VulnFuse v0.4.13: incomplete SARIF run feedback

[CAOShurong]

VulnFuse v0.4.13 adds an explicit boundary between partial SARIF evidence and scan completeness.

When a SARIF invocation declares executionSuccessful: false, carries an error-level tool/configuration notification, or has unavailable results, VulnFuse now keeps every available inline finding and exposes the run-health warning. CI owners can opt into --fail-on-incomplete / fail-on-incomplete; the report is written before the command or Action fails.

The release was exercised against pinned public fixtures from Microsoft SARIF Tutorials and Zypheron, synthetic contradictory/malformed metadata, an installed npm tarball, and the extracted GitHub Action archive on Windows and Ubuntu. Public downloads, checksums, SBOMs, licenses, and the desktop/mobile workbench were reverified after release. This is compatibility evidence, not proof that a scanner covered its intended targets or rules.

Useful feedback from SARIF producers and CI users:

1. Which scanner and exact version emitted the incomplete run?
2. Did it retain useful results, or externalize them with externalPropertyFileReferences?
3. Which run-health signal should be visible or gateable but is currently missed?
4. Does “write evidence first, then fail” fit your artifact-upload workflow?
5. Can you share a sanitized fixture through the format compatibility issue template?

Release and checksummed downloads: https://github.com/CAOShurong/vulnfuse/releases/tag/v0.4.13

Format issue template: https://github.com/CAOShurong/vulnfuse/issues/new?template=format.yml

Implementation issue and evidence: #40

Limits: VulnFuse does not perform full SARIF schema validation, fetch external property files, rerun scanners, authenticate producers, or infer that missing run-health metadata proves completeness.