fix/prevent dynamic scan from triggering npm audit #957
Conversation
WalkthroughThe changes update the security scanning commands defined in the Changes
Sequence Diagram(s)sequenceDiagram
participant Developer
participant ScanZap as scan:zap
participant DockerScan as docker-security-scan
participant StaticScan as static-security-scan
Developer->>ScanZap: Execute scan:zap
ScanZap->>DockerScan: Run docker-security-scan
Note over ScanZap: Previous flow also invoked static-security-scan
Possibly related PRs
Suggested reviewers
Poem
📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (1)
🧰 Additional context used🪛 actionlint (1.7.4).github/workflows/security-scan.yml19-19: the runner of "actions/github-script@v6" action is too old to run on GitHub Actions. update the action's version to fix this issue (action) 30-30: property "detect-environments" is not defined in object type {} (expression) 78-78: property "detect-environments" is not defined in object type {} (expression) ⏰ Context from checks skipped due to timeout of 90000ms (1)
🔇 Additional comments (3)
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
Coverage Report
File CoverageNo changed files found. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🔭 Outside diff range comments (1)
.github/workflows/security-scan.yml (1)
208-208: 💡 Verification agent❓ Verification inconclusive
Undefined Output "result" in Audit Error Check Condition
In thecheck-audit-errorsjob (line 208), the condition usescontains(join(needs.*.result, ','), 'failure'). However, none of the preceding jobs define an output namedresult. This discrepancy means the condition for sending a failure notification might never be triggered as intended. Please update the condition to reference valid output parameters or define the missingresultoutput in the relevant jobs.
Action Required: Correct the Output Reference in the Workflow Condition
The condition at line 208 of.github/workflows/security-scan.ymlcurrently usesif: always() && contains(join(needs.*.result, ','), 'failure')which references an output named
resultthat is not defined in any of the preceding jobs. To ensure that failure notifications are triggered as intended, please either update the condition to reference a valid output parameter from the relevant jobs, or define theresultoutput in those jobs if it was intended to be produced.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/security-scan.yml(3 hunks)
🧰 Additional context used
🪛 actionlint (1.7.4)
.github/workflows/security-scan.yml
14-14: "steps" section is missing in job "jobs"
(syntax-check)
14-14: "runs-on" section is missing in job "jobs"
(syntax-check)
14-14: "jobs" job should not be empty. please remove this section if it's unnecessary
(syntax-check)
20-20: the runner of "actions/github-script@v6" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
31-31: property "detect-environments" is not defined in object type {}
(expression)
79-79: property "detect-environments" is not defined in object type {}
(expression)
⏰ Context from checks skipped due to timeout of 90000ms (1)
- GitHub Check: run-tests / test
🔇 Additional comments (2)
.github/workflows/security-scan.yml (2)
79-79:❓ Verification inconclusive
Validate Static Audit Job "environment" Reference
Similarly, thestatic-auditjob uses${{ needs.detect-environments.outputs.environments }}for itsenvironment. Ensure that this output is in the expected format (a single string) and that it correctly resolves after the workflow structure is fixed.
Review Comment Verification: Check "environment" Output Format
After reviewing the workflow snippet, please verify that the output from the
detect-environmentsjob—referenced as${{ needs.detect-environments.outputs.environments }}—consists of a single, properly formatted string. If the output may potentially contain multiple values or an unexpected format after the workflow structure changes, you may need to adjust the configuration for thestatic-auditjob accordingly.
- Confirm that the
detect-environmentsjob correctly sets theenvironmentsoutput as a single string.- If a different format is returned, update the
static-auditenvironment reference to ensure consistency.🧰 Tools
🪛 actionlint (1.7.4)
79-79: property "detect-environments" is not defined in object type {}
(expression)
31-31:❓ Verification inconclusive
Validate Dynamic Audit Job "environment" Reference
Thedynamic-auditjob assigns itsenvironmentfield with${{ needs.detect-environments.outputs.environments }}. Please verify that after refactoring the redundant nested"jobs:"key, the output from thedetect-environmentsjob exists and is a single valid string rather than an array—since theenvironmentproperty requires a single environment name.
