Add app

scripts/stig-deviations.sh

@@ -71,8 +71,21 @@ for k in ("pass", "fixed", "fail", "error", "unknown", "notchecked",
           "notapplicable", "notselected", "informational"):
     if counts.get(k):
         print(f"- **{k}**: {counts[k]}")
-print(f"\n**{review} rule(s) need REVIEW** "
-      f"(non-pass and not a documented intentional deviation).\n")
+
+# A scan where NOTHING was actually evaluated (no pass/fixed/fail — only
+# notapplicable/notselected) is NOT clean: the datastream/CPE didn't match the
+# host, so no rule was checked and no hardening was verified. Flag it loudly
+# instead of letting "0 REVIEW" read as success.
+evaluated = counts.get("pass", 0) + counts.get("fixed", 0) + counts.get("fail", 0)
+if evaluated == 0:
+    print("\n> ⚠️ **INVALID SCAN — 0 rules evaluated.** Every rule came back "
+          "`notapplicable`/`notselected`, which means the SSG datastream/CPE did "
+          "not match this host (e.g. the RHEL9 datastream run on Rocky). **No "
+          "hardening was assessed** — this report is NOT a clean result. Use the "
+          "distro-matching datastream (`ssg-rl9-ds.xml` on Rocky) and rebuild.\n")
+else:
+    print(f"\n**{review} rule(s) need REVIEW** "
+          f"(non-pass and not a documented intentional deviation).\n")
 
 if findings:
     print("## Findings (non-pass)\n")
@@ -80,8 +93,11 @@ if findings:
     print("|---|---|---|---|---|")
     for sev, res, rid, title, tag in findings:
         print(f"| {sev} | {res} | `{short(rid)}` | {tag} | {title} |")
-else:
+elif evaluated > 0:
     print("No fail/error/unknown/notchecked rules — clean against the tailored profile.")
+
+# Non-zero exit on an invalid (non-evaluating) scan so callers can gate on it.
+sys.exit(2 if evaluated == 0 else 0)
 PY
 
 [ "$OUT" = /dev/stdout ] || echo "wrote $OUT" >&2