feat(cli): --no-warn, new exit codes, glint render, and graph --no-skipped

Exit codes (breaking change from exit 1):
- 0  clean (no findings)
- 2  one or more errors
- 10 one or more warnings, no errors
Errors take precedence over warnings.

glint check --no-warn:
  Discard warning findings before output and exit-code calculation.
  Mixed pipelines (errors + warnings) still exit 2 but only errors print.
  Warnings-only pipelines exit 0 with "OK" when --no-warn is set.

glint render <PIPELINE>:
  New subcommand. Resolves all include: and extends: chains, then writes
  a single flat .gitlab-ci.yml (default: rendered.gitlab-ci.yml, or
  stdout with --output -). Strips consumed keys (include:, extends:).
  Template jobs (.) are retained. Flags: --output, --token, --gitlab-url,
  --cache-dir, --offline, --proxy (all with .glint.yml fallback).
  To support render, Resolve() now writes the merged raw map back to
  p.RawJobs[name] and also preserves j.Column from the original job.

glint graph --no-skipped:
  Removes jobs that evaluate to JobSkipped in the given context before
  any graph function sees the pipeline. Works for tree, pipeline (SVG,
  HTML, Mermaid), includes, and all modes.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

cmd/glint/main.go

@@ -66,7 +66,8 @@ const globalUsage = `glint: Lint and visualise GitLab CI pipelines locally.
 Usage: glint [OPTIONS] <COMMAND>
 
 Commands:
-  check    Lint a pipeline file — exits 0 (clean) or 1 (errors found)
+  check    Lint a pipeline file — exits 0 (clean), 2 (errors), or 10 (warnings only)
+  render   Resolve all includes and extends into a single merged YAML file
   graph    Visualise the pipeline as a job tree or Mermaid graph
   explain  Show description and fix for a lint rule (e.g. glint explain GL007)
   lsp      Start a Language Server Protocol server (stdin/stdout)
@@ -87,6 +88,8 @@ func main() {
 	switch os.Args[1] {
 	case "check":
 		cmdCheck(os.Args[2:])
+	case "render":
+		cmdRender(os.Args[2:])
 	case "graph":
 		cmdGraph(os.Args[2:])
 	case "explain":
@@ -121,6 +124,7 @@ func cmdCheck(args []string) {
 	offline := fs.Bool("offline", false, "skip all network calls; serve only from --cache-dir")
 	proxy := fs.String("proxy", "", "HTTP proxy URL for remote includes and GitLab API calls (e.g. http://proxy:8080); overrides system proxy env vars")
 	format := fs.String("format", "text", "output format: text, json, sarif, junit, github")
+	noWarn := fs.Bool("no-warn", false, "suppress warning findings; only errors are shown and affect the exit code")
 	branch := fs.String("branch", "", "simulate a branch push (sets CI_COMMIT_BRANCH, …)")
 	tag := fs.String("tag", "", "simulate a tag push (sets CI_COMMIT_TAG, …)")
 	source := fs.String("source", "", "set CI_PIPELINE_SOURCE")
@@ -137,7 +141,11 @@ func cmdCheck(args []string) {
 		fmt.Fprint(os.Stderr, `Lint a GitLab CI pipeline file.
 
 Resolves local includes and extends chains, then runs all lint rules.
-Exits 0 when no errors are found, 1 when at least one error is reported.
+
+Exit codes:
+  0   no findings (clean)
+  2   one or more errors
+  10  one or more warnings, no errors
 
 Usage: glint check [OPTIONS] <PIPELINE>
 
@@ -149,6 +157,10 @@ Options:
           Output format for findings.
           [default: text] [possible values: text, json, sarif, junit, github]
 
