mirror of
https://github.com/semantica-agi/semantica.git
synced 2026-08-29 04:26:20 +00:00
KaifAhmad1
52e8f38361
Root cause of 6 consecutive CI failures: MSDO 0.215.0's guardian.cmd wrapper breaks the build whenever checkov exits with code 1. Checkov exits 1 on ANY violation, including MEDIUM/LOW findings that are all 'below minimum severity'. This makes Active results = 0 and 'Found no breaking results', yet Guardian still raises BreakException because it treats the tool's exit code as a first-class breaking signal. The .checkov.yaml soft-fail setting was never read because the MSDO runner bypasses repository config files. Fix: - Remove checkov from the MSDO tools list (stops the guardian.cmd crash) - Add a dedicated 'checkov' job on ubuntu-latest using the official bridgecrewio/checkov-action@v12, which runs a current checkov release, runs on Linux, and correctly reads .checkov.yaml and respects soft_fail - Set soft_fail: true in the action so low/medium findings appear in the Security tab without ever blocking the build - MSDO continues to run eslint, templateanalyzer (Bicep/ARM), and terrascan; these tools all have well-behaved exit codes and produce no active results after the security fixes applied earlier in this PR .checkov.yaml: - Replace soft-fail: true (was a failed workaround for MSDO) with skip-check: [CKV_K8S_28, CKV_K8S_30] — correct suppression for the Knative false-positives (Cloud Run enforces seccomp + AppArmor at platform level without requiring K8s annotations)