fix: resolve ReportParsingError in IaC mode #101
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
IaC mode scans were silently failing with
ReportParsingErrorbecause the scanner always attempted to parse a JSON output file that only exists in VM mode.Root Cause
In VM mode, the Sysdig CLI scanner generates a
scan-result.jsonfile via the--output=json-file=scan-result.jsonflag. The action then reads and parses this file to build theScanResultobject.In IaC mode, this flag is intentionally omitted (IaC scans don't produce vulnerability JSON), but the code still attempted to read and parse the non-existent file, causing
JSON.parse("")to throw.Why This Wasn't Caught Earlier
The CI dogfooding test (
scan-with-multiple-policies) was running withstop-on-processing-error: false(the default). This meant theReportParsingErrorwas logged but didn't fail the action, sosteps.scan.outcomewas"success"and the test passed despite the underlying error.Changes
ScanResultderived from the CLI exit code (0 = passed, non-zero = failed) instead of attempting to parse JSONstop-on-processing-error: trueto ensure processing errors are caught in the futureCloses #99