+      --no-warn
+          Suppress warning findings. Only errors are printed and counted toward
+          the exit code; warnings are ignored entirely.
+
       --token <TOKEN>
           GitLab personal access token. Required to fetch project: includes;
           component: includes are attempted unauthenticated.
@@ -402,7 +414,19 @@ Examples:
 
 	findings := linter.Lint(p, skipped)
 	findings = applyConfig(findings, glintCfg, p.Suppressions)
-	errCount, _ := countSeverities(findings)
+
+	// --no-warn: discard warnings before any output or exit-code calculation.
+	if *noWarn {
+		kept := findings[:0]
+		for _, f := range findings {
+			if f.Severity != linter.Warning {
+				kept = append(kept, f)
+			}
+		}
+		findings = kept
+	}
+
+	errCount, warnCount := countSeverities(findings)
 
 	// In structured formats the summary line goes to stderr so stdout is clean.
 	summaryOut := os.Stdout
@@ -426,11 +450,21 @@ Examples:
 	if len(findings) == 0 {
 		fmt.Fprintf(summaryOut, "OK: %s — no issues found (%d job(s), %d stage(s))\n", path, len(p.Jobs), len(p.Stages))
 	} else {
-		fmt.Fprintf(summaryOut, "%d finding(s): %d error(s)\n", len(findings), errCount)
+		switch {
+		case errCount > 0 && warnCount > 0:
+			fmt.Fprintf(summaryOut, "%d finding(s): %d error(s), %d warning(s)\n", len(findings), errCount, warnCount)
+		case errCount > 0:
+			fmt.Fprintf(summaryOut, "%d finding(s): %d error(s)\n", len(findings), errCount)
+		default:
+			fmt.Fprintf(summaryOut, "%d finding(s): %d warning(s)\n", len(findings), warnCount)
+		}
 	}
 
-	if errCount > 0 {
+	switch {
-		exit(1)
+	case errCount > 0:
+		exit(2)
+	case warnCount > 0:
+		exit(10)
 	}
 }
 
@@ -513,6 +547,12 @@ Options:
           Run "git diff --name-only <REF>" to determine changed files for
           rules:changes: evaluation.
 
+      --no-skipped
+          Omit jobs that would be skipped in the given context. Requires at
+          least one context flag (--branch, --tag, --source, --var) or the
+          implicit default context (branch=main). Skipped jobs are removed
+          from the tree, SVG, HTML, and Mermaid output entirely.
+
       --list-vars
           Print all pipeline-level variables collected from the root file and
           every included file (sorted KEY=VALUE) to stderr, then continue
@@ -543,6 +583,7 @@ Examples:
 	branch := fs.String("branch", "", "simulate a branch push (sets CI_COMMIT_BRANCH, …)")
 	tag := fs.String("tag", "", "simulate a tag push (sets CI_COMMIT_TAG, …)")
 	source := fs.String("source", "", "set CI_PIPELINE_SOURCE")
+	noSkipped := fs.Bool("no-skipped", false, "hide jobs that would be skipped in the given context (requires a context)")
 	listVars := fs.Bool("list-vars", false, "print all collected pipeline variables to stderr, then continue")
 	var vars multiFlag
 	fs.Var(&vars, "var", "set a CI variable as KEY=VALUE; repeatable")
@@ -631,6 +672,16 @@ Examples:
 		printVars(p, ctx)
 	}
 
+	// --no-skipped: remove jobs that evaluate to skipped in the current context
+	// before handing the pipeline to any graph function.
+	if *noSkipped && !ctx.IsEmpty() {
+		for name, job := range p.Jobs {
+			if !strings.HasPrefix(name, ".") && cicontext.EvalJob(job, ctx) == cicontext.JobSkipped {
+				delete(p.Jobs, name)
+			}
+		}
+	}
+
 	switch mode {
 	case "default":
 		fmt.Print(graph.Tree(p, ctx))

cmd/glint/main_test.go

@@ -112,7 +112,7 @@ func TestCmdCheck_MissingFile(t *testing.T) {
 	if *code != 2 { t.Errorf("missing file: want exit(2), got %d", *code) }
 }
 
