feat(cli): add --min-grade flag for configurable CI exit threshold

[dmchaledev]

$(cat <<'EOF'

Problem

The CLI's exit-code-1 threshold is hardcoded to grades D and F. Teams
that want to enforce a stricter security bar — e.g. "our CI pipeline
must achieve B or better" — have no way to configure this. They either
get false-green (C slips through) or have to wrap the tool in a shell
script that re-parses the JSON output.

Solution

Add a --min-grade flag that accepts any valid grade (A+, A, B,
C, D, F) and exits with code 1 whenever the site's grade falls
below that threshold.

# Fail unless the site scores B or better
security-headers https://example.com --min-grade B

# Fail on D/F only (unchanged default behaviour)
security-headers https://example.com            # default: --min-grade C

The default is C, which preserves the existing behaviour exactly
(exit 1 on D or F, exit 0 on C, B, A, A+).

Changes

• src/cli.ts: parse --min-grade, validate it against VALID_GRADES,
  replace the hard-coded grade === 'D' || grade === 'F' check with a
  rank-based comparison, and update --help output + examples.

Test plan

• npm test — all 82 existing tests pass (library is unchanged)
• security-headers https://example.com --help shows the new flag
• --min-grade B exits 1 when a C-grade site is scanned
• --min-grade C (default) exits 0 for a C-grade site
• Invalid grade (e.g. --min-grade Z) prints a clear error and exits 1

https://claude.ai/code/session_016KofvKuoo4haZ8raNTwChF
EOF
)

---

Generated by Claude Code