Add human-readable vulnerability summary to terminal output (#5)

Replace the terse "N vulnerabilities found" line with a colored,
categorized summary showing counts per severity level and individual
listings for critical and high vulnerabilities. Medium and low are
shown as counts only to avoid flooding the terminal.

Output goes to stderr, respects --quiet flag, and uses emoji indicators.
Long vulnerability summaries are truncated at 60 characters.

Closes #2

Author: sns45

internal/cli/pipeline.go

@@ -208,8 +208,8 @@ func runPipeline(cmd *cobra.Command, args []string) error {
 				return fmt.Errorf("writing VEX document: %w", err)
 			}
 			if !quiet {
-				fmt.Fprintf(os.Stderr, "  VEX document written to %s (%d vulnerabilities found)\n",
-					vexPath, triageResult.VulnCount)
+				fmt.Fprintf(os.Stderr, "  VEX document written to %s\n", vexPath)
+				vex.PrintSummary(os.Stderr, triageResult)
 			}
 		}
 	} else if !quiet {

internal/cli/vex.go

@@ -166,8 +166,7 @@ var vexTriageCmd = &cobra.Command{
 
 		quiet, _ := cmd.Flags().GetBool("quiet")
 		if !quiet {
-			fmt.Fprintf(os.Stderr, "Scanned %d components, found %d vulnerabilities\n",
-				result.ComponentCount, result.VulnCount)
+			vex.PrintSummary(os.Stderr, result)
 		}
 
 		outputPath, _ := cmd.Flags().GetString("output")

internal/vex/summary.go

@@ -0,0 +1,91 @@
+package vex
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"sort"
+	"strings"
+)
+
+// severityOrder defines display order (most severe first).
+var severityOrder = []SeverityLevel{
+	SeverityCritical,
+	SeverityHigh,
+	SeverityMedium,
+	SeverityLow,
+	SeverityUnknown,
+}
+
+// severityIndicator returns the emoji + label for a severity level.
+func severityIndicator(sev SeverityLevel) string {
+	switch sev {
+	case SeverityCritical:
+		return "\xf0\x9f\x94\xb4 CRITICAL" // 🔴
+	case SeverityHigh:
+		return "\xf0\x9f\x9f\xa1 HIGH" // 🟡
+	case SeverityMedium:
+		return "\xf0\x9f\x9f\xa0 MEDIUM" // 🟠
+	case SeverityLow:
+		return "\xe2\x9a\xaa LOW" // ⚪
+	case SeverityUnknown:
+		return "\xe2\x9d\x94 UNKNOWN" // ❔
+	default:
+		return string(sev)
+	}
+}
+
+// PrintSummary writes a human-readable vulnerability summary to w.
+// If isTTY is false, emoji indicators are replaced with plain text labels.
+func PrintSummary(w io.Writer, result *TriageResult) {
+	if result.VulnCount == 0 {
+		fmt.Fprintf(w, "\n  \xe2\x9c\x85 %d components scanned, no vulnerabilities found\n\n", result.ComponentCount)
+		return
+	}
+
+	// Header line with counts per severity
+	fmt.Fprintf(w, "\n")
+	parts := make([]string, 0)
+	for _, sev := range severityOrder {
+		if count, ok := result.CountBySeverity[sev]; ok && count > 0 {
+			parts = append(parts, fmt.Sprintf("%s %d %s", severityIndicator(sev), count, strings.ToUpper(string(sev))))
+		}
+	}
+	fmt.Fprintf(w, "  %s\n\n", strings.Join(parts, "   "))
+
+	// Group vulnerabilities by severity
+	grouped := make(map[SeverityLevel][]VulnDetail)
+	for _, v := range result.Vulnerabilities {
+		grouped[v.Severity] = append(grouped[v.Severity], v)
+	}
+
+	// Print critical and high individually
+	for _, sev := range []SeverityLevel{SeverityCritical, SeverityHigh} {
+		vulns, ok := grouped[sev]
+		if !ok || len(vulns) == 0 {
+			continue
+		}
+
+		// Sort by ID for consistent output
+		sort.Slice(vulns, func(i, j int) bool {
+			return vulns[i].ID < vulns[j].ID
+		})
+
+		fmt.Fprintf(w, "  %s:\n", strings.ToUpper(string(sev)))
+		for _, v := range vulns {
+			summary := v.Summary
+			if len(summary) > 60 {
+				summary = summary[:57] + "..."
+			}
+			fmt.Fprintf(w, "    %-30s %-60s %s\n", v.ComponentName, summary, v.ID)
+		}
+		fmt.Fprintf(w, "\n")
+	}
+
+	fmt.Fprintf(w, "  Scanned %d components, found %d vulnerabilities\n\n", result.ComponentCount, result.VulnCount)
+}
+
+// PrintSummaryToStderr is a convenience function that prints to stderr.
+func PrintSummaryToStderr(result *TriageResult) {
+	PrintSummary(os.Stderr, result)
+}

