Documentation — PackageMedic

Create an accepted state

1
Scan without a failure gate
Review the evidence behind every existing diagnostic.
2
Fix obvious problems
Do not baseline findings that should be corrected immediately.
3
Create the baseline
Commit the portable file with the repository policy.
4
Gate new findings
Keep all existing findings visible while CI rejects new warnings and errors.

Terminal

package-medic doctor . --fail-on none
package-medic baseline create . --output .packagemedic-baseline.json
package-medic doctor .   --baseline .packagemedic-baseline.json   --fail-on none   --fail-on-new warning

Diagnostic states

State	Meaning	Typical action
New	The fingerprint is absent from the selected baseline.	Review and fix or explicitly accept.
Existing	The same accepted diagnostic is still present.	Keep visible and schedule remediation.
Resolved	A baseline entry is no longer present.	Verify the change and refresh the baseline.

Fingerprints are repository-portable, do not contain timestamps, and remain stable across source-line movement. JSON includes resolved entries; SARIF uses the standardnew and unchanged baseline states.

Refresh intentionally

Terminal

package-medic baseline update .   --baseline .packagemedic-baseline.json

Centralize the gate

.packagemedic.json

{
  "schemaVersion": 1,
  "failOn": "none",
  "failOnNew": "warning",
  "baseline": ".packagemedic-baseline.json"
}

With these values committed, local and CI scans use the same new-only policy without repeating command-line options.

Baseline safety

Baselines are bounded to 64 MiB and 100,000 entries. Malformed, unknown, or oversized data fails with operational exit code 2 instead of producing a partial classification.