Below are two new shell scripts to verify that the output from the
detect-environmentsjob is defined correctly as a single valid string. The first script searches for the file where thedetect-environmentsjob is defined; the second inspects that file’s outputs block for theenvironmentskey.Please run these scripts and share the results so we can confirm whether the value is indeed a string (as required by the
environmentproperty) rather than an array.Script 1 – Locate the
detect-environmentsjob definition:#!/bin/bash # Search for the definition of the 'detect-environments' job within .github/workflows. rg -n "id:\s*detect-environments" .github/workflowsScript 2 – Inspect the outputs block for the 'environments' key:
#!/bin/bash # Once the file is located, inspect its outputs block for the 'environments' key. file=$(rg -l "id:\s*detect-environments" .github/workflows | head -n 1) if [[ -n "$file" ]]; then echo "Inspecting outputs in file: $file" awk '/outputs:/ {flag=1; next} flag && /environments:/ {print; flag=0}' "$file" else echo "No detect-environments job found." fiPlease run these and update the verification results accordingly.
🧰 Tools
🪛 actionlint (1.7.4)
31-31: property "detect-environments" is not defined in object type {}
(expression)
.github/workflows/security-scan.yml
Outdated
| jobs: | ||
| detect-environments: | ||
| runs-on: ubuntu-latest | ||
| outputs: | ||
| environments: ${{ steps.environments.outputs.result }} | ||
| steps: | ||
| - uses: actions/github-script@v6 | ||
| id: environments | ||
| with: | ||
| github-token: ${{ secrets.GITHUB_TOKEN }} | ||
| script: | | ||
| if (context.payload?.inputs?.environment) return [context.payload?.inputs?.environment]; | ||
| const { data: { environments } } = await github.request(`GET /repos/${process.env.GITHUB_REPOSITORY}/environments`); | ||
| return environments.map(e => e.name) | ||
There was a problem hiding this comment.
🛠️ Refactor suggestion
Redundant Nested "jobs:" Key
The workflow contains a nested "jobs:" entry (lines 14–15) inside the top-level "jobs:" block. This extra nesting is not valid according to GitHub Actions schema and may cause the workflow to misinterpret your job definitions. Please remove the redundant "jobs:" key so that your job definitions (e.g. detect-environments) are direct children of the top-level "jobs:" key.
🧰 Tools
🪛 actionlint (1.7.4)
14-14: "steps" section is missing in job "jobs"
(syntax-check)
14-14: "runs-on" section is missing in job "jobs"
(syntax-check)
14-14: "jobs" job should not be empty. please remove this section if it's unnecessary
(syntax-check)
20-20: the runner of "actions/github-script@v6" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
| - uses: actions/github-script@v6 | ||
| id: environments | ||
| with: | ||
| github-token: ${{ secrets.GITHUB_TOKEN }} | ||
| script: | | ||
| if (context.payload?.inputs?.environment) return [context.payload?.inputs?.environment]; | ||
| const { data: { environments } } = await github.request(`GET /repos/${process.env.GITHUB_REPOSITORY}/environments`); | ||
| return environments.map(e => e.name) | ||
There was a problem hiding this comment.
🛠️ Refactor suggestion
Update GitHub Script Action Version
The actions/github-script@v6 action is reported by static analysis as being outdated for current GitHub Actions runners. Consider updating to a newer version (e.g. v6.1.0 or later) to benefit from improvements and ensure compatibility.
🧰 Tools
🪛 actionlint (1.7.4)
20-20: the runner of "actions/github-script@v6" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
Preview Link
https://submit-pr-[PR_NUMBER].herokuapp.com/
What type of PR is this? (check all applicable)
Description
This PR ensures that the dynamic security scan (ZAP scan) does not trigger
npm audit, which is meant for static security scanning.Related Tickets & Documents
Added/updated tests?
We encourage you to keep the code coverage percentage at 80% and above.
QA sign off
[optional] Are there any post-deployment tasks we need to perform?
[optional] Are there any dependencies on other PRs or Work?
Summary by CodeRabbit