Merge pull request #101 from JoshuaAFerguson/claude/fix-dashboard-app… #197
JoshuaAFergusonsecurity-scan.yml
on: push
Matrix: CodeQL Analysis
Matrix: Dockerfile Linting
Matrix: Go Dependency Vulnerability Scan
Matrix: Trivy Container Image Scan
npm Dependency Vulnerability Scan
39s
Secret Scanning with Gitleaks
5s
SAST with Semgrep
46s
Kubernetes Manifest Security Scan
23s
Dependency Review
0s
Security Scan Summary
5s
Annotations
34 errors and 5 warnings
|
Dockerfile Linting (controller):
controller/Dockerfile#L29
DL3059 info: Multiple consecutive `RUN` instructions. Consider consolidation.
|
|
npm Dependency Vulnerability Scan
Process completed with exit code 1.
|
|
Go Dependency Vulnerability Scan (controller)
Process completed with exit code 1.
|
|
Go Dependency Vulnerability Scan (controller):
controller/controllers/applicationinstall_controller.go#L292
cannot use &streamspacev1alpha1.ApplicationInstall{} (value of type *"github.com/streamspace/streamspace/api/v1alpha1".ApplicationInstall) as client.Object value in argument to ctrl.NewControllerManagedBy(mgr).For: *"github.com/streamspace/streamspace/api/v1alpha1".ApplicationInstall does not implement client.Object (missing method DeepCopyObject)
|
|
Go Dependency Vulnerability Scan (controller):
controller/controllers/applicationinstall_controller.go#L286
cannot use appInstall (variable of type *"github.com/streamspace/streamspace/api/v1alpha1".ApplicationInstall) as client.Object value in argument to r.Status().Update: *"github.com/streamspace/streamspace/api/v1alpha1".ApplicationInstall does not implement client.Object (missing method DeepCopyObject)
|
|
Go Dependency Vulnerability Scan (controller):
controller/controllers/applicationinstall_controller.go#L52
cannot use &appInstall (value of type *"github.com/streamspace/streamspace/api/v1alpha1".ApplicationInstall) as client.Object value in argument to r.Get: *"github.com/streamspace/streamspace/api/v1alpha1".ApplicationInstall does not implement client.Object (missing method DeepCopyObject)
|
|
Go Dependency Vulnerability Scan (controller):
controller/api/v1alpha1/applicationinstall_types.go#L203
cannot use &ApplicationInstallList{} (value of type *ApplicationInstallList) as "k8s.io/apimachinery/pkg/runtime".Object value in argument to SchemeBuilder.Register: *ApplicationInstallList does not implement "k8s.io/apimachinery/pkg/runtime".Object (missing method DeepCopyObject)
|
|
Go Dependency Vulnerability Scan (controller):
controller/api/v1alpha1/applicationinstall_types.go#L203
cannot use &ApplicationInstall{} (value of type *ApplicationInstall) as "k8s.io/apimachinery/pkg/runtime".Object value in argument to SchemeBuilder.Register: *ApplicationInstall does not implement "k8s.io/apimachinery/pkg/runtime".Object (missing method DeepCopyObject)
|
|
Dockerfile Linting (api):
api/Dockerfile#L44
DL3018 warning: Pin versions in apk add. Instead of `apk add <package>` use `apk add <package>=<version>`
|
|
Dockerfile Linting (api):
api/Dockerfile#L30
DL3059 info: Multiple consecutive `RUN` instructions. Consider consolidation.
|
|
Dockerfile Linting (api):
api/Dockerfile#L12
DL3018 warning: Pin versions in apk add. Instead of `apk add <package>` use `apk add <package>=<version>`
|
|
Dockerfile Linting (ui)
The strategy configuration was canceled because "docker-lint.api" failed
|
|
Dockerfile Linting (ui)
A task was canceled.
|
|
Go Dependency Vulnerability Scan (api)
The strategy configuration was canceled because "go-dependency-scan.controller" failed
|
|
Go Dependency Vulnerability Scan (api)
The operation was canceled.
|
|
Go Dependency Vulnerability Scan (api)
auth.JWTManager.ValidateToken calls jwt.ParseWithClaims, which eventually calls jwt.Parser.ParseUnverified
|
|
Kubernetes Manifest Security Scan
Path does not exist: checkov-k8s-results.sarif
|
|
Kubernetes Manifest Security Scan
CodeQL Action v3 will be deprecated in December 2026. Please update all occurrences of the CodeQL Action in your workflow files to v4. For more information, see https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/
|
|
SAST with Semgrep
CodeQL Action v3 will be deprecated in December 2026. Please update all occurrences of the CodeQL Action in your workflow files to v4. For more information, see https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/
|
|
Trivy Container Image Scan (ui)
Process completed with exit code 1.
|
|
Trivy Container Image Scan (ui)
CodeQL Action v3 will be deprecated in December 2026. Please update all occurrences of the CodeQL Action in your workflow files to v4. For more information, see https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/
|
|
Trivy Container Image Scan (ui)
Process completed with exit code 1.
|
|
CodeQL Analysis (javascript)
CodeQL Action v3 will be deprecated in December 2026. Please update all occurrences of the CodeQL Action in your workflow files to v4. For more information, see https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/
|
|
Trivy Container Image Scan (api)
The strategy configuration was canceled because "trivy-container-scan.ui" failed
|
|
Trivy Container Image Scan (api)
Process completed with exit code 1.
|
|
Trivy Container Image Scan (api)
Path does not exist: trivy-api-results.sarif
|
|
Trivy Container Image Scan (api)
CodeQL Action v3 will be deprecated in December 2026. Please update all occurrences of the CodeQL Action in your workflow files to v4. For more information, see https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/
|
|
Trivy Container Image Scan (api)
The operation was canceled.
|
|
Trivy Container Image Scan (controller)
The strategy configuration was canceled because "trivy-container-scan.ui" failed
|
|
Trivy Container Image Scan (controller)
Process completed with exit code 1.
|
|
Trivy Container Image Scan (controller)
Path does not exist: trivy-controller-results.sarif
|
|
Trivy Container Image Scan (controller)
CodeQL Action v3 will be deprecated in December 2026. Please update all occurrences of the CodeQL Action in your workflow files to v4. For more information, see https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/
|
|
Trivy Container Image Scan (controller)
The operation was canceled.
|
|
CodeQL Analysis (go)
CodeQL Action v3 will be deprecated in December 2026. Please update all occurrences of the CodeQL Action in your workflow files to v4. For more information, see https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/
|
|
Go Dependency Vulnerability Scan (controller)
Restore cache failed: Dependencies file is not found in /home/runner/work/streamspace/streamspace. Supported file pattern: go.sum
|
|
Go Dependency Vulnerability Scan (api)
Restore cache failed: Dependencies file is not found in /home/runner/work/streamspace/streamspace. Supported file pattern: go.sum
|
|
Trivy Container Image Scan (ui)
No files were found with the provided path: trivy-ui-report.html. No artifacts will be uploaded.
|
|
Trivy Container Image Scan (api)
No files were found with the provided path: trivy-api-report.html. No artifacts will be uploaded.
|
|
Trivy Container Image Scan (controller)
No files were found with the provided path: trivy-controller-report.html. No artifacts will be uploaded.
|
Artifacts
Produced during runtime
| Name | Size | Digest | |
|---|---|---|---|
|
gitleaks-results.sarif
Expired
|
6.62 KB |
sha256:54bb50284c716b2f41cae56636a09ea67932b14d9f9f96db3a86638886e074b2
|
|