From 395284d8485207503087be525c8a397780c49071 Mon Sep 17 00:00:00 2001
From: Param <181403125+Paramjeet-singh-neu@users.noreply.github.com>
Date: Mon, 24 Aug 2026 15:34:01 -0400
Subject: [PATCH] fix(buildspec): fail install when jq or curl cannot be
 installed
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The install commands hid yum/apt failure behind || true, so a missing
jq or curl became a confusing scan error (or a score from a run that
never started). Fail the install phase instead. Also list BRANCH and
DEBUG in the input comment — both are read by the scanner, neither
was documented next to the other CodeBuild env vars.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 codepipeline/buildspec.yml | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/codepipeline/buildspec.yml b/codepipeline/buildspec.yml
index 81c1d8d..b9710a9 100644
--- a/codepipeline/buildspec.yml
+++ b/codepipeline/buildspec.yml
@@ -13,6 +13,8 @@ version: 0.2
 #   TARGET (default "."), VERSION (default "latest"), DETECTORS, STRICT,
 #   RULES_REF, RULES_REPO, SARIF_FILE, JSON_FILE,
 #   RISK_SCORE_THRESHOLD (default 0), SEVERITY_THRESHOLD (default none),
+#   BRANCH (report label; CodePipeline checkouts often have no .git),
+#   DEBUG (set -x; do not enable with GITHUB_TOKEN — it echoes the header),
 #   GITHUB_TOKEN (optional — dodges GitHub's 60 req/hr anon rate limit).
 
 env:
@@ -25,8 +27,12 @@ env:
 phases:
   install:
     commands:
-      - command -v jq   >/dev/null 2>&1 || { yum -y install jq   || (apt-get update && apt-get -y install jq);   } >/dev/null 2>&1 || true
-      - command -v curl >/dev/null 2>&1 || { yum -y install curl || (apt-get update && apt-get -y install curl); } >/dev/null 2>&1 || true
+      # Fail the install phase if a missing tool cannot be installed. Swallowing
+      # that with `|| true` left the scan to die later on a confusing jq/curl
+      # error, or — if the script's own fallbacks also fail — to report a score
+      # from a run that never started.
+      - command -v jq   >/dev/null 2>&1 || yum -y install jq   || (apt-get update && apt-get -y install jq)
+      - command -v curl >/dev/null 2>&1 || yum -y install curl || (apt-get update && apt-get -y install curl)
   build:
     commands:
       - bash "$CODEBUILD_SRC_DIR/scan/trustabl-scan.sh"