Repository navigation
fix(ci): the Kubescape guard accepts a reduced scan in a command substitution or behind && … || true #4163
Description
🤖 Generated by the Agentic Engineer (interactive Claude Code session)
Found by Spike #3564.
Evidence
Three spellings pass scripts/validate-kubescape-frameworks on main (35031dbb) while bash runs a reduced scan or hides a failing one. Each sits beside the real ksail workload scan --framework nsa,mitre --compliance-threshold 95 line, so the guard sees the full framework set and passes.
| # | Spelling | What bash does |
|---|---|---|
| G1 | echo "$(ksail workload scan --framework nsa)" |
runs an nsa-only scan |
| G2 | an unquoted heredoc (cat <<EOF) whose body is $(ksail workload scan --framework nsa) |
runs an nsa-only scan |
| G3 | ksail workload scan --framework nsa,mitre --compliance-threshold 95 && echo scanned || true |
exits 0 when the scan fails |
Each result was checked against bash, using a stand-in ksail that records its arguments and a second one that always fails.
Audience and problem
The guard gates every PR and merge-group run. A reduced scan can overwrite the uploaded SARIF while the full invocation satisfies the guard. A masked failure turns the compliance gate green whatever the score.
Direction
Spike #3564 chose to back the guard with mvdan.cc/sh/v3/syntax (delivery: #3579). The prototype on branch claude/spike-kubescape-parser-3564 (4e0c98a) refuses all three, with the existing tests unmodified. Land this with #3579 or right after it.
Acceptance criteria
- G1, G2 and G3 are refused, each by a test that fails on the current guard.
- Controls stay accepted:
echo "$(date)", a quoted heredoc containing$(date), and the real workflows. - Every existing test passes unmodified.
Rough size: S.
Generated by Claude Code
Metadata
Metadata
Assignees
Labels
Type
Fields
Priority
Effort
Projects
- Status
Activity
devantler commentedon Oct 2, 2026
The new automated finding is reproducible against
f5fb7015816affc5da560b19ab79a34ead3d9e06, which contains #4378. Beside a legitimate full-framework scan, closed command substitutions and an expanding heredoc can execute a reduced scan while the guard accepts the full framework set. An AND-list followed by a permissive fallback can also hide scan failure. Offline Bash checks with a recording stand-in confirmed execution and failure masking; no provider was called.The three acceptance families still need repair. An independent review of a narrow local implementation found unresolved multiline-argument, multiline-heredoc, escaped-backtick and pipeline cases, plus two false refusals of ordinary shell. That implementation was rejected before submission. The existing guard tests alone do not cover these cases; new reproductions are retained privately for the next implementation.
The planned parser delivery in #3579 remains the appropriate foundation. Its existing prototype demonstrates whole-script substitution discovery, but is not a current reviewed repair and cannot be promoted wholesale. This issue stays open; no fix, scanner clearance or production change is claimed.
chore: agent-claim #4163 nonce=8408e9d131dbc8cfa9a86ed32f2b6ad0
chore: agent-claim #4163 nonce=143d15c5bd51136f95e47af220dcc050
devantler commentedon Oct 3, 2026
Delivered by merged PR #4431, reviewed source commit 06d951f.
The shared parser regressions refuse G1, G2 and G3. The dedicated failure-propagation regression also checks G3 without a second invocation, and Bash witnesses verify the execution/status behavior. Ordinary substitutions, quoted heredoc data, and the real workflows remain accepted.
Acceptance was checked against the original issue body. The original historical test file is unchanged. All 266 test/subtest assertions passed with race detection, including 28 Bash recording witnesses; source CI and protected merge-queue CI passed. Closing as completed.