feat(integration-jfrog): add -o json output, separated from logs

[KunalSin9h]

What

safedep integration jfrog run now has a machine-consumable output stream, cleanly separated from operational logs.

• Output is the user-facing result: a real state change in XRay (package_pushed, package_deleted) or a dry-run preview (dry_run_package_push, dry_run_package_delete).
• Logs are operational: feed cycle, connectivity, startup mode, errors, and no-ops (already pushed, does not exist, skipped).

-o json (or --output json) is an explicit request for machine output, so it prints only the result events, as JSONL on stdout, and nothing else: every log is suppressed. No 2>/dev/null needed.

safedep integration jfrog run -o json

{"event":"package_pushed","report_id":"01KR0EKN...","package":"make-array","ecosystem":"npm","versions":["0.1.2"],"issue_id":"SD-01KR0EKN...","status":201}
{"event":"package_deleted","report_id":"01KR0G12...","package":"retracted","ecosystem":"pypi","issue_id":"SD-01KR0G12...","status":200}

Without -o json, the command prints for humans: results and logs both render to stderr, unchanged from before, except the high-frequency no-ops (already pushed, does not exist) are now dimmed but always shown (no --verbose needed).

Mode	Output events
Real run	package_pushed, package_deleted
Dry run	dry_run_package_push, dry_run_package_delete

Design (addressing review)

• Output vs logs. A single reporter (reporter.go) routes everything by output mode. Only results reach stdout; everything operational is a log. Under -o json logs are suppressed entirely, so the json stream is results-only and stderr stays empty.
• Constructor DI. The reporter is a constructor dependency of all four components (feed service, feed source, real client, print client), so wiring is uniform. No post-construction field assignment.
• Token flag renamed to --insecure-instance-access-token: a token on the command line leaks into shell history and the process list. Docs lead with the environment variable and never show a literal token. (Follows the existing --insecure-keychain-fallback convention.)
• The corrupt-cursor recovery moved to dry/log (internal diagnostic), keeping it out of the json stream.

Fatal errors

A fatal error (JFrog connectivity failure, missing add-on, bad API key) is a returned error, not a log: the command exits non-zero and prints the error, in every mode including -o json (stdout stays clean, so an agent sees empty stdout + non-zero exit). Transient per-cycle errors are logs and the loop retries.

Tests / docs

Tests assert the split: under -o json only state changes and dry-run previews reach stdout and stderr is empty; no-ops/errors/skips are suppressed. Full go test ./..., gofmt, and cobra convention tests green. docs/cmd/integration-jfrog-run.md and docs/integration-jfrog.md document the output/logs boundary and the flag.

[safedep]

SafeDep Report Summary

No dependency changes detected. Nothing to scan.

View complete scan results →

_{This report is generated by SafeDep GitHub App}