-func TestCmdCheck_WithErrors_ExitsOne(t *testing.T) {
+func TestCmdCheck_WithErrors_ExitsTwo(t *testing.T) {
 	code := captureExit(t)
 	// Pipeline with an error finding (invalid stage reference)
 	content := `
@@ -123,7 +123,7 @@ test-job:
 `
 	path := writePipeline(t, content)
 	cmdCheck([]string{path})
-	if *code != 1 { t.Errorf("pipeline with errors: want exit(1), got %d", *code) }
+	if *code != 2 { t.Errorf("pipeline with errors: want exit(2), got %d", *code) }
 }
 
 func TestCmdCheck_FormatJSON(t *testing.T) {
@@ -703,10 +703,10 @@ func TestCmdCheck_ChangesFrom_Fails(t *testing.T) {
 
 	code := captureExit(t)
 	path := writePipeline(t, minimalPipeline)
-	// Should warn but not crash; pipeline is clean → no exit(1).
+	// Should warn but not crash; pipeline is clean → no exit(2).
 	cmdCheck([]string{"--changes-from", "origin/main", path})
-	if *code == 1 {
+	if *code == 2 {
-		t.Errorf("expected no exit(1) when --changes-from fails gracefully, got %d", *code)
+		t.Errorf("expected no exit(2) when --changes-from fails gracefully, got %d", *code)
 	}
 }
 
@@ -753,10 +753,10 @@ build-job:
 `
 	path := writePipeline(t, content)
 	// build-job's rule fires only if src/** matches; with 0 changed files it is skipped.
-	// Pipeline is clean (no lint errors) → no exit(1).
+	// Pipeline is clean (no lint errors) → no exit(2).
 	cmdCheck([]string{"--changes-from", "origin/main", path})
-	if *code == 1 {
+	if *code == 2 {
-		t.Errorf("unexpected exit(1): %d", *code)
+		t.Errorf("unexpected exit(2): %d", *code)
 	}
 }
 
@@ -770,8 +770,8 @@ func TestCmdGraph_ChangesFrom_Fails(t *testing.T) {
 	code := captureExit(t)
 	path := writePipeline(t, minimalPipeline)
 	cmdGraph([]string{"tree", "--changes-from", "origin/main", path})
-	if *code == 1 {
+	if *code == 2 {
-		t.Errorf("unexpected exit(1) when --changes-from fails in graph mode")
+		t.Errorf("unexpected exit(2) when --changes-from fails in graph mode")
 	}
 }
 
@@ -785,8 +785,8 @@ func TestCmdGraph_ChangesFrom_Success(t *testing.T) {
 	code := captureExit(t)
 	path := writePipeline(t, minimalPipeline)
 	cmdGraph([]string{"tree", "--changes-from", "origin/main", path})
-	if *code == 1 {
+	if *code == 2 {
-		t.Errorf("unexpected exit(1) in graph --changes-from success path")
+		t.Errorf("unexpected exit(2) in graph --changes-from success path")
 	}
 }
 
@@ -801,8 +801,8 @@ func TestCmdGraph_ChangesFrom_EmptyDiff(t *testing.T) {
 	path := writePipeline(t, minimalPipeline)
 	// reliable=true, allChanged nil → allChanged = []string{} branch hit
 	cmdGraph([]string{"tree", "--changes-from", "origin/main", path})
-	if *code == 1 {
+	if *code == 2 {
-		t.Errorf("unexpected exit(1) in graph --changes-from empty diff")
+		t.Errorf("unexpected exit(2) in graph --changes-from empty diff")
 	}
 }
 
@@ -818,8 +818,8 @@ build-job:
 `
 	path := writePipeline(t, content)
 	cmdGraph([]string{"tree", "--changes", "src/app.go", path})
-	if *code == 1 {
+	if *code == 2 {
-		t.Errorf("unexpected exit(1) with valid pipeline and --changes flag")
+		t.Errorf("unexpected exit(2) with valid pipeline and --changes flag")
 	}
 }
 
