v3.6.1

v3.6.1 — a verified, reproducible GitHub Action

What changed since v3.6.0:

• Security: the composite Action now verifies the Fendix binary's cosign
  signature before it first runs. cosign is installed first for every
  caller, the installer bundled with the Action revision installs one exact
  release with FENDIX_REQUIRE_SIGNATURE=1, inherited FENDIX_* variables are
  removed, and the binary is published to the job from a private RUNNER_TEMP
  directory only after an exact version check. There is no checksum-only
  fallback.
• Security: the Action's SARIF upload is pinned by commit
  (github/codeql-action/upload-sarif v4.38.3), and the SHA-pin policy now
  covers action.yml.
• Fixed: SARIF for a scan with no findings is valid ("rules": [] instead of
  the schema-invalid null that upload-sarif rejected), in fendix scan and
  fendix report.
• Fixed: the Action works with its defaults. It prepares the Python engine
  from the release's verified source and installs that release's
  hash-locked python/requirements.lock with --require-hashes. Releases up to
  v3.6.0 have no lock and keep requirements.txt with a pydantic<2.14 bound;
  a caller-managed engine_path is unchanged.
• Fixed: Action failures are legible and fail closed. A setup failure
  before the scan exits 2 with a clear message, SARIF is uploaded only when a
  report exists, and unknown results fail closed. Setup errors name the
  missing build record, signature, download, pip or sync step.
• Fixed: Semgrep keeps running (pydantic<2.14), and fendix init --ci gitlab
  keeps SARIF as an ordinary artifact.
• Docs: diff mode, permissions, the GitHub Code Security requirement for
  private SARIF upload, the Sigstore connectivity the Action needs and the
  signed-release boundary are documented. The --diff help states what it
  scopes. No diff behaviour changed.

Upgrading:

• Pin Fendix-app/Fendix to this release's commit with version: v3.6.1. Do
  not use @v1; it still points to an older revision.
• The runner needs outbound HTTPS to Sigstore (TUF and Rekor), GitHub and
  PyPI. Without Sigstore access the Action's install fails.
• SARIF upload from a private or internal repository needs actions: read
  and GitHub Code Security; otherwise set upload-sarif: 'false'.
• The Action installs only signed releases; automatic Python preparation
  needs v3.5.0 or later. setup-python no longer sets pythonLocation for later
  steps, and fendix is on PATH from a private directory, not /usr/local/bin.

Known limitations: diff mode scopes whole files of the native scanners only
and can miss changed files when --code is a subdirectory (fixes planned for
v3.7.0); the Semgrep/Pydantic line is held until the paired v3.7.0 upgrade
(#111); pull requests from forks cannot upload SARIF.

Known issue (found after release; fixed in v3.6.2): diff-aware scans with a
relative --code path can miss findings. In diff mode (--diff or --staged) with a relative code
path such as ".", the Semgrep and native text scanners receive a file filter
that matches none of the changed files. They report no findings, and the
coverage table still shows them as ok, so a blocking finding that only those
scanners detect does not fail the scan. Affected: the composite Action's
default pull-request setup (code: "." with diff: auto) and the pre-commit hook
written by fendix hook install (fendix scan --code . --staged --fast). Not
affected: the secrets scanner, the Python engine, and scans without diff mode,
including the tested reference workflow, which remains the recommended GitHub
Actions setup:
https://github.com/Fendix-app/Fendix/blob/46dd52e4880a06c3ebc7852ba572bb71f69a2644/examples/github-actions/fendix-scan.yml
Fixed in v3.6.2:
https://github.com/Fendix-app/Fendix/releases/tag/v3.6.2
v3.6.1 users should upgrade. The temporary workarounds used with v3.6.1 (an
absolute code path such as code: ${{ github.workspace }} in the Action or
--code "$PWD" on the command line and in the pre-commit hook, or diff: 'false')
are no longer required after upgrading.

Full notes: CHANGELOG.md, section 3.6.1.