🤖 Generated by the Agentic Engineer
Part of #2451. Follows #2829, which added the Kubescape SARIF → Code Scanning upload.
Evidence
Measured locally against main (ksail 7.x, k8s source dir, repo exceptions applied), running
exactly what CI runs:
ksail workload scan --framework nsa --exceptions <generated> --compliance-threshold 95 \
--format sarif -o kubescape.sarif
- Console output:
All controls passed. No issues found — exit 0.
- SARIF written by the same run: 4 findings on real, un-excepted manifests:
C-0034 (warning) ×3 — bases/infrastructure/vault-backup/{job,cron-job}.yaml, bases/infrastructure/vault-config/job.yamlC-0017 (note) ×1 — bases/apps/umami/cron-job.yaml
I confirmed none of these are suppressed: no policy in the generated exceptions file
(21 policies) covers C-0034 or C-0017.
The printer is showing a filtered view, not an empty one. Re-running the same scan with
--exceptions removed produced 70 SARIF findings while the console table listed one
control (C-0013, 2 resources). So the console summary surfaces only a subset; the SARIF
carries the full set.
Problem
Since #2829, those SARIF findings become Code Scanning alerts — so the two surfaces now
disagree in a way they did not before:
- The CI log, which is what a developer reads on a PR, says
All controls passed. No issues found.
- The Security tab shows alerts for the same run.
Anyone trusting the log concludes there is nothing to fix. Findings that do not move the
compliance score enough to breach the floor are invisible in CI entirely, which is precisely the
class #2829 was added to make visible. The gate is working correctly; the reporting around it is
what misleads.
Smallest useful change
After the scan step, derive a one-line summary from the SARIF the run just produced and print it
to the log and the job summary — count and per-control breakdown, plus a pointer to the Security
tab. No change to the gate, the threshold, or the upload.
Acceptance criteria
- A run producing N SARIF findings prints a summary naming N and the control IDs, even when the
compliance gate passes and the Kubescape table prints All controls passed.
- A run producing zero findings says so explicitly.
- The compliance-threshold gate's pass/fail behaviour is unchanged.
- No change to what is uploaded to Code Scanning.
Size
S — one step in the validate job, reading a file the run already writes.
Note on scope
The filtered console table comes from Kubescape's own printer, which ksail forwards. This issue is
deliberately scoped to the platform's CI reporting rather than proposing an upstream printer
change — the summary we need is cheap to derive on our side and does not depend on upstream.
Part of #2451. Follows #2829, which added the Kubescape SARIF → Code Scanning upload.
Evidence
Measured locally against
main(ksail 7.x,k8ssource dir, repo exceptions applied), runningexactly what CI runs:
All controls passed. No issues found— exit 0.C-0034(warning) ×3 —bases/infrastructure/vault-backup/{job,cron-job}.yaml,bases/infrastructure/vault-config/job.yamlC-0017(note) ×1 —bases/apps/umami/cron-job.yamlI confirmed none of these are suppressed: no policy in the generated exceptions file
(21 policies) covers
C-0034orC-0017.The printer is showing a filtered view, not an empty one. Re-running the same scan with
--exceptionsremoved produced 70 SARIF findings while the console table listed onecontrol (
C-0013, 2 resources). So the console summary surfaces only a subset; the SARIFcarries the full set.
Problem
Since #2829, those SARIF findings become Code Scanning alerts — so the two surfaces now
disagree in a way they did not before:
All controls passed. No issues found.Anyone trusting the log concludes there is nothing to fix. Findings that do not move the
compliance score enough to breach the floor are invisible in CI entirely, which is precisely the
class #2829 was added to make visible. The gate is working correctly; the reporting around it is
what misleads.
Smallest useful change
After the scan step, derive a one-line summary from the SARIF the run just produced and print it
to the log and the job summary — count and per-control breakdown, plus a pointer to the Security
tab. No change to the gate, the threshold, or the upload.
Acceptance criteria
compliance gate passes and the Kubescape table prints
All controls passed.Size
S — one step in the
validatejob, reading a file the run already writes.Note on scope
The filtered console table comes from Kubescape's own printer, which ksail forwards. This issue is
deliberately scoped to the platform's CI reporting rather than proposing an upstream printer
change — the summary we need is cheap to derive on our side and does not depend on upstream.