Repository navigation
fix(ci): build the scanner, not the caller, in scan-and-report.yml - #286
Merged
Merged
Conversation
Every repository that calls scan-and-report.yml as a reusable workflow failed at "Run scan" with exit 127: ./target/release/panic-attack did not exist. In a reusable workflow, actions/checkout with no repository checks out the caller, so "cargo build" built the caller's crate. The step worked only when this repository ran the workflow on itself. Fetch the scanner source at the commit of this workflow file (job.workflow_repository at job.workflow_sha) and build that: - a caller that pins scan-and-report.yml@<sha> gets the scanner at that SHA, never main by name (the #212 property); - a run of this workflow in its own repository still builds the commit under test; - the source goes to the runner's temp directory, outside the workspace, so the scan cannot report on the scanner's own files. The fetch step refuses a repository that is not owner/name and a commit that is not a full SHA, and checks that the fetched HEAD is that SHA. The cache step now keys on the scanner's workspace, not the caller's. The scan step takes the target path from the environment and quotes it. No uses: reference changes, so actions.lock is unchanged. Local run of the changed steps, extracted from the workflow file (x86_64 Linux, cargo 1.97.0): the fetch at c7b1c44 succeeds and is refused for "main", a short SHA and a malformed repository; the build takes 3 min 14 s and leaves the binary; the scan of a checkout of hyperpolymath/echidna as the caller exits 0 with a schema 2.6 report (951 of 951 files) that names no scanner source path. Not shown locally: that job.workflow_sha names this repository's commit inside a call from another repository. That needs a hosted run from an external caller. Refs #276, #212 Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0136P7ZmAsYpFA9gxfQLF3F6 Signed-off-by: Claude <noreply@anthropic.com>
Contributor
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 32 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
|
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
hyperpolymath
added a commit
that referenced
this pull request
Nov 10, 2026
Follow-up to #286. Refs #276. ## What failed Run 42862049822 was the first run of `scan-and-report.yml` by `workflow_dispatch`. It ran on the #286 branch before the merge. - The new steps of #286 passed: the fetch of the scanner source and the build (2 min 33 s). - **Run scan** failed with exit 2: `a value is required for '<TARGET>' but none was supplied`. ## Cause `repo_path` and `fail_on_severity` are declared under `workflow_call` only. A `workflow_dispatch` run has its own `inputs` context, so both values were empty strings. - The scan had no target. - The severity gate would then reject the empty threshold (`fail_on_severity must be one of ...`). The step before #286 expanded the same empty input, so this path did not work before #286 either. #286 did not cause it. The first manual run showed it. ## Change Declare both inputs under `workflow_dispatch`, with the same names and the same defaults (`.` and `none`). The expressions in the steps do not change. An explicit bad value from a caller is still refused. ## Evidence A hosted `workflow_dispatch` run on this branch is the proof. I add its result in a comment when it completes. This pull request does not show the external caller case of #276. That still needs a caller that pins a commit with #286, for example echidna's `security-scan.yml`. --- _Generated by [Claude Code](https://claude.ai/code/session_0136P7ZmAsYpFA9gxfQLF3F6)_ Signed-off-by: Claude <noreply@anthropic.com> Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refs #276 and #212. This pull request does not close #276 by itself: the first acceptance criterion needs a hosted run from an external caller (see "Not shown yet").
Symptom
Every repository that calls
scan-and-report.ymlas a reusable workflow fails at Run scan with exit 127:./target/release/panic-attackdoes not exist. Observed on hyperpolymath/echidnamain, Security Scan run 42351376316.Cause
In a reusable workflow,
actions/checkoutwith norepository:checks out the caller. The stepcargo build --locked --releasetherefore built the caller's crate. It worked only when this repository ran the workflow on itself.Change
The workflow now fetches the scanner source at the commit of this workflow file and builds that.
job.workflow_repositoryatjob.workflow_sha. GitHub documents both as the repository and commit of the workflow file that defines the job.scan-and-report.yml@<sha>gets the scanner at that SHA. It is nevermainby name, which keeps the scan-and-report.yml installs panic-attack from moving main — pin the scanner source (CWE-829) #212 property.owner/nameand for a commit that is not a full SHA. It also checks that the fetchedHEADis that SHA.No
uses:reference changes, soactions.lockis unchanged.One difference from the proposal in #276: the proposal names
hyperpolymath/panic-attackas a literal. This change takes the repository fromjob.workflow_repository, so a rename of this repository cannot break the fetch.Acceptance criteria
Run scan, and the binary existsworkflow_dispatchrun on this branch: see the comment below when it completes.Evidence (local)
I extracted the changed steps from the workflow file and ran them on x86_64 Linux with cargo 1.97.0.
c7b1c44(mainat that time). It is refused with exit 2 formain, a short SHA, a malformed repository and an empty repository.Not shown yet
That
job.workflow_shanames this repository's commit inside a call from another repository. The local run cannot show it. A caller must pin a commit that contains this change; echidna'ssecurity-scan.ymlstill pinsbe6ac46.Generated by Claude Code