fix: Survive scanner findings in report-only mode #21

Merged

ahmad merged 1 commit from fix/security-scan-exit-codes into main

2026-08-23 11:28:49 +00:00

ahmad commented

2026-08-23 11:26:53 +00:00

Owner

Issue

Refs #19

Problem

The launchpad canary run proved detection works (real js-yaml/markdown-it advisories found) but the job failed in report-only mode: the runner injects -e into shell: bash steps, so osv-scanner's exit 1 killed the step before the handling logic ran.

Solution

Capture every scanner's exit code inline (cmd && rc=0 || rc=$?) in all three steps.

Review notes

Re-run the launchpad canary security job after the v3 tag moves — it should report the findings and stay green.

Risks and trade-offs

N/A

### Issue Refs #19 ### Problem The launchpad canary run proved detection works (real js-yaml/markdown-it advisories found) but the job failed in report-only mode: the runner injects -e into shell: bash steps, so osv-scanner's exit 1 killed the step before the handling logic ran. ### Solution Capture every scanner's exit code inline (cmd && rc=0 || rc=$?) in all three steps. ### Review notes Re-run the launchpad canary security job after the v3 tag moves — it should report the findings and stay green. ### Risks and trade-offs N/A

ahmad added 1 commit

2026-08-23 11:26:53 +00:00

fix: Survive scanner findings in report-only mode dbdc531cd8

The runner injects -e into shell: bash composite steps, so a scanner
exiting 1 on findings killed the step before the report-only handling
ran — the launchpad canary failed on real osv findings it should have
only reported. Capture exit codes inline.

ahmad changed title from ~~WIP: fix: Survive scanner findings in report-only mode~~ to fix: Survive scanner findings in report-only mode

2026-08-23 11:27:00 +00:00

ahmad merged commit d1c96e1910 into main

2026-08-23 11:28:49 +00:00

ahmad deleted branch fix/security-scan-exit-codes

2026-08-23 11:28:49 +00:00

ahmad referenced this pull request from a commit

2026-08-23 11:28:50 +00:00

fix: Survive scanner findings in report-only mode (#21)