v0.3.2

Added

• --diff [base] and --fail-on <severity>: a CI gate on what a change introduces.
  equall scan . --diff origin/main --fail-on serious scans the changed files and exits 1
  only when the change introduces a counted violation at serious or above. Existing
  violations are reported as not blocking, and findings that cannot be confirmed statically
  or are best practices never block. In a pull request on GitHub Actions, GitLab CI or
  Azure Pipelines, --diff with no value uses the target branch. On GitHub Actions, each new
  finding becomes an annotation on its file and line. --json writes the diff result.
  Exit code 2 means the check could not run, for example when the base branch is missing
  from a shallow clone; the message says how to fetch it.
  • A changed file a scanner could not analyse is listed as not checked (terminal, summary
    line, a warning annotation, and unchecked in --json): a passing check says nothing
    about it.
  • On GitHub Actions, every finding is also written to the job summary, since GitHub shows
    at most ten annotations of each kind per step.
  • On GitLab, --diff with no value uses the merge-base commit GitLab computes
    (CI_MERGE_REQUEST_DIFF_BASE_SHA), which is in a merge-request clone when the target
    branch usually is not.
  • scan <dir> --diff only looks at changes under <dir>.