fix(security): osv-scanner exit 128 is not a failure#11
Conversation
osv-scanner v2 exits 128 when a target has no package manifests (e.g. scripts-only repos like resq-software/dev). That's not a failure — it just means there's nothing to scan. Map 128 → exit 0 and leave all other exit codes as-is.
|
Note Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported. |
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe OSV-Scanner step in the security workflow now conditionally treats exit code 128 (no package sources found) as success, while preserving failure behavior for other non-zero exit codes. Previously, any non-zero exit would fail the step unconditionally. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Poem
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
…by name The reusable security-scan workflow consumes SEMGREP_APP_TOKEN, SNYK_TOKEN and GITLEAKS_LICENSE in its jobs but did not declare them under workflow_call, forcing callers to use `secrets: inherit` -- which forwards ALL of the caller's secrets and trips zizmor's `secrets-inherit` audit (e.g. resq-software/programs alert #11). Declare them explicitly (all required: false, each gated by its enable-* input). Backward-compatible.
…by name (#21) The reusable security-scan workflow consumes SEMGREP_APP_TOKEN, SNYK_TOKEN and GITLEAKS_LICENSE in its jobs but did not declare them under workflow_call, forcing callers to use `secrets: inherit` -- which forwards ALL of the caller's secrets and trips zizmor's `secrets-inherit` audit (e.g. resq-software/programs alert #11). Declare them explicitly (all required: false, each gated by its enable-* input). Backward-compatible.
1 participant
osv-scanner v2 returns exit 128 when a repo has no package manifests (scripts-only repos like
dev). Map to exit 0; other codes still propagate.Summary by CodeRabbit