Problem
When a security scan fails, the background consumer automatically retries the scan up to three times. After the retries are exhausted, the skill version is transitioned to SCAN_FAILED.
There is currently no way for an authorized user to manually trigger another scan for that failed version. The only available recovery path is to re-upload/publish the package again, which is inconvenient for transient scanner, storage, or network failures.
Relevant implementation:
AbstractStreamConsumer handles automatic retry and terminal failure.ScanTaskConsumer transitions the version to SCAN_FAILED.SecurityAuditController currently exposes audit-result retrieval only; there is no rescan endpoint.- The frontend displays the failed status but does not provide a manual retry action.
Expected behavior
Add a manual “Retry scan” capability for versions in SCAN_FAILED:
- Add an authenticated API endpoint to trigger a new scan.
- Expose the action to the version owner / namespace administrators and platform security administrators according to existing lifecycle permissions.
- Create a new active security-audit round while preserving previous audit records for history.
- Reset the retry counter for the new scan task.
- Transition the version back to
SCANNING.
- Reuse the stored bundle when available, without requiring the user to upload the package again.
- Make the operation safe against duplicate/concurrent retry requests.
- Add a corresponding UI action and localized success/error messages.
- Add backend and frontend tests for authorization, state transition, audit history, duplicate requests, and successful retry.
Current workaround
Re-upload/publish the same version, which replaces the SCAN_FAILED version and starts a new scan.
Problem
When a security scan fails, the background consumer automatically retries the scan up to three times. After the retries are exhausted, the skill version is transitioned to
SCAN_FAILED.There is currently no way for an authorized user to manually trigger another scan for that failed version. The only available recovery path is to re-upload/publish the package again, which is inconvenient for transient scanner, storage, or network failures.
Relevant implementation:
AbstractStreamConsumerhandles automatic retry and terminal failure.ScanTaskConsumertransitions the version toSCAN_FAILED.SecurityAuditControllercurrently exposes audit-result retrieval only; there is no rescan endpoint.Expected behavior
Add a manual “Retry scan” capability for versions in
SCAN_FAILED:SCANNING.Current workaround
Re-upload/publish the same version, which replaces the
SCAN_FAILEDversion and starts a new scan.