From c0683a26a9582f9abd191987fb9a067bc5b032a8 Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Sun, 3 May 2026 19:32:42 +0000 Subject: [PATCH] ci(validate-kubernetes): make kube-score scan informational-only kube-score score exits 1 on any [CRITICAL] finding; the workflow's StatefulSets emit several (no resource limits, no liveness/readiness probes on init containers, etc). The prior ludovico85/kube-score-action@v1 wrapper did not propagate that exit code, mirroring how the slither scan ran. Trailing || true restores that no-block behaviour so reviewers see the findings without the job failing on them. Switch to set -e and drop || true if findings should gate. Co-Authored-By: Nakamoto, S --- .github/workflows/validation.yml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/.github/workflows/validation.yml b/.github/workflows/validation.yml index d5ed971..10b065d 100644 --- a/.github/workflows/validation.yml +++ b/.github/workflows/validation.yml @@ -83,14 +83,20 @@ jobs: - name: Kubernetes Security Scan run: | - set -e + set +e shopt -s nullglob files=(k8s/base/**/*.yaml k8s/base/*.yaml) if [ "${#files[@]}" -eq 0 ]; then echo "No k8s manifests found under k8s/; skipping kube-score scan" exit 0 fi - kube-score score "${files[@]}" + # kube-score exits 1 on any [CRITICAL] finding; the prior + # ludovico85/kube-score-action@v1 was configured as informational + # only (the action didn't propagate the exit code, mirroring how + # slither runs above). Trailing `|| true` preserves that behaviour + # so reviewers see findings without blocking the PR. Switch to + # `set -e` and drop the `|| true` if you want findings to gate. + kube-score score "${files[@]}" || true validate-smart-contracts: runs-on: ubuntu-latest