Skip to content

Conversation

@tembleking
Copy link
Member

Summary

IaC mode scans were silently failing with ReportParsingError because the scanner always attempted to parse a JSON output file that only exists in VM mode.

Root Cause

In VM mode, the Sysdig CLI scanner generates a scan-result.json file via the --output=json-file=scan-result.json flag. The action then reads and parses this file to build the ScanResult object.

In IaC mode, this flag is intentionally omitted (IaC scans don't produce vulnerability JSON), but the code still attempted to read and parse the non-existent file, causing JSON.parse("") to throw.

Why This Wasn't Caught Earlier

The CI dogfooding test (scan-with-multiple-policies) was running with stop-on-processing-error: false (the default). This meant the ReportParsingError was logged but didn't fail the action, so steps.scan.outcome was "success" and the test passed despite the underlying error.

Changes

  • IaC mode now returns a minimal ScanResult derived from the CLI exit code (0 = passed, non-zero = failed) instead of attempting to parse JSON
  • The CI test now uses stop-on-processing-error: true to ensure processing errors are caught in the future

Closes #99

@tembleking tembleking requested a review from a team as a code owner January 27, 2026 14:58
@tembleking tembleking enabled auto-merge (squash) January 27, 2026 14:59
@tembleking tembleking merged commit eb42441 into master Jan 27, 2026
10 checks passed
@tembleking tembleking deleted the fix/iac-mode-report-parsing-error branch January 27, 2026 15:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

IaC scan failing with ReportParsingError

3 participants