Skip to content

Conversation

@tembleking
Copy link
Member

This PR fixes a regression introduced in v6.2.0 where the action would fail even if all risks were accepted and the global policy evaluation passed.

The ScanResult domain entity was incorrectly recalculating the final evaluation result based on the outcome of individual policies, ignoring the global evaluation result provided in the scanner's report.
This was wrong because the accepted risk at the level of an image is not reflected in the policy evaluations.
This caused the action to fail when stop-on-failed-policy-eval was set to true.

This has been fixed by:

  • Storing the globalEvaluation from the report directly in the ScanResult.
  • Ensuring this global result is used to determine the final action status.
  • Adding a test case with a fixture where risks are globally accepted to prevent future regressions.

Fixes #92

@tembleking tembleking self-assigned this Oct 27, 2025
@tembleking tembleking requested a review from a team as a code owner October 27, 2025 08:26
@tembleking tembleking enabled auto-merge (squash) October 27, 2025 08:28
Copy link

@alecron alecron left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@tembleking tembleking merged commit 5645a29 into master Oct 27, 2025
10 checks passed
@tembleking tembleking deleted the fix-solve-regression-policy-evaluation branch October 27, 2025 08:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

v6.2.0 regression: failed even if all risks are accepted and policy evaluation passed

3 participants