Repository navigation
ci(strix): post scan report as PR comment and fail on findings - #25
Conversation
- Capture and redact the Strix report and upload it as an artifact. - Post/update a single PR comment from a separate job that holds the only write-capable token (the job running PR code and the LLM never does). - Fail the check when Strix reports vulnerabilities; scanner errors and timeouts stay warnings. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars.
 |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9ed98a0428
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if [[ "$FINDINGS" == "true" ]]; then | ||
| status="vulnerabilities reported" | ||
| else | ||
| status="no vulnerabilities reported" |
There was a problem hiding this comment.
When Strix times out or exits with any scanner error, FINDINGS remains unset, so this branch labels the PR comment “no vulnerabilities reported” even though the scan did not complete; the preceding workflow section explicitly classifies exit codes 124/137 as timeouts and other nonzero codes as failures. Because these outcomes intentionally leave the check green, the success-like comment can conceal that no reliable security result exists; use a separate incomplete/error status for nonzero, non-findings exit codes.
Useful? React with 👍 / 👎.
The full report can contain secrets or exploit details the scanner finds and comments/artifacts are public on public repositories (flagged by Strix on arumes31/hackwerk#29). Comment titles + severities only; pass the summary as a job output instead of an artifact. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The full report can contain secrets or exploit details the scanner finds and comments/artifacts are public on public repositories (flagged by Strix on arumes31/hackwerk#29). Comment titles + severities only; pass the summary as a job output instead of an artifact. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Strix security scan: no vulnerabilities reportedCommit ea709d3 · exit code 0 · workflow run Details are in the workflow run log. |
actionlint/shellcheck flagged individual redirects to GITHUB_OUTPUT. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Updates the Strix workflow (same change as arumes31/rauth#768):
Strix PR commentjob posts/updates one PR comment with the report. Only that job getspull-requests: write; the job that runs PR code and the LLM keeps a read-only token.The repository's existing
actions/checkoutpin is kept.🤖 Generated with Claude Code