ci(rampart): honor RAMPART_ENFORCE=warn in scanner steps - #23
Merged
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
1 Skipped Deployment
|
Contributor
Author
|
Action ref audit (follow-up from ummat investigation): checked for unresolvable |
🟢 Rampart Security Gate — CLEAN
Totals: 0 critical · 0 high · 0 medium · 0 low Mode: |
The scan steps already skipped their own failure in warn mode, but the gate steps (rampart-gate.js) that run right after them did not — so sast/deps-osv/deps-pnpm still failed the job even with RAMPART_ENFORCE=warn. Per-job gates are advisory in warn mode; the summary job (rampart-summary.js) remains the real enforcement point and still blocks on CRITICAL findings per the spec's always-blocking rule.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Replicates the pattern from ummat PR #88 (https://github.com/ummeco/ummat/pull/88) into islamwiki's
.github/workflows/rampart-pr.yml.Scanner steps (osv-scanner, semgrep) currently fail the GitHub Actions job via their own raw process exit code. This bypasses the intended
RAMPART_ENFORCE=warnbehavior, where.github/scripts/rampart-gate.js(and thesummaryjob's aggregation logic) is supposed to be the sole decider of pass/fail based on severity.Fix: add
continue-on-error: ${{ env.RAMPART_ENFORCE == 'warn' }}to each scanner step that can fail the job via its own exit code. WhenRAMPART_ENFORCE=warn, the step is allowed to fail without failing the job, and the downstream gate/summary logic decides the outcome instead.The
secretsjob (gitleaks) is intentionally exempt — it stays always-blocking by design and was not touched.Steps changed
deps-osv:google/osv-scanner-actionstep — addedcontinue-on-errorsast: semgrep scan step — addedname: Scan+continue-on-errordeps-pnpm'spnpm audit ... || truestep was reviewed and left as-is — the|| truealready absorbs the exit code, so it can't fail the job on its own.islamwiki has no Go module / govulncheck job and no containers/trivy or schema-audit/hasura job, so those parts of PR #88's diff do not apply here.
DO NOT MERGE — for review only.
Test plan
RAMPART_ENFORCE=warnvsstrict