raised) and ignore-marker-mistakes (no reason, an unknown rule, a stale marker, and a marker on the line above a finding). The corpus test now runs through the same lint() as the command line.
• The fix-text change regenerated 7 fix lines in 5 diff entries; the diff was read and changes nothing else.
• internal/ignore tests: both comment styles, a colon-less marker has no reason, down files not scanned, trailing vs standalone scope, and which unused markers are reported.
• gofmt -l . clean, go vet, go test ./... pass; RefuseRadar as above.

Merging

Stacked on #20, which is on #19. Merge #19, #20, then this. After a release, RefuseRadar's tools/cdclint.sh can move the PR gate to --fail-on warning, as its own comment asks.