Merge pull request #389 from timescale/fix/output-format-coverage

fix(cli): honor --output-format across structured and artifact commands

Author: mostafa

.github/workflows/ci.yml

@@ -361,3 +361,26 @@ jobs:
         run: |
           python3 scripts/mcp-smoke.py --bin target/debug/rsigma
           python3 scripts/mcp-smoke.py --http --bin target/debug/rsigma
+
+  output-format-smoke:
+    name: Output Format Smoke
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read # read repo
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - name: Install Rust stable
+        run: |
+          rustup toolchain install stable --profile minimal --no-self-update
+          rustup override set stable
+      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+        with:
+          save-if: ${{ github.ref == 'refs/heads/main' }}
+      # Build the full CLI so daemon-gated commands (`pipeline resolve`) and
+      # the shared output renderer are exercised against a real binary.
+      - name: Build rsigma with all features
+        run: cargo build --locked -p rsigma --all-features
+      - name: Smoke-test --output-format across CLI commands
+        run: ./scripts/output-format-smoke.sh --bin target/debug/rsigma

CHANGELOG.md

@@ -4,6 +4,15 @@ All notable changes to RSigma are documented in this file. Each entry correspond
 
 ## [Unreleased]
 
+### CLI: complete `--output-format` coverage (#389)
+
+- Structured report commands (`backend targets`/`formats`, `rule validate`, `pipeline resolve`/`diff`, `config validate`/`show`/`path`, and the existing eval/lint/fields/report family) honor `json`/`ndjson`/`table`/`csv`/`tsv` through a shared renderer backed by the `csv` crate.
+- `backend convert` emits one NDJSON query record per line for `--output-format ndjson`; table/csv/tsv warn and keep raw query text.
+- AST commands (`rule parse`/`condition`/`stdin`) warn and fall back to JSON for table/csv/tsv instead of silently ignoring the selector.
+- Fixed products (`rule reverse`, `rule draft` YAML, `rule migrate-sources`, `engine tap`, `engine daemon`, `mcp serve`, `config init`/`reload`) keep their wire format and emit a standardized unsupported-format warning when an incompatible selector is set.
+- `config validate`/`show` local `--format` wins over global `--output-format` with a precedence warning when both are set.
+- CI runs `scripts/output-format-smoke.sh` against a full-featured binary to keep the per-command contract from drifting.
+
 ### rstix: TAXII collection ingest (`taxii-store` feature) (#387)
 
 - **`taxii-store`** — meta-feature (`taxii` + `store`).

Cargo.lock

@@ -49,7 +49,7 @@ Full documentation, including guides, CLI reference, and library API docs, lives
 
 * **[Detection diagnostics](https://rsigma.io/cli/engine/explain/):** Explains why a rule did or did not match an event with `engine explain`, diffs pipeline transformations with `pipeline diff`, and introspects live correlation windows
 * **[Corpus backtesting](https://rsigma.io/cli/rule/backtest/):** Replays an event corpus against declared per-rule expectations with `rule backtest`, emitting a JSON or JUnit XML report for CI
-* **[Output formats](https://rsigma.io/reference/output/):** Renders every command's results as JSON, NDJSON, table, CSV, or TSV with a TTY-aware default via a global `--output-format` flag
+* **[Output formats](https://rsigma.io/reference/output/):** Structured commands render JSON, NDJSON, table, CSV, or TSV with a TTY-aware default via a global `--output-format` flag; artifact and protocol commands keep their fixed wire format (see the per-command contract)
 
 ### Deploy
 

README.md

@@ -44,6 +44,7 @@ rsigma-mcp = { path = "../rsigma-mcp", version = "0.20.0", optional = true }
 clap = { version = "4", features = ["derive", "env"] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
+csv = "1"
 serde_ignored = "0.1"
 schemars = "1"
 yaml_serde = "0.10"