feat: scan gate mode via --fail-on=any|high and --strict - #13
Merged
Merged
Conversation
- --fail-on=high (ps1 -FailOn high): secrets (gitleaks, trufflehog) always fail; osv fails only when Critical+High > 0 parsed from its severity summary (a missing summary counts as fail, stated on the terminal); semgrep runs with --severity ERROR; checkov and socket become report-only. Default any = unchanged behaviour. Below-threshold findings stay visible in the report; they just stop failing the run. - --strict (ps1 -Strict): exit 3 when a selected scanner is not installed, for gates that must not silently pass green on a machine missing a scanner. Default stays fail-open (skip + report note). - Exit codes documented: 0 clean, 1 findings at/above threshold, 2 usage, 3 strict + missing scanner. - seckit.ps1 scan dispatch forwards -FailOn/-Strict; docs and both CI templates gain the blocking-gate variant comment. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01B9sELo4AqzS2NcvToDhdNy
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Second slice of the deployment-gate plan: make the
seckit scanexit code usable as a blocking gate.--fail-on=any|high(PowerShell-FailOn).highkeeps a blocking gate quiet on low-severity noise: secrets (gitleaks, trufflehog) always fail; osv fails only when its severity summary shows Critical+High > 0 (a missing summary counts as fail, noted on the terminal); semgrep runs with--severity ERROR; checkov and socket still report but never fail the run. Defaultany= today's behaviour. Below-threshold findings stay visible in the report - they just stop failing the run.--strict(PowerShell-Strict): exit 3 when a selected scanner is not installed, so a gate cannot silently pass green on a machine that is missing a scanner. Default remains fail-open (skip + report note).0clean,1findings at/above threshold,2usage error,3strict + missing scanner.seckit.ps1scan dispatch forwards the new switches; docs and both CI templates (GitHub + Azure Pipelines) gain the blocking-gate variant comment.Verified
bash check.shgreen (shellcheck, PSScriptAnalyzer, YAML).anymode.--fail-onvalue -> 2 (both shells), strict + missing scanner -> 3 (both, via stripped PATH), non-strict same setup -> 0, end-to-end gate run (--only=osv --fail-on=high --strict, direct and via the pwsh wrapper) -> 0.🤖 Generated with Claude Code
https://claude.ai/code/session_01B9sELo4AqzS2NcvToDhdNy