From 0cad8f384d9aeba575e975c06849db7151516a71 Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Tue, 21 Apr 2026 01:32:41 +0000 Subject: [PATCH 1/2] fix(ci): unblock image job on private-repo SARIF upload MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The post-merge main build of PR #10 successfully built, pushed, and Cosign-signed ghcr.io/bcit-tlu/haproxy-operator/haproxy-operator:0.2.1-head.db7fcb5, but the codeql-action/upload-sarif@v4 step failed with 'Resource not accessible by integration' on the workflow-runs GET. On private repos, upload-sarif needs 'actions: read' to read the calling workflow's run metadata; public repos (hriv, tech-ops-docs) don't hit this path because the metadata endpoint is anonymous. Two-part fix: 1. Add 'actions: read' to the workflow permissions block so the required metadata fetch actually works. 2. Mark the upload step 'continue-on-error: true' so a transient telemetry-upload failure never cascades into blocking chart publication of an already-built, already-signed image. This mirrors the intent of the existing guards — publish artifacts stay gated on MODE + successful build+sign; SARIF-to-Security-tab is a diagnostic sidecar. Co-Authored-By: kyle_hunter@bcit.ca --- .github/workflows/ci.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 50edb84..39aedd8 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -29,6 +29,7 @@ permissions: packages: write id-token: write # Cosign keyless (Sigstore OIDC) security-events: write # Trivy SARIF upload to GitHub Security tab + actions: read # Required by codeql-action/upload-sarif on private repos jobs: # ── Quality gates ───────────────────────────────────────── @@ -250,6 +251,7 @@ jobs: - name: Upload scan results to GitHub Security if: needs.versions.outputs.mode == 'head' || needs.versions.outputs.mode == 'release' uses: github/codeql-action/upload-sarif@v4 + continue-on-error: true # Non-critical: don't block chart publish on telemetry upload with: sarif_file: trivy.sarif category: trivy From a1830cd89be361e0ebe4b454682e535e4499e5c9 Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Tue, 21 Apr 2026 01:54:35 +0000 Subject: [PATCH 2/2] fix(ci): surface SARIF upload failures as warnings MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Addresses Devin Review feedback on PR #11. 'continue-on-error: true' on upload-sarif correctly unblocks chart publish when the upload fails, but it silently swallows ALL upload failures — including genuine regressions (malformed SARIF, removed 'security-events: write', breaking CodeQL action changes). The security scan results would silently disappear from the GitHub Security tab with no signal in the workflow summary. Add a follow-up step that emits a '::warning::' annotation when the preceding step's outcome is 'failure'. This surfaces the failure in the Actions UI (yellow warning icon + annotation in the summary) without gating the pipeline, preserving the original intent that the image+chart artifacts ship even if telemetry upload glitches. Co-Authored-By: kyle_hunter@bcit.ca --- .github/workflows/ci.yaml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 39aedd8..0e1e3e3 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -249,13 +249,19 @@ jobs: severity: CRITICAL,HIGH - name: Upload scan results to GitHub Security + id: upload-sarif if: needs.versions.outputs.mode == 'head' || needs.versions.outputs.mode == 'release' uses: github/codeql-action/upload-sarif@v4 - continue-on-error: true # Non-critical: don't block chart publish on telemetry upload + continue-on-error: true # Never block chart publish on Security-tab upload with: sarif_file: trivy.sarif category: trivy + - name: Surface SARIF upload failure + if: steps.upload-sarif.outcome == 'failure' + run: | + echo "::warning title=Trivy SARIF upload failed::Scan results did NOT reach the GitHub Security tab for this run. Inspect the 'Upload scan results to GitHub Security' step above. The image was still built, pushed, signed, and scanned locally." + # ── Helm chart → OCI registry ──────────────────────────── # # Charts are published on: