From 18532857bf3e9dfa6c361d9c37cabd19c28102cf Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 7 Aug 2026 17:16:07 +0000 Subject: [PATCH] docs: say what the six required security scans actually gate MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Gate 2 now requires the six security contexts, but every one of them reports success with findings present, so the list as written reads as a vulnerability gate it is not. npm-audit continue-on-error: true on the audit step python-safety || true and continue-on-error: true bandit || true on bandit -r src trivy exit-code: '0' passed to trivy-action CodeQL x2 alerts route to the Security tab; blocking them is code-scanning merge protection, not a required check Records what requiring them does buy — detection of a scanner that broke or stopped running — and states that making findings block is a change to security.yml and to merge protection, not a branch-protection edit. Same defect class as the list this stacks on: a list that does not say what it means. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_019VsKKnTAKoWJr49zQP95kK --- MERGE_POLICY.md | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/MERGE_POLICY.md b/MERGE_POLICY.md index 7445810ea..89b6d8b1f 100644 --- a/MERGE_POLICY.md +++ b/MERGE_POLICY.md @@ -93,6 +93,23 @@ listed `Security` among its required six, and dropping every security scan out of the required set would be a weakening introduced by the rewrite that set out to make this gate precise. +> **What these six actually gate.** They attest that each scan *ran* — not that +> it found nothing. Every one of them reports `success` with findings present: +> +> | Check | Fails the job on | Why findings don't fail it | +> | --- | --- | --- | +> | `npm-audit` | `npm install` breaking | `continue-on-error: true` on the `npm audit` step | +> | `python-safety` | `pip install safety` breaking | `\|\| true` *and* `continue-on-error: true` | +> | `bandit` | `pip install bandit` breaking | `\|\| true` on the `bandit -r src` step | +> | `trivy` | the `docker build` breaking | `exit-code: '0'` passed to `trivy-action` | +> | `Security Scan - python`, `Security Scan - javascript` | CodeQL itself erroring | alerts route to the Security tab; blocking on them is code-scanning merge protection, which is not a required-check setting | +> +> So requiring these six catches a scanner that broke or stopped running, which +> is a real regression this gate can detect. It does **not** mean "no +> HIGH/CRITICAL finding can merge." Making findings block is a change to +> `security.yml` and to code-scanning merge protection — not a branch-protection +> edit, and not something adding a name to the list above achieves. + > **`trivy` is lowercase.** Two distinct check-runs exist on the same head — > `trivy` reports `success`, `Trivy` reports `neutral`. Selecting the > capitalised one requires a check that never passes. This is exactly the trap