CM-68642: stop SCA scan on restore command failure with --stop-on-error

[omer-roth]

Problem

A restore command failing with a non-zero exit code (e.g. poetry lock exit 1) did not stop the scan, even with --stop-on-error.

Root cause — failure-sentinel mismatch:

• shell() signals a non-zero exit by returning None (catches CalledProcessError, logs, returns None).
• execute_commands dropped that None via if command_output: and joined an empty list into '' — an empty-string success.
• try_restore_dependencies only checks if output is None, so '' was treated as success and a Document was returned.
• restore() therefore never returned None, making the --stop-on-error escalation in _try_restore_dependencies unreachable for a clean non-zero exit.

Fix

execute_commands now treats shell() → None as a failed command and returns None (short-circuiting remaining commands). Propagation is restored: fail → None all the way up → FileCollectionError raised under --stop-on-error.

Tests

Existing stop-on-error tests all mocked execute_commands → None, so they never covered the production path where a real non-zero exit produced ''. Added:

• TestExecuteCommands — real execute_commands with only shell() mocked: fail→None, short-circuit at first failure, empty-output success ≠ failure, joins outputs.
• test_shell_failure_propagates_to_none_and_no_lockfile — e2e through try_restore_dependencies.

All 27 SCA restore/collector tests pass.

🤖 Generated with Claude Code

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.

_{Tip: disable this comment in your organization's Code Review settings.}