🐛 Render UNKNOWN instead of None for v0.1 finding severity in supply-chain CLI

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: fevra-dev

gitexpose/cli_advanced.py

@@ -838,9 +838,9 @@ def supply_chain(path: str, output: str, out_file: str):
         else:
             lines = [f"🔍 {len(findings)} supply-chain finding(s) in {path}:"]
             for f in findings:
-                sev = f.get("severity", "?")
-                ftype = f.get("type", "?")
-                src = f.get("source", "")
+                sev = f.get("severity") or "UNKNOWN"
+                ftype = f.get("type") or "unknown"
+                src = f.get("source") or ""
                 desc = next(iter((f.get("description") or "").splitlines()), "")
                 lines.append(f"  [{sev}] {ftype}  ({src})")
                 if desc:

tests/test_supply_chain_cli.py

@@ -64,6 +64,18 @@ def test_supply_chain_handles_synthetic_repo_e2e():
     assert "groq_api_key" in result.output
 
 
+def test_supply_chain_renders_severity_for_v01_findings(tmp_path: Path):
+    """Regression: v0.1 secret-dicts have severity=None.
+    Output must render 'UNKNOWN' (or similar), not the literal '[None]'."""
+    # generic_api_key is a v0.1 pattern that emits with severity=None
+    (tmp_path / "config.py").write_text(
+        'api_key = "abcdefghijklmnopqrstuvwxyz1234567890"\n'
+    )
+    runner = CliRunner()
+    result = runner.invoke(cli, ["supply-chain", str(tmp_path)])
+    assert "[None]" not in result.output, f"Severity rendered as literal None: {result.output}"
+
+
 def test_main_cli_accepts_sarif_output_format():
     """`gitexpose --help` lists sarif as an output choice."""
     from click.testing import CliRunner