@@ -848,7 +848,7 @@ deploy-job:
 	// by rules evaluation → needs cross-check suppressed → exit 0.
 	code := captureExit(t)
 	cmdCheck([]string{"--branch", "main", path})
-	if *code == 1 {
+	if *code == 2 {
 		t.Error("skipped job's needs: error should be suppressed in context-scoped lint")
 	}
 }
@@ -873,8 +873,8 @@ deploy-job:
 
 	code := captureExit(t)
 	cmdCheck([]string{"--tag", "v1.0.0", path})
-	if *code != 1 {
+	if *code != 2 {
-		t.Error("active job's bad needs: should still produce GL027 error")
+		t.Error("active job's bad needs: should still produce GL027 error (exit 2)")
 	}
 }
 
@@ -883,7 +883,7 @@ func TestCmdCheck_ContextScopedLinting_SkippedSet_IsNilWhenAllActive(t *testing.
 	code := captureExit(t)
 	path := writePipeline(t, minimalPipeline)
 	cmdCheck([]string{"--branch", "main", path})
-	if *code == 1 {
+	if *code == 2 {
 		t.Error("valid pipeline with all-active jobs should not produce errors")
 	}
 }
@@ -1142,8 +1142,8 @@ test-job:
 `
 	path := writePipeline(t, content)
 	cmdCheck([]string{"--context", "branch=main", path})
-	if *code != 1 {
+	if *code != 2 {
-		t.Errorf("multi-context error pipeline: want exit(1), got %d", *code)
+		t.Errorf("multi-context error pipeline: want exit(2), got %d", *code)
 	}
 }
 

