[PPSC-466] fix(ci): support empty fail-on for informational mode#78
Merged
yiftach-armis merged 5 commits intomainfrom Feb 19, 2026
Merged
[PPSC-466] fix(ci): support empty fail-on for informational mode#78yiftach-armis merged 5 commits intomainfrom
yiftach-armis merged 5 commits intomainfrom
Conversation
🛡️ Armis Security Scan Results✅ No issues
Total: 0 View full resultsNo security issues found. |
Test Coverage Reporttotal: (statements) 80.2% Coverage by function |
There was a problem hiding this comment.
Pull request overview
This PR attempts to add "informational mode" support for security scanning, allowing users to view scan results without failing builds on any severity level. It changes the default fail-on parameter from 'CRITICAL' to an empty string and adds early-exit logic in the reusable workflow to skip failure checks when fail-on is empty.
Changes:
- Changed default
fail-onvalue from'CRITICAL'to empty string inaction.ymland reusable workflow - Added early-exit logic in workflow to handle empty
fail-onparameter - Updated descriptions to document informational mode behavior
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| action.yml | Changed default fail-on from 'CRITICAL' to empty string and updated description to document informational mode |
| .github/workflows/reusable-security-scan.yml | Changed default fail-on from 'CRITICAL' to empty string, updated description, and added early-exit logic for informational mode |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Change the default fail-on value from 'CRITICAL' to empty string, allowing workflows to run scans in informational mode without failing on findings. When fail-on is empty: - The scan runs and produces results normally - Results are uploaded to GitHub Code Scanning - The workflow does NOT fail regardless of findings This fixes an issue where passing fail-on: '' would be replaced by the default 'CRITICAL' due to GitHub Actions input substitution. Workflows that want to fail on findings should now explicitly set: fail-on: 'CRITICAL' or: fail-on: 'HIGH,CRITICAL'
Golangci-lint v2.10 introduces stricter gosec rules that produce false positives for this codebase: - G101: Test files with example credentials (intentional) - G115: uintptr->int for terminal detection (standard Go pattern) - G117: ClientSecret field names (legitimate config struct fields) - G204: docker/podman exec (image names are validated) - G704/G705: SSRF/XSS taint (admin-configured URLs, not user input) - QF1012: staticcheck style suggestion (not a bug)
Pin the golangci-lint version in CI to match local development version (v2.7.2) to avoid schema validation errors from newer rule IDs not recognized in the config schema. Also fixes gosec exclusions: - G101: Test file example credentials (false positive) - G115: uintptr->int for terminal detection (standard pattern) - G204: docker/podman exec (validated image names)
yiftach-armis
force-pushed
the
fix/PPSC-466-empty-fail-on-support
branch
from
93c62c1 to
36ea1cf
Compare
golangci-lint v2.7.2 was built with Go 1.25 and panics when analyzing code with Go 1.26 (which `go-version: stable` now resolves to).
- reusable-security-scan.yml: Check operational failures (timeout/API errors) before applying informational mode early-exit, ensuring scan execution problems are never masked - .golangci.yml: Remove global gosec exclusions (G101/G115/G204) since the codebase already uses targeted #nosec and //nolint:gosec annotations at specific call sites
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| staticcheck: | ||
| checks: | ||
| - "all" | ||
| - "-QF1012" # WriteString(fmt.Sprintf) style suggestion - not a bug |
There was a problem hiding this comment.
These golangci-lint configuration changes appear unrelated to the PR's stated purpose of fixing empty fail-on support for informational mode. These changes should be moved to a separate PR focused on linter configuration to keep changes focused and easier to review.
Suggested change
| - "-QF1012" # WriteString(fmt.Sprintf) style suggestion - not a bug |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related Issue
Type of Change
Problem
The
fail-oninput parameter for GitHub Actions did not support an empty value for "informational mode" scanning, where users want to see scan results without failing the build on any severity level.Solution
fail-onvalue from'CRITICAL'to''(empty string) in bothaction.ymland the reusable workflowfail-onis emptyTesting
Automated Tests
Manual Testing
Verified the workflow logic handles empty fail-on correctly by inspecting the shell script conditionals.
Checklist