Repository navigation
Surface Kubescape posture findings in Code Scanning, not just an aggregate score gate #2829
Description
🤖 Generated by the Agentic Engineer
Why
The platform's static posture scan is a score gate, not a finding surface. ksail workload scan --framework nsa --compliance-threshold 95 fails a PR when the aggregate compliance score drops below the floor, and that is all a reviewer ever sees: a number, in a log, on a job that has already scrolled past.
Two consequences follow, and both are live today:
- A finding that does not move the score is invisible. Findings below the floor never surface anywhere a person looks, so they are never triaged and never enter the backlog. This is the structural gap the parent describes — the reason a posture problem can sit unnoticed for weeks.
- The log is the only record. There is no dedup, no history, no "this appeared in this PR", and no auto-close when a finding is fixed. Answering "what is failing right now, and since when" means reading a CI log by hand.
The repo is public and already uses GitHub Code Scanning for CodeQL and zizmor, so the surface that fixes all of this is already present and paid for — the posture scan simply does not feed it.
What
Emit the existing scan's findings as SARIF and upload them to GitHub Code Scanning, so each Kubescape control becomes a Security-tab alert with native fingerprint dedup, per-PR annotations, and auto-close when the finding is gone.
Deliberately additive: the compliance-threshold gate keeps its current behaviour and remains the merge gate. This slice changes what a human can see, not what blocks a merge — graduating findings into blocking enforcement is the parent's third slice, not this one.
Acceptance criteria
- The manifest scan produces SARIF alongside its existing gate result, and the SARIF is uploaded to Code Scanning.
- Findings appear in the repository's Security tab, attributed to the Kubescape scan and distinguishable from CodeQL and zizmor.
- The upload happens even when the posture gate fails — that is precisely when the findings are wanted.
- The threshold gate's pass/fail behaviour is unchanged; verified by exercising both outcomes.
- A fork PR, which cannot be granted
security-events: write, does not fail the build because of the upload.
Size
S — one workflow job change plus its permission, no new tooling: ksail workload scan already supports --format sarif.
Part of #2451
Activity
coderabbitai commentedon Jul 27, 2026
🔗 Related PRs
#2316 - fix(kubescape): make ClusterSecurityException posture exceptions take effect [merged]
#2319 - feat(security): cosign-verify the infrastructure Flux OCI artifact [merged]
#2434 - fix(kubescape): except GitOps-managed CronJobs from C-0026 posture control [merged]
#2443 - fix(kubescape): keep scheduled posture scans local so results persist [merged]
#2452 - fix(kubescape): bump posture scanner to v4.0.10 so exception CRs apply offline [merged]
📝 Issue Planner
Check the box below or use the
@coderabbitai plancommand to generate an implementation plan and prompts that you can use with your favorite coding assistant.🧪 Issue enrichment is currently in open beta.
You can configure auto-planning by selecting labels in the issue_enrichment configuration.
To disable automatic issue enrichment, add the following to your
.coderabbit.yaml:💬 Have feedback or questions? Drop into our discord!