cmd/glint/render.go

@@ -0,0 +1,269 @@
+package main
+
+import (
+	"flag"
+	"fmt"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+
+	"git.k3nny.fr/glint/internal/config"
+	"git.k3nny.fr/glint/internal/fetcher"
+	"git.k3nny.fr/glint/internal/model"
+	"git.k3nny.fr/glint/internal/resolver"
+	"gopkg.in/yaml.v3"
+)
+
+func cmdRender(args []string) {
+	fs := flag.NewFlagSet("glint render", flag.ExitOnError)
+	output := fs.String("output", "", "output file path (default: rendered.gitlab-ci.yml; use - for stdout)")
+	token := fs.String("token", "", "GitLab personal access token (overrides GITLAB_TOKEN)")
+	gitlabURL := fs.String("gitlab-url", "", "GitLab instance URL (overrides CI_SERVER_URL / GITLAB_URL)")
+	cacheDir := fs.String("cache-dir", "", "directory to cache fetched remote includes")
+	offline := fs.Bool("offline", false, "skip all network calls; serve only from --cache-dir")
+	proxy := fs.String("proxy", "", "HTTP proxy URL for remote includes (e.g. http://proxy:8080)")
+	fs.Usage = func() {
+		fmt.Fprintf(os.Stderr, "glint %s\n\n", version)
+		fmt.Fprint(os.Stderr, `Resolve all includes and extends into a single merged YAML file.
+
+Performs the same include resolution and extends merging that GitLab CI
+does server-side, then writes the fully flattened pipeline to a single file.
+Useful for inspecting the resolved pipeline or running further local tooling.
+
+The output file strips 'include:' (consumed by resolution) and 'extends:'
+(applied to each job) keys. All other fields are preserved verbatim.
+Template jobs (names starting with '.') are retained.
+
+Usage: glint render [OPTIONS] <PIPELINE>
+
+Arguments:
+  <PIPELINE>  Path to the .gitlab-ci.yml file to resolve
+
+Options:
+      --output <FILE>
+          Write the rendered pipeline to FILE.
+          Use '-' to write to stdout.
+          [default: rendered.gitlab-ci.yml]
+
+      --token <TOKEN>
+          GitLab personal access token for fetching project: and component:
+          includes.
+          [env: GITLAB_TOKEN | CI_JOB_TOKEN | GITLAB_PRIVATE_TOKEN]
+
+      --gitlab-url <URL>
+          GitLab instance URL.
+          [env: CI_SERVER_URL | GITLAB_URL] [default: https://gitlab.com]
+
+      --cache-dir <DIR>
+          Cache directory for fetched remote includes.
+
+      --offline
+          Do not make any network calls; use cache only.
+
+      --proxy <URL>
+          HTTP proxy URL for remote includes and GitLab API calls.
+
+  -h, --help
+          Print help
+
+Examples:
+  glint render .gitlab-ci.yml
+  glint render --output merged.yml .gitlab-ci.yml
+  glint render --output - .gitlab-ci.yml | yq .
+  glint render --offline --cache-dir ~/.cache/glint .gitlab-ci.yml
+`)
+	}
+	_ = fs.Parse(args)
+
+	if fs.NArg() != 1 {
+		fs.Usage()
+		exit(2)
+		return
+	}
+	path := fs.Arg(0)
+	rootDir := filepath.Dir(filepath.Clean(path))
+
+	glintCfg, cfgErr := config.Load(rootDir)
+	if cfgErr != nil {
+		fmt.Fprintf(os.Stderr, "%s: [warning] %s: %v\n", path, config.Filename, cfgErr)
+	}
+
+	fetcherToken := *token
+	if fetcherToken == "" {
+		fetcherToken = glintCfg.Token
+	}
+	fetcherURL := *gitlabURL
+	if fetcherURL == "" {
+		fetcherURL = glintCfg.URL
+	}
+	resolvedCacheDir := *cacheDir
+	if resolvedCacheDir == "" {
+		resolvedCacheDir = glintCfg.CacheDir
+	}
+	if *offline && resolvedCacheDir == "" {
+		resolvedCacheDir = defaultCacheDir()
+	}
+	resolvedProxy := *proxy
+	if resolvedProxy == "" {
+		resolvedProxy = glintCfg.Proxy
+	}
+
+	cfg := fetcher.AutoConfig().WithOverrides(fetcherURL, fetcherToken, resolvedCacheDir, *offline).WithProxy(resolvedProxy)
+
+	p, err := model.Parse(path)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "error: %v\n", err)
+		exit(2)
+		return
+	}
+
+	warnings, _ := resolver.ResolveIncludes(p, cfg, rootDir)
+	for _, w := range warnings {
+		fmt.Fprintf(os.Stderr, "%s: [warning] include %s\n", path, w)
+	}
+
+	extWarnings, err := resolver.Resolve(p)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "error: resolving extends: %v\n", err)
+		exit(2)
+		return
+	}
+	for _, w := range extWarnings {
+		fmt.Fprintf(os.Stderr, "%s: [warning] job %q extends unknown job %q; extends chain skipped\n", path, w.Job, w.Base)
