Reading static verification evidence: three exit codes, three review decisions

Three distinct exit codes from a static verification tool provide clear guidance for interpreting the results and informing release decisions. The exit code 0 indicates a successful completion without reporting any findings, suggesting the tool's analysis did not detect any issues within the specified scope. This outcome should be interpreted with caution, as it does not guarantee the code is completely free of problems; it only means the tool's analysis did not identify any issues within the tested scope.

Exit code 1 signifies an evidence finding that requires a reviewer's decision. The verification tool has identified an issue that needs attention, such as dynamic code evaluation, which poses a high severity risk. The reviewer should investigate the origin of the problematic code and determine whether dynamic evaluation is necessary or if it should be replaced with explicit operations.

Exit code 2 denotes that the requested check did not produce any results, indicating a potential invalid or incomplete execution. This could be due to providing an incorrect path or an input error. Before making any assumptions about the absence of issues, the reviewer should verify the exit code and ensure the correct input is being checked.

By understanding these three exit codes and their corresponding implications, reviewers can make informed decisions about the software's safety and proceed with confidence in the release process.