internal/vex/summary_test.go

@@ -0,0 +1,98 @@
+package vex
+
+import (
+	"bytes"
+	"strings"
+	"testing"
+)
+
+func TestPrintSummaryNoVulns(t *testing.T) {
+	var buf bytes.Buffer
+	result := &TriageResult{
+		VulnCount:       0,
+		ComponentCount:  42,
+		CountBySeverity: map[SeverityLevel]int{},
+	}
+	PrintSummary(&buf, result)
+	output := buf.String()
+
+	if !strings.Contains(output, "42 components scanned") {
+		t.Errorf("expected component count in output, got: %s", output)
+	}
+	if !strings.Contains(output, "no vulnerabilities found") {
+		t.Errorf("expected no-vuln message, got: %s", output)
+	}
+}
+
+func TestPrintSummaryWithVulns(t *testing.T) {
+	var buf bytes.Buffer
+	result := &TriageResult{
+		VulnCount:      5,
+		ComponentCount: 100,
+		CountBySeverity: map[SeverityLevel]int{
+			SeverityCritical: 1,
+			SeverityHigh:     2,
+			SeverityMedium:   1,
+			SeverityLow:      1,
+		},
+		Vulnerabilities: []VulnDetail{
+			{ID: "CVE-2021-44228", Summary: "Remote code execution via JNDI", Severity: SeverityCritical, ComponentName: "log4j@2.14.1"},
+			{ID: "CVE-2024-1234", Summary: "Prototype pollution", Severity: SeverityHigh, ComponentName: "lodash@4.17.20"},
+			{ID: "CVE-2024-5678", Summary: "SSRF in proxy config", Severity: SeverityHigh, ComponentName: "axios@1.6.0"},
+			{ID: "CVE-2024-9999", Summary: "Minor info leak", Severity: SeverityMedium, ComponentName: "express@4.17.1"},
+			{ID: "CVE-2024-0001", Summary: "Low severity issue", Severity: SeverityLow, ComponentName: "debug@4.3.4"},
+		},
+	}
+	PrintSummary(&buf, result)
+	output := buf.String()
+
+	// Check severity header line
+	if !strings.Contains(output, "CRITICAL") {
+		t.Errorf("expected CRITICAL in output, got: %s", output)
+	}
+	if !strings.Contains(output, "HIGH") {
+		t.Errorf("expected HIGH in output, got: %s", output)
+	}
+
+	// Check critical vulns are listed individually
+	if !strings.Contains(output, "log4j@2.14.1") {
+		t.Errorf("expected critical vuln component listed, got: %s", output)
+	}
+	if !strings.Contains(output, "CVE-2021-44228") {
+		t.Errorf("expected critical CVE listed, got: %s", output)
+	}
+
+	// Check high vulns are listed individually
+	if !strings.Contains(output, "lodash@4.17.20") {
+		t.Errorf("expected high vuln component listed, got: %s", output)
+	}
+
+	// Check footer
+	if !strings.Contains(output, "100 components") {
+		t.Errorf("expected component count in footer, got: %s", output)
+	}
+	if !strings.Contains(output, "5 vulnerabilities") {
+		t.Errorf("expected vuln count in footer, got: %s", output)
+	}
+}
+
+func TestPrintSummaryLongSummaryTruncated(t *testing.T) {
+	var buf bytes.Buffer
+	longSummary := strings.Repeat("A", 100)
+	result := &TriageResult{
+		VulnCount:      1,
+		ComponentCount: 10,
+		CountBySeverity: map[SeverityLevel]int{
+			SeverityCritical: 1,
+		},
+		Vulnerabilities: []VulnDetail{
+			{ID: "CVE-2024-0001", Summary: longSummary, Severity: SeverityCritical, ComponentName: "pkg@1.0.0"},
+		},
+	}
+	PrintSummary(&buf, result)
+	output := buf.String()
+
+	if !strings.Contains(output, "...") {
+		t.Errorf("expected truncated summary with ..., got: %s", output)
+	}
+}