+	}
+
+	doc, err := buildRenderDoc(p)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "error: building output: %v\n", err)
+		exit(2)
+		return
+	}
+
+	outPath := *output
+	if outPath == "" {
+		outPath = "rendered.gitlab-ci.yml"
+	}
+
+	var w interface{ Write([]byte) (int, error) }
+	if outPath == "-" {
+		w = os.Stdout
+	} else {
+		f, err := os.Create(outPath)
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "error: creating output file: %v\n", err)
+			exit(2)
+			return
+		}
+		defer f.Close()
+		w = f
+	}
+
+	enc := yaml.NewEncoder(w)
+	enc.SetIndent(2)
+	if err := enc.Encode(doc); err != nil {
+		fmt.Fprintf(os.Stderr, "error: writing output: %v\n", err)
+		exit(2)
+		return
+	}
+	_ = enc.Close()
+
+	if outPath != "-" {
+		jobCount := 0
+		for name := range p.Jobs {
+			if !strings.HasPrefix(name, ".") {
+				jobCount++
+			}
+		}
+		fmt.Fprintf(os.Stderr, "rendered: %s (%d job(s), %d stage(s))\n", outPath, jobCount, len(p.Stages))
+	}
+}
+
+// buildRenderDoc constructs an ordered yaml.Node document from the resolved
+// pipeline. Pipeline-level keys (stages, variables, default, workflow) come
+// first, followed by template jobs (.name) then regular jobs, both sorted
+// alphabetically. 'include:' and 'extends:' are omitted — they have been
+// consumed by the resolution passes.
+func buildRenderDoc(p *model.Pipeline) (*yaml.Node, error) {
+	root := &yaml.Node{Kind: yaml.MappingNode, Tag: "!!map"}
+
+	addField := func(key string, val any) error {
+		n, err := anyToNode(val)
+		if err != nil {
+			return fmt.Errorf("encoding %q: %w", key, err)
+		}
+		root.Content = append(root.Content,
+			&yaml.Node{Kind: yaml.ScalarNode, Tag: "!!str", Value: key},
+			n,
+		)
+		return nil
+	}
+
+	if len(p.Stages) > 0 {
+		if err := addField("stages", p.Stages); err != nil {
+			return nil, err
+		}
+	}
+	if len(p.Variables) > 0 {
+		if err := addField("variables", p.Variables); err != nil {
+			return nil, err
+		}
+	}
+	if p.Default != nil {
+		if err := addField("default", p.Default); err != nil {
+			return nil, err
+		}
+	}
+	if p.Workflow != nil {
+		if err := addField("workflow", p.Workflow); err != nil {
+			return nil, err
+		}
+	}
+
+	// Collect and sort job names: template jobs first, then regular jobs.
+	var templates, regular []string
+	for name := range p.RawJobs {
+		if strings.HasPrefix(name, ".") {
+			templates = append(templates, name)
+		} else {
+			regular = append(regular, name)
+		}
+	}
+	sort.Strings(templates)
+	sort.Strings(regular)
+
+	for _, name := range append(templates, regular...) {
+		raw := p.RawJobs[name]
+		// Copy to avoid mutating the shared map; strip resolution-consumed keys.
+		cleaned := make(map[string]any, len(raw))
+		for k, v := range raw {
+			if k == "extends" {
+				continue
+			}
+			cleaned[k] = v
+		}
+		if err := addField(name, cleaned); err != nil {
+			return nil, err
+		}
+	}
+
+	doc := &yaml.Node{Kind: yaml.DocumentNode, Content: []*yaml.Node{root}}
+	return doc, nil
+}
+
+// anyToNode converts an arbitrary Go value to a *yaml.Node by round-tripping
+// through yaml.Marshal / yaml.Unmarshal, which preserves all value types.
+func anyToNode(v any) (*yaml.Node, error) {
+	data, err := yaml.Marshal(v)
+	if err != nil {
+		return nil, err
+	}
+	var doc yaml.Node
+	if err := yaml.Unmarshal(data, &doc); err != nil {
+		return nil, err
+	}
+	if doc.Kind == yaml.DocumentNode && len(doc.Content) > 0 {
+		return doc.Content[0], nil
+	}
+	return &doc, nil
+}

internal/resolver/extends.go

@@ -80,12 +80,15 @@ func Resolve(p *model.Pipeline) ([]ExtendWarning, error) {
 			return extWarnings, fmt.Errorf("job %q: re-decoding merged definition: %w", name, err)
 		}
 		j.Name = name
-		// Preserve source location — File/Line are not part of the YAML map
+		// Preserve source location — these fields are not part of the YAML map
 		// and are lost during the encode/decode round-trip.
 		orig := p.Jobs[name]
 		j.File = orig.File
 		j.Line = orig.Line
+		j.Column = orig.Column
 		p.Jobs[name] = j
+		// Write merged raw map back so p.RawJobs always reflects post-extends state.
+		p.RawJobs[name] = merged
 	}
 
 	return extWarnings, nil