Exit 0 when app security check's no-configuration prompt is declined

Answering No to "Scan it without app configuration?" is a choice, not a
failure. With `--json` it was already a cancelled result with exit 0;
in the terminal it aborted with exit 1. It now shows the same message
and next step as information, and exits 0 in both formats.

Without prompts, a missing app configuration still aborts: nothing was
declined.

Author: jek

.changeset/app-security-check-declined-exit.md

@@ -0,0 +1,6 @@
+---
+'@shopify/app': patch
+'@shopify/cli': patch
+---
+
+Exit 0 instead of failing when you decline to scan without app configuration in `app security check`.

packages/app/src/cli/commands/app/security/check.integration.test.ts

@@ -718,20 +718,19 @@ describe('app security check prompts', () => {
       })
     })
 
-    test('scans nothing when scanning without app configuration is declined', async () => {
+    test('scans nothing and exits 0 when scanning without app configuration is declined', async () => {
       await inTemporaryDirectory(async (directory) => {
         vi.mocked(renderConfirmationPrompt).mockResolvedValue(false)
 
         const result = await runInTerminal(['--path', directory], {json})
 
         expect(renderConfirmationPrompt).toHaveBeenCalledOnce()
         expect(renderSelectPrompt).not.toHaveBeenCalled()
+        expect(result.exitCode).toBe(0)
         if (json) {
-          expect(result.exitCode).toBe(0)
           expect(JSON.parse(result.stdout)).toStrictEqual({status: 'cancelled'})
           expect(result.stderr).toBe('')
         } else {
-          expect(result.exitCode).toBe(1)
           expect(result.stdout).toBe('')
           expect(boxText(result.stderr)).toContain('No app configuration found at or above')
           expect(boxText(result.stderr)).toContain('--without-app-config --client-id <client-id>')

packages/app/src/cli/services/app-security-selection.ts

@@ -358,13 +358,19 @@ export function mergeScanDirectories(
   }
 }
 
-/** No app configuration at or above `directory`. In the terminal, declining to scan without one ends with it too. */
-export class MissingAppConfigurationError extends AbortError {
-  constructor(directory: string) {
-    super(
-      `No app configuration found at or above ${directory}.`,
+/** That there's no app configuration at or above `directory`, and how to scan anyway. */
+export function missingAppConfigurationMessage(directory: string): {headline: string; nextStep: string} {
+  return {
+    headline: `No app configuration found at or above ${directory}.`,
+    nextStep:
       'Pass `--path` to your app directory, or scan without app configuration with `--without-app-config --client-id <client-id>`.',
-    )
+  }
+}
+
+class MissingAppConfigurationError extends AbortError {
+  constructor(directory: string) {
+    const {headline, nextStep} = missingAppConfigurationMessage(directory)
+    super(headline, nextStep)
   }
 }
 

packages/app/src/cli/services/security-check/result.test.ts

@@ -17,7 +17,6 @@ import {appSecurityInstructions} from '../app-security-instructions.js'
 import {validAppConfiguration} from '../app-security-selection.test-data.js'
 import {committedSecretIssue, scan, scanExecution} from '../security-check.test-data.js'
 import {runWithCommandEventsForCommand} from '@shopify/cli-kit/node/command-events'
-import {AbortError} from '@shopify/cli-kit/node/error'
 import {fileRealPath, inTemporaryDirectory, matchGlob, mkdir, writeFile} from '@shopify/cli-kit/node/fs'
 import {unstyled} from '@shopify/cli-kit/node/output'
 import {joinPath} from '@shopify/cli-kit/node/path'
@@ -494,14 +493,17 @@ describe('renderSecurityCheckResult for --list-files', () => {
 })
 
 describe('renderSecurityCheckResult when scanning without app configuration was declined', () => {
-  test('aborts as when no app configuration is found', async () => {
-    const error: unknown = await present({kind: 'cancelled'}).catch((caught: unknown) => caught)
+  test('shows that no app configuration was found, with the next step, and leaves the exit code alone', async () => {
+    process.exitCode = undefined
+
+    const {stdout, stderr} = await present({kind: 'cancelled'})
 
-    expect(error).toBeInstanceOf(AbortError)
-    expect((error as AbortError).message).toBe(`No app configuration found at or above ${appDirectory}.`)
-    expect((error as AbortError).tryMessage).toBe(
+    expect(stdout).toBe('')
+    expect(boxText(stderr)).toContain(`No app configuration found at or above ${appDirectory}.`)
+    expect(boxText(stderr)).toContain(
       'Pass `--path` to your app directory, or scan without app configuration with `--without-app-config --client-id <client-id>`.',
     )
+    expect(process.exitCode).toBeUndefined()
   })
 })
 

packages/app/src/cli/services/security-check/result.ts

@@ -21,7 +21,7 @@ import {
   shellForPlatform,
   type AppSecurityCommands,
 } from '../app-security-commands.js'
-import {MissingAppConfigurationError} from '../app-security-selection.js'
+import {missingAppConfigurationMessage} from '../app-security-selection.js'
 import {renderSecurityReport} from '../security-output.js'
 import {fileRealPath} from '@shopify/cli-kit/node/fs'
 import {outputResult} from '@shopify/cli-kit/node/output'
@@ -93,8 +93,8 @@ export function renderSecurityCheckPromptsTip(commands: AppSecurityCommands): vo
  * Presents the outcome of `securityCheck` as JSON, or in the terminal. Gathering warnings come first, on stderr. Then
  * the listed files, or the scan: in the terminal, its report followed by the coding-agent instructions; as JSON, the
  * instructions prompt followed by the result. Either way, sets exit code 1 after the output when the scan breaches
- * `--blocking`. Declining to scan without app configuration is a cancelled result as JSON. In the terminal it aborts,
- * as when there is no app configuration and prompts are off.
+ * `--blocking`. Declining to scan without app configuration exits 0: as JSON, it's a cancelled result. In the
+ * terminal, it shows the message that aborts the command when there's no app configuration and prompts are off.
  */
 export async function renderSecurityCheckResult(
   check: SecurityCheckOutcome,
@@ -103,8 +103,12 @@ export async function renderSecurityCheckResult(
   dependencies: SecurityCheckPresenterDependencies = defaultDependencies,
 ): Promise<void> {
   if (check.kind === 'cancelled') {
-    if (format === 'text') throw new MissingAppConfigurationError(options.directory)
-    outputResult(appSecurityCheckJsonOutputSchema.encode({status: 'cancelled'}))
+    if (format === 'json') {
+      outputResult(appSecurityCheckJsonOutputSchema.encode({status: 'cancelled'}))
+    } else {
+      const {headline, nextStep} = missingAppConfigurationMessage(options.directory)
+      renderInfo({headline, body: nextStep})
+    }
     return
   }