No finding with a fix available is left open
security/fixable-vulnerabilities@v1
Every finding the scanner reported a fixed version for is taken, so the ones that cost an upgrade rather than a redesign are not the ones left open.
| Id | security/fixable-vulnerabilities |
| Version | v1 |
| Category | security |
| Default severity | warning |
| Interpreter | python3 |
| Timeout | 30 seconds |
| Violations tolerated | 0 |
| Collects | scan |
Collectors
This guardrail gathers nothing itself. It depends on the collectors below, which the CLI runs once per build before any check, and reads what they found out of GUARDRAIL_FACTS. A collector that collects nothing skips this guardrail rather than failing it.
| Collector | Gathers | Inputs it is given |
|---|---|---|
scan | Findings from whatever scanner the build already ran, read from the report it left behind and normalized into one shape, whether the tool was a SAST, an SCA, a secret detector or an infrastructure scanner. | none |
The inputs above are this guardrail's own, passed straight through. Configuring one in buildnote.json changes what is collected, and two guardrails configured the same way share the one collection.
Configuration
{
"guardrails": {
"failOn": "error",
"comment": true,
"checks": [
{
"use": "security/fixable-vulnerabilities@v1",
"severity": "warning",
"with": {
"severity": "medium",
"kinds": "sast,sca,iac,container,secret"
},
"exemptions": []
}
]
}
}Inputs
| Input | Description | Default | Environment variable |
|---|---|---|---|
severity | Lowest severity that is a violation when a fix is available. One of critical, high, medium, low, info. | medium | GUARDRAIL_INPUT_SEVERITY |
kinds | Comma separated kinds of finding that are counted, as the collector normalises them: sast, sca, secret, iac, container, unknown. | sast,sca,iac,container,secret | GUARDRAIL_INPUT_KINDS |
How to fix
Upgrade the packages named in the violations to the version the scanner named. The fix is already written and released: what is left is taking it.
An unfixable finding is a decision about risk, and it is reasonable for one to stay open while the team weighs it. A fixable one is not that decision, and it is the half of the report that is worth separating out, because it is the half that can be closed this afternoon.
More in security
security/finding-budget. The number of findings at or above a severity sits within the budget the team set, so a report nobody can read does not pass for a clean one.security/no-high-findings. Every finding the scanner reported sits below the severity the team gates on.security/scan-results-present. A scanner ran and left a report the build can be judged on, rather than the build reporting nothing at all.