ci(rampart): honor RAMPART_ENFORCE=warn in scanner steps - #24
Merged
Merged
Conversation
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
Contributor
Author
|
Action ref audit (follow-up from ummat investigation): checked for unresolvable |
🟢 Rampart Security Gate — CLEAN
Totals: 0 critical · 0 high · 0 medium · 0 low Mode: |
Per §3.2/§3.3 spec, RAMPART_ENFORCE=warn means each scan job's gate script should log and exit 0, with CRITICAL blocking enforced only at the summary job. The sast job's rampart-gate.js step lacked continue-on-error, so a CRITICAL finding still hard-failed the sast job even in warn mode. Add continue-on-error to the gate steps in deps-osv, deps-pnpm, and sast so scan jobs never block on their own; summary.js still exits 1 on any CRITICAL finding regardless of mode.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
DO NOT MERGE — this PR is for review only.
Replicates the pattern from ummeco/ummat PR #88 (https://github.com/ummeco/ummat/pull/88) into chatislam.
Problem
Scanner steps in
.github/workflows/rampart-pr.ymlfail the GitHub Actions job via the tool's own process exit code. This bypasses the intendedRAMPART_ENFORCE=warnbehavior, where.github/scripts/rampart-gate.js(and thesummaryjob's severity aggregation) is supposed to be the sole decider of pass/fail based on finding severity.Fix
Added
continue-on-error: ${{ env.RAMPART_ENFORCE == 'warn' }}to scanner steps that can fail the job via their own exit code, so that whenRAMPART_ENFORCE=warn, the step is allowed to fail without failing the job — letting rampart-gate.js / the summary job decide the outcome instead of the raw tool exit code.Changed in chatislam
deps-osvjob: addedcontinue-on-errorto thegoogle/osv-scanner-actionstepsastjob: named the semgrep stepScan(mirroring ummat's pattern) and addedcontinue-on-errorto itNot changed (by design)
secretsjob (gitleaks) — exempt, always-blocking, never getscontinue-on-errordeps-pnpmjob —pnpm audit --prod --json > pnpm-audit.json || truealready absorbs the exit code via|| true, so it can't fail the job; no change neededNot applicable to chatislam
chatislam's workflow has no
deps-go/govulncheck job, nocontainers/trivy job, and noschema-audit/hasura job — those parts of ummat PR #88 don't apply here and were skipped.