docs: omitting SEVERITY_THRESHOLD is not report-only - #36
Open
Paramjeet-singh-neu wants to merge 1 commit into
Open
docs: omitting SEVERITY_THRESHOLD is not report-only#36Paramjeet-singh-neu wants to merge 1 commit into
Paramjeet-singh-neu wants to merge 1 commit into
Conversation
The evaluation guide said to omit SEVERITY_THRESHOLD for a report-only trial, and that running the CodeBuild project alone "does not gate anything real". Default none still fails on native medium+, so omit is the default gate. Report-only is the || true wrap in the CodePipeline README. Co-authored-by: Cursor <cursoragent@cursor.com>
6 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
docs/EVALUATION.mdtold people to omitSEVERITY_THRESHOLDfor a report-only trial, and that running the CodeBuild project alone "does not gate anything real".Omit is the default (
none). The wrapper still fails when the binary exits 1, which is any finding at medium or above. So omit is the default gate, not report-only. Running the project on its own still turns the build red; it just is not in a pipeline yet.A true report-only run is the
|| truewrap already documented incodepipeline/README.md. Two sentences, one file. Independent of the other EVALUATION.md PRs (exit-code table, STRICT, env outputs).Test plan
scan/trustabl-scan.sh(NATIVE_CODE=1 still fails whenSEVERITY_THRESHOLDis unset)Made with Cursor