admin/0pt
5
0
Fork 0
Code Issues 10 Pull Requests Actions 3.8k Packages Projects Releases Wiki Activity

chore(security): fail-closed scannerfel + resurstak for scannrarna #595

Merged
admin merged 1 commits from chore/security-fail-closed-20261113 into main 2026-11-14 16:18:26 +00:00
Conversation 1 Commits 1 Files Changed 1
+14 -32
admin commented 2026-11-14 16:12:18 +00:00
Owner
Copy Link
Copy Source

Hardar .gitea/workflows/security.yml enligt server-config/workflows/security-hardened.yml:

  1. Fail-closed: ett scannerfel (rc som varken ar 0 = rent eller 1 = fynd) gav tidigare ::warning och exit 0 — grinden blev tyst gron nar verktyget inte kunde koras. Nu blir det ::error och exit 1, med texten uttryckligen "scannerfel, inte fynd" sa att felklassen gar att skilja.
  2. Resurstak: --cpus 2 --memory 4g aven pa Trivy, OSV-Scanner och Semgrep (gitleaks hade det redan), sa en scanner inte kan ata en delad runner-vard.

Concurrency-blocket och de informativa stegen (Trivy config, gitleaks history) ar oforandrade — de ar fortsatt continue-on-error by design.

Verifierat: YAML parsar, 11 steg, concurrency: security-${{ github.ref }} kvar.

Hardar `.gitea/workflows/security.yml` enligt `server-config/workflows/security-hardened.yml`: 1. **Fail-closed**: ett scannerfel (rc som varken ar 0 = rent eller 1 = fynd) gav tidigare `::warning` och `exit 0` — grinden blev tyst gron nar verktyget inte kunde koras. Nu blir det `::error` och `exit 1`, med texten uttryckligen "scannerfel, inte fynd" sa att felklassen gar att skilja. 2. **Resurstak**: `--cpus 2 --memory 4g` aven pa Trivy, OSV-Scanner och Semgrep (gitleaks hade det redan), sa en scanner inte kan ata en delad runner-vard. Concurrency-blocket och de informativa stegen (Trivy config, gitleaks history) ar oforandrade — de ar fortsatt `continue-on-error` by design. Verifierat: YAML parsar, 11 steg, `concurrency: security-${{ github.ref }}` kvar.
admin added 1 commit 2026-11-14 16:12:19 +00:00
chore(security): fail-closed scannerfel + resurstak for scannrarna
CI (SIAX Cloud) / sonar (pull_request) Skipped
Details
CI (SIAX Cloud) / Component conformance (blocking) (pull_request) Successful in 11s
Details
CI (SIAX Cloud) / security (pull_request) Successful in 22s
Details
masterplan-lock / check (pull_request) Successful in 9s
Details
CI (SIAX Cloud) / integration (pull_request) Successful in 1m37s
Details
security / scan (pull_request) Failing after 1m14s
Details
CI (SIAX Cloud) / quality (pull_request) Successful in 2m18s
Details
59ae1a32a6
CODEOWNERS rules requested review from sax3l 2026-11-14 16:12:19 +00:00
siax-bot approved these changes 2026-11-14 16:18:24 +00:00
siax-bot left a comment
Collaborator
Copy Link
Copy Source

pr-shepherd: obligatoriska kontroller gröna (all-emitted-green) på 59ae1a32; ändrar: ci-workflow.

pr-shepherd: obligatoriska kontroller gröna (all-emitted-green) på 59ae1a32; ändrar: ci-workflow.
admin merged commit e02e0ea259 into main 2026-11-14 16:18:26 +00:00
admin deleted branch chore/security-fail-closed-20261113 2026-11-14 16:18:26 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
sax3l
siax-bot
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
siax-approver siax-bot siax-ci siax-healer (siax-healer (CI self-healing agent)) admin (Simon Axelsson)
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: admin/0pt#595