From 8ca70b343342fd39a33b7e8180bcfaa19e21fec7 Mon Sep 17 00:00:00 2001
From: "coderabbitai[bot]"
 <136622811+coderabbitai[bot]@users.noreply.github.com>
Date: Mon, 14 Sep 2026 11:30:16 +0000
Subject: [PATCH] fix(baseline): reject unrecognized finding severities

---
 scripts/apply-baseline.sh | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/scripts/apply-baseline.sh b/scripts/apply-baseline.sh
index 46ed1a0..9135c14 100644
--- a/scripts/apply-baseline.sh
+++ b/scripts/apply-baseline.sh
@@ -73,6 +73,17 @@ echo "$FINDINGS_JSON" | jq -e 'type == "array"' >/dev/null || {
   echo "error: findings JSON is not an array" >&2
   exit 2
 }
+INVALID_FINDING_SEVERITIES="$(jq -r '
+  [ .[] | (try .severity catch null)
+    | select(. as $severity | ["critical", "high", "medium", "low", "info", "advisory"] | index($severity) | not) ]
+  | unique
+  | .[] | @json
+' <<<"$FINDINGS_JSON")"
+if [[ -n "$INVALID_FINDING_SEVERITIES" ]]; then
+  echo "error: findings contain unrecognized severity values:" >&2
+  echo "$INVALID_FINDING_SEVERITIES" >&2
+  exit 2
+fi
 echo "$BASELINE_JSON" | jq -e 'type == "array"' >/dev/null || {
   echo "error: baseline JSON is not an array" >&2
   exit 2