mengzhx/semantica
1
0
Fork 0
mirror of https://github.com/semantica-agi/semantica.git synced 2026-08-29 04:26:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(ci): add .checkov.yaml soft-fail to silence tool-error break in MSDO

Browse Source 
Active results are 0 and 'Found no breaking results' but MSDO still fails
because checkov exits with code 1 whenever it finds any violation
(including MEDIUM/LOW below the minimum severity threshold). MSDO v1.12.0
treats a non-zero tool exit code as a breaking result even when Guardian
reports no active findings.

soft-fail: true makes checkov exit 0 in all cases. MSDO Guardian still
reads the full SARIF output and would surface any HIGH/CRITICAL findings
as active results that break the build, so the security posture is
unchanged.
This commit is contained in:
KaifAhmad1
2026-06-24 13:31:19 +05:30
parent a8043418a1
commit 2f73c1c91d
1 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.checkov.yaml
+9
View File
@@ -0,0 +1,9 @@
# Checkov configuration for MSDO (Microsoft Security DevOps) CI.
#
# soft-fail: true makes checkov exit with code 0 regardless of findings.
# MSDO Guardian still reads the SARIF output produced by checkov and surfaces
# any HIGH/CRITICAL violations as "active results" that break the build.
# Without this setting, checkov exits 1 on any violation (even MEDIUM/LOW),
# which MSDO v1.12.0 treats as a tool error and breaks the build even when
# Active results = 0.
soft-fail: true