Skip to content
Sarj Repo Standards
sarj/github/vulnerability-gate

Keep scanner failures blocking

Recognized vulnerability scanner failures propagate to CI.

warning beta

Examples

FlaggedFails
run: pip-audit || true
PassesClean
run: pip-audit

Why it matters

CI can pass while the scanner reports vulnerabilities or fails to run correctly.

How detection works

A recognized scanner runs with continue-on-error or shell failure suppression.

What is inspected

  • workflow steps invoking a recognized vulnerability scanner

Limits

  • choosing vulnerability policy
  • calling vulnerability alert APIs

How to fix it

Remove failure suppression from the vulnerability scanning gate.

  1. Let the scanner's nonzero exit status fail its workflow job.

Verify

  • Run repo-lint again and confirm the rule passes.