Skip to content

fix: treat score 0 as a successful scan exit #740

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
alexchen-sys wants to merge 2 commits into
base: master
Choose a base branch
from
Open

fix: treat score 0 as a successful scan exit #740

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
33938e8
fix: treat score 0 as a successful scan exit
alexchen-sys Jul 23, 2026
813930c
test: rename remaining score-0 CLI cases to scores 0
alexchen-sys Jul 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion cmd/scan.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -143,7 +143,8 @@ var scanCmd = &cobra.Command{

var lowScore bool
for _, r := range reports {
if r.Score <= 0 {
// Score 0 is a pass ("Passed with a score of 0 points"); only negative scores fail.
if r.Score < 0 {
lowScore = true
break
}
Expand Down
18 changes: 9 additions & 9 deletions test/1_cli.bats
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ teardown() {
assert_lt_zero_points
}

@test "fails with CAP_CHOWN" {
@test "passes with a score of 0 for CAP_CHOWN-only (no critical)" {
run _app "${TEST_DIR}/asset/score-0-cap-chown.yml"
assert_zero_points
}
Expand Down Expand Up @@ -45,12 +45,12 @@ teardown() {
assert_gt_zero_points
}

@test "fails deployment with pod securitycontext runAsUser 1" {
@test "scores 0 deployment with pod securitycontext runAsUser 1" {
run _app "${TEST_DIR}/asset/score-1-dep-podseccon-run-as-user-1.yml"
assert_zero_points
}

@test "fails deployment with securitycontext runAsUser 1" {
@test "scores 0 deployment with securitycontext runAsUser 1" {
run _app "${TEST_DIR}/asset/score-1-dep-seccon-run-as-user-1.yml"
assert_zero_points
}
Expand All @@ -65,12 +65,12 @@ teardown() {
assert_gt_zero_points
}

@test "fails deployment with pod securitycontext runAsGroup 1" {
@test "scores 0 deployment with pod securitycontext runAsGroup 1" {
run _app "${TEST_DIR}/asset/score-1-dep-podseccon-run-as-group-1.yml"
assert_zero_points
}

@test "fails deployment with securitycontext runAsGroup 1" {
@test "scores 0 deployment with securitycontext runAsGroup 1" {
run _app "${TEST_DIR}/asset/score-1-dep-seccon-run-as-group-1.yml"
assert_zero_points
}
Expand All @@ -85,7 +85,7 @@ teardown() {
assert_gt_zero_points
}

@test "fails deployment with empty security context" {
@test "scores 0 deployment with empty security context" {
run _app "${TEST_DIR}/asset/score-1-dep-empty-security-context.yml"
assert_zero_points
}
Expand Down Expand Up @@ -118,7 +118,7 @@ teardown() {
assert_gt_zero_points
}

@test "fails StatefulSet with no security" {
@test "scores 0 StatefulSet with no security" {
run _app "${TEST_DIR}/asset/score-0-statefulset-no-sec.yml"
assert_zero_points
}
Expand All @@ -133,7 +133,7 @@ teardown() {
assert_lt_zero_points
}

@test "fails Deployment with unconfined apparmor for all containers" {
@test "scores 0 Deployment with unconfined apparmor for all containers" {
run _app "${TEST_DIR}/asset/score-0-dep-apparmor-empty-securitycontext.yml"
assert_zero_points
}
Expand Down Expand Up @@ -178,7 +178,7 @@ teardown() {
assert_lt_zero_points
}

@test "fails Deployment with unconfined seccomp for all containers" {
@test "scores 0 Deployment with unconfined seccomp for all containers" {
run _app "${TEST_DIR}/asset/score-0-dep-seccomp-empty-securitycontext.yml"
assert_zero_points
}
Expand Down
3 changes: 2 additions & 1 deletion test/_helper.bash
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -106,7 +106,8 @@ else

assert_zero_points() {
assert_output --regexp ".*with a score of 0 points.*"
assert_failure
# Score 0 is a pass message; exit 0 (issue #580). Negative scores still assert_failure.
assert_success
}

assert_lt_zero_points() {
Expand Down