bug(ci): the Kubescape scan log reports "All controls passed" while the same run raises Code Scanning alerts #2846

🤖 Generated by the Agentic Engineer

Part of #2451. Follows #2829, which added the Kubescape SARIF → Code Scanning upload.

Evidence

Measured locally against main (ksail 7.x, k8s source dir, repo exceptions applied), running
exactly what CI runs:

ksail workload scan --framework nsa --exceptions <generated> --compliance-threshold 95 \
  --format sarif -o kubescape.sarif

• Console output: All controls passed. No issues found — exit 0.
• SARIF written by the same run: 4 findings on real, un-excepted manifests:
  • C-0034 (warning) ×3 — bases/infrastructure/vault-backup/{job,cron-job}.yaml, bases/infrastructure/vault-config/job.yaml
  • C-0017 (note) ×1 — bases/apps/umami/cron-job.yaml

I confirmed none of these are suppressed: no policy in the generated exceptions file
(21 policies) covers C-0034 or C-0017.

The printer is showing a filtered view, not an empty one. Re-running the same scan with
--exceptions removed produced 70 SARIF findings while the console table listed one
control (C-0013, 2 resources). So the console summary surfaces only a subset; the SARIF
carries the full set.

Problem

Since #2829, those SARIF findings become Code Scanning alerts — so the two surfaces now
disagree in a way they did not before:

• The CI log, which is what a developer reads on a PR, says All controls passed. No issues found.
• The Security tab shows alerts for the same run.

Anyone trusting the log concludes there is nothing to fix. Findings that do not move the
compliance score enough to breach the floor are invisible in CI entirely, which is precisely the
class #2829 was added to make visible. The gate is working correctly; the reporting around it is
what misleads.

Smallest useful change

After the scan step, derive a one-line summary from the SARIF the run just produced and print it
to the log and the job summary — count and per-control breakdown, plus a pointer to the Security
tab. No change to the gate, the threshold, or the upload.

Acceptance criteria

• A run producing N SARIF findings prints a summary naming N and the control IDs, even when the
  compliance gate passes and the Kubescape table prints All controls passed.
• A run producing zero findings says so explicitly.
• The compliance-threshold gate's pass/fail behaviour is unchanged.
• No change to what is uploaded to Code Scanning.

Size

S — one step in the validate job, reading a file the run already writes.

Note on scope

The filtered console table comes from Kubescape's own printer, which ksail forwards. This issue is
deliberately scoped to the platform's CI reporting rather than proposing an upstream printer
change — the summary we need is cheap to derive on our side and does not depend on upstream.