fix(scan): make security-scan and sast-scan fail on findings #38

2026-10-16T20:43:08Z

KofTwentyTwo commented

2026-10-16 20:43:08 +00:00

(Migrated from github.com)

Why

Reviewing Website-Backend's latest pr-checks (jobs 6072 and 6076 on feature/dashboard-wave0, merged as v0.1.13x) showed that two gates never fail:

security-scan: run_trivy.sh calls trivy fs without --exit-code, so Trivy exits 0 whatever it finds. The job's trivy-results.json artifact holds a HIGH finding (CVE-2026-40984, micrometer-core 1.11.11) and the job is green.
sast-scan: the executor pins returntocorp/semgrep:1.61.1. That version can't parse the current auto ruleset ("Rules downloaded from https://semgrep.dev/c/auto failed to parse"), so it runs no rules, scans 0 files and passes. Run against Website-Backend main, semgrep 1.181.0 runs 378 rules on 750 files and reports 23 findings.

Changes

run_trivy.sh: --exit-code 1, and the findings table is printed on failure, the same as run_trivy_image.sh.
executors/semgrep.yml: semgrep/semgrep:1.181.0 (the current official image name).
run_semgrep.sh: always prints a summary (files scanned, findings, errors, and up to 50 findings as rule path:line). It fails when the report shows 0 files scanned or a rule configuration error, even in warn-only mode, so an outdated scanner can't pass silently again. A missing report also fails.
tests/test_scan_gates.sh: tool stubs cover trivy failing and passing, and semgrep clean, with findings, warn-only, and no rules run.

Verification

bash tests/test_scan_gates.sh: 6/6 pass. shellcheck is clean.
Ran the patched run_semgrep.sh in semgrep/semgrep:1.181.0 against a throwaway git repo: semgrep ci --config auto works without an app token (1074 rules), lists the finding and exits 1.

Rollout

Consumers pin orb versions, so nothing changes until a repo bumps. Website-Backend has PRs that clear its current findings: the micrometer and log4j bump, and the Semgrep triage. Other consumers may go red on bump until they triage.

Refs KofTwentyTwo/Website-Backend#317.

🤖 Generated with Claude Code

## Why Reviewing Website-Backend's latest pr-checks (jobs 6072 and 6076 on `feature/dashboard-wave0`, merged as v0.1.13x) showed that two gates never fail: - **security-scan**: `run_trivy.sh` calls `trivy fs` without `--exit-code`, so Trivy exits 0 whatever it finds. The job's `trivy-results.json` artifact holds a HIGH finding (CVE-2026-40984, micrometer-core 1.11.11) and the job is green. - **sast-scan**: the executor pins `returntocorp/semgrep:1.61.1`. That version can't parse the current `auto` ruleset ("Rules downloaded from https://semgrep.dev/c/auto failed to parse"), so it runs no rules, scans 0 files and passes. Run against Website-Backend main, semgrep 1.181.0 runs 378 rules on 750 files and reports 23 findings. ## Changes - `run_trivy.sh`: `--exit-code 1`, and the findings table is printed on failure, the same as `run_trivy_image.sh`. - `executors/semgrep.yml`: `semgrep/semgrep:1.181.0` (the current official image name). - `run_semgrep.sh`: always prints a summary (files scanned, findings, errors, and up to 50 findings as `rule path:line`). It fails when the report shows 0 files scanned or a rule configuration error, even in warn-only mode, so an outdated scanner can't pass silently again. A missing report also fails. - `tests/test_scan_gates.sh`: tool stubs cover trivy failing and passing, and semgrep clean, with findings, warn-only, and no rules run. ## Verification - `bash tests/test_scan_gates.sh`: 6/6 pass. shellcheck is clean. - Ran the patched `run_semgrep.sh` in `semgrep/semgrep:1.181.0` against a throwaway git repo: `semgrep ci --config auto` works without an app token (1074 rules), lists the finding and exits 1. ## Rollout Consumers pin orb versions, so nothing changes until a repo bumps. Website-Backend has PRs that clear its current findings: the micrometer and log4j bump, and the Semgrep triage. Other consumers may go red on bump until they triage. Refs KofTwentyTwo/Website-Backend#317. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/Munitor#38