fix(scan): make security-scan and sast-scan fail on findings #38

Merged

KofTwentyTwo merged 1 commits from feature/scan-gates-enforce into develop

2026-10-19 12:48:50 +00:00

Author	SHA1	Message	Date
james.maesandClaude Opus 5.5	4aeccb801e	fix(scan): make the security-scan and sast-scan gates fail on findings - run_trivy.sh: `trivy fs` ran without --exit-code, so it always exited 0 and security-scan passed with HIGH/CRITICAL findings in the report. Add --exit-code 1 and print the findings table on failure. - Semgrep 1.61.1 cannot parse the current `auto` ruleset, so sast-scan ran zero rules on zero files and passed. Move the executor to semgrep/semgrep:1.181.0, and fail the job when the report shows no files scanned or a rule configuration error (even in warn-only mode). Print a findings summary in the job output. - tests/test_scan_gates.sh covers both gates with tool stubs. Consumers pick this up when they bump their pinned orb version; repos with existing HIGH/CRITICAL or Semgrep findings will need to triage them then. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-16 15:42:51 -05:00

Author

SHA1

Message

Date

james.maesandClaude Opus 5.5

4aeccb801e

fix(scan): make the security-scan and sast-scan gates fail on findings

- run_trivy.sh: `trivy fs` ran without --exit-code, so it always exited 0
  and security-scan passed with HIGH/CRITICAL findings in the report. Add
  --exit-code 1 and print the findings table on failure.
- Semgrep 1.61.1 cannot parse the current `auto` ruleset, so sast-scan ran
  zero rules on zero files and passed. Move the executor to
  semgrep/semgrep:1.181.0, and fail the job when the report shows no files
  scanned or a rule configuration error (even in warn-only mode). Print a
  findings summary in the job output.
- tests/test_scan_gates.sh covers both gates with tool stubs.

Consumers pick this up when they bump their pinned orb version; repos with
existing HIGH/CRITICAL or Semgrep findings will need to triage them then.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-16 15:42:51 -05:00