chore: merge develop → main

[github-actions]

Automated PR by github-actions[bot].

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics -9 complexity · 0 duplication

Metric	Results
Complexity	-9
Duplication	0

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

The merge of development changes into main introduces automatic local subnet detection via the 'auto' keyword, but several issues must be addressed before merging. Codacy analysis indicates the PR is not up to standards, primarily due to security risks and logic issues.

Key concerns include a high-severity potential for command injection in integration tests and a bug in target parsing that allows duplicate scans and inflated detection counts if the 'auto' keyword is repeated. Additionally, the CLI implementation uses hardcoded stderr instead of Cobra's configured error stream, which limits testability and consistency. Acceptance criteria for feedback suppression via the --quiet flag are implemented but lack verification in the test suite.

About this PR

• The PR description is generic and does not reflect the functional changes. Furthermore, the handling of the 'auto' keyword logic is not idempotent; repeated keywords in the input will lead to redundant network scanning and inaccurate host counts.

Test suggestions

• Verify that targets.ParseRange('auto') resolves to a list of IP addresses.\n- [x] Verify that calling the 'scan' command without arguments defaults to 'auto' mode.\n- [x] Verify that using the 'auto' target prints an 'Auto-detected' summary to stderr.\n- [ ] Verify that the 'Auto-detected' summary is hidden when the '--quiet' flag is provided.\n- [ ] Verify that providing multiple targets (e.g. 'auto,192.168.1.1') correctly combines them without unnecessary duplication in the count.\n- [ ] Ensure integration tests sanitize binary paths to prevent injection vulnerabilities.

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}

[mendsec]

Full review completed successfully.

Review Summary:

• CI / Status Checks: All 9 status checks passed (Build, Test, Vet, Govulncheck, golangci-lint, PR Rules Enforcer, Codacy Static Analysis).
• Local Verification: go build ./..., go vet ./..., and go test -race -count=1 ./... passed with zero errors or race conditions.
• Architecture & Compliance:
  • No scanning logic in CLI (delegates to catnet-io/engine).
  • Output formats and exit codes strictly follow existing contracts.
  • Security annotations (nosec / nosemgrep) and concurrency fixes verified.

PR approved for merge from develop into main.