Guardrails / security

The build produced a security scan

security/scan-results-present@v1

A scanner ran and left a report the build can be judged on, rather than the build reporting nothing at all.

Id	security/scan-results-present
Version	v1
Category	security
Default severity	error
Interpreter	python3
Timeout	30 seconds
Violations tolerated	0
Collects	scan

Collectors

This guardrail gathers nothing itself. It depends on the collectors below, which the CLI runs once per build before any check, and reads what they found out of GUARDRAIL_FACTS. A collector that collects nothing skips this guardrail rather than failing it.

Collector	Gathers	Inputs it is given
scan	Findings from whatever scanner the build already ran, read from the report it left behind and normalized into one shape, whether the tool was a SAST, an SCA, a secret detector or an infrastructure scanner.	none

The inputs above are this guardrail's own, passed straight through. Configuring one in buildnote.json changes what is collected, and two guardrails configured the same way share the one collection.

Configuration

{
  "guardrails": {
      "failOn": "error",
      "comment": true,
      "checks": [
          {
              "use": "security/scan-results-present@v1",
              "severity": "error",
              "with": {},
              "exemptions": []
          }
      ]
  }
}

How to fix

Run a scanner in the pipeline and leave its report in the workspace before buildnote guardrails runs. Any of these is enough:

semgrep --config auto --sarif --output semgrep.sarif
trivy fs --format json --output trivy.json .
grype dir:. -o json --file grype.json

The guardrail reads whatever report is there, so the scanner is your choice. An absent report is the violation: a build nobody scanned cannot be evidenced as clean.

More in security

• security/finding-budget. The number of findings at or above a severity sits within the budget the team set, so a report nobody can read does not pass for a clean one.
• security/fixable-vulnerabilities. Every finding the scanner reported a fixed version for is taken, so the ones that cost an upgrade rather than a redesign are not the ones left open.
• security/no-high-findings. Every finding the scanner reported sits below the severity the team gates on.

All 4 security guardrails