Skip to content
BETAGuardrails are in beta. The library, the configuration format and the CLI command can still change.

Guardrails / security

No finding with a fix available is left open

security/fixable-vulnerabilities@v1

Every finding the scanner reported a fixed version for is taken, so the ones that cost an upgrade rather than a redesign are not the ones left open.

Idsecurity/fixable-vulnerabilities
Versionv1
Categorysecurity
Default severitywarning
Interpreterpython3
Timeout30 seconds
Violations tolerated0
Collectsscan

Collectors

This guardrail gathers nothing itself. It depends on the collectors below, which the CLI runs once per build before any check, and reads what they found out of GUARDRAIL_FACTS. A collector that collects nothing skips this guardrail rather than failing it.

CollectorGathersInputs it is given
scanFindings from whatever scanner the build already ran, read from the report it left behind and normalized into one shape, whether the tool was a SAST, an SCA, a secret detector or an infrastructure scanner.none

The inputs above are this guardrail's own, passed straight through. Configuring one in buildnote.json changes what is collected, and two guardrails configured the same way share the one collection.

Configuration

json
{
  "guardrails": {
      "failOn": "error",
      "comment": true,
      "checks": [
          {
              "use": "security/fixable-vulnerabilities@v1",
              "severity": "warning",
              "with": {
                  "severity": "medium",
                  "kinds": "sast,sca,iac,container,secret"
              },
              "exemptions": []
          }
      ]
  }
}

Inputs

InputDescriptionDefaultEnvironment variable
severityLowest severity that is a violation when a fix is available. One of critical, high, medium, low, info.mediumGUARDRAIL_INPUT_SEVERITY
kindsComma separated kinds of finding that are counted, as the collector normalises them: sast, sca, secret, iac, container, unknown.sast,sca,iac,container,secretGUARDRAIL_INPUT_KINDS

How to fix

Upgrade the packages named in the violations to the version the scanner named. The fix is already written and released: what is left is taking it.

An unfixable finding is a decision about risk, and it is reasonable for one to stay open while the team weighs it. A fixable one is not that decision, and it is the half of the report that is worth separating out, because it is the half that can be closed this afternoon.

More in security

  • security/finding-budget. The number of findings at or above a severity sits within the budget the team set, so a report nobody can read does not pass for a clean one.
  • security/no-high-findings. Every finding the scanner reported sits below the severity the team gates on.
  • security/scan-results-present. A scanner ran and left a report the build can be judged on, rather than the build reporting nothing at all.

All 4 security guardrails

Buildnote Limited
Registered in England and Wales, Reg: 16140412