hardening(ruvector): L2 from PR #435 review — overflow on >u16::MAX dims #808
ruvnetsecurity-scan.yml
on: push
Static Application Security Testing
1m 37s
Dependency Vulnerability Scan
4m 2s
Container Security Scan
22s
Infrastructure Security Scan
1m 32s
Secret Scanning
51s
License Compliance Scan
1m 40s
Security Policy Compliance
5s
Security Report
6s
Annotations
25 errors and 24 warnings
|
Security Policy Compliance
Process completed with exit code 1.
|
|
Container Security Scan
Path does not exist: scout-results.sarif
|
|
Container Security Scan
could not authenticate: user githubactions not entitled to use Docker Scout
|
|
Container Security Scan
Input required and not supplied: sarif_file
|
|
Container Security Scan
Path does not exist: trivy-results.sarif
|
|
Container Security Scan
buildx failed with: ERROR: failed to build: failed to solve: failed to read dockerfile: open Dockerfile: no such file or directory
|
|
Secret Scanning
Process completed with exit code 2.
|
|
Infrastructure Security Scan
KICS scan failed with exit code 50
|
|
Infrastructure Security Scan:
logging/fluentd-config.yml#L452
CKV_K8S_28: "Minimize the admission of containers with the NET_RAW capability"
|
|
Infrastructure Security Scan:
logging/fluentd-config.yml#L452
CKV_K8S_15: "Image Pull Policy should be Always"
|
|
Infrastructure Security Scan:
logging/fluentd-config.yml#L452
CKV_K8S_40: "Containers should run as a high UID to avoid host conflict"
|
|
Infrastructure Security Scan:
logging/fluentd-config.yml#L452
CKV_K8S_29: "Apply security context to your pods and containers"
|
|
Infrastructure Security Scan:
logging/fluentd-config.yml#L452
CKV_K8S_38: "Ensure that Service Account Tokens are only mounted where necessary"
|
|
Infrastructure Security Scan:
logging/fluentd-config.yml#L452
CKV_K8S_20: "Containers should not run with allowPrivilegeEscalation"
|
|
Infrastructure Security Scan:
logging/fluentd-config.yml#L452
CKV_K8S_22: "Use read-only filesystem for containers where possible"
|
|
Infrastructure Security Scan:
logging/fluentd-config.yml#L452
CKV_K8S_43: "Image should use digest"
|
|
Infrastructure Security Scan:
logging/fluentd-config.yml#L452
CKV_K8S_30: "Apply security context to your containers"
|
|
Infrastructure Security Scan:
logging/fluentd-config.yml#L452
CKV_K8S_31: "Ensure that the seccomp profile is set to docker/default or runtime/default"
|
|
Static Application Security Testing
Path does not exist: semgrep.sarif
|
|
Static Application Security Testing
Path does not exist: bandit-results.sarif
|
|
Static Application Security Testing
Process completed with exit code 2.
|
|
Dependency Vulnerability Scan
Path does not exist: snyk-results.sarif
|
|
Dependency Vulnerability Scan
Process completed with exit code 1.
|
|
Dependency Vulnerability Scan
Process completed with exit code 2.
|
|
Security Report
Unhandled error: HttpError: Resource not accessible by integration
|
|
Security Policy Compliance
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/checkout@v4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
Container Security Scan
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/checkout@v4, docker/build-push-action@v5, docker/setup-buildx-action@v3, github/codeql-action/upload-sarif@v3. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
Container Security Scan
CodeQL Action v3 will be deprecated in December 2026. Please update all occurrences of the CodeQL Action in your workflow files to v4. For more information, see https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/
|
|
Secret Scanning
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/checkout@v4, gitleaks/gitleaks-action@v2. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
Infrastructure Security Scan
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/checkout@v4, github/codeql-action/upload-sarif@v3. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
[MEDIUM] Container Running As Root:
logging/fluentd-config.yml#L481
Containers should only run as non-root user. This limits the exploitability of security misconfigurations and restricts an attacker's possibilities in case of compromise
|
|
[MEDIUM] Container Capabilities Unrestricted:
docker/docker-compose.yml#L4
Some capabilities are not needed in certain (or any) containers. Make sure that you only add capabilities that your container needs. Drop unnecessary capabilities as well.
|
|
[MEDIUM] Container Capabilities Unrestricted:
docker/docker-compose.yml#L29
Some capabilities are not needed in certain (or any) containers. Make sure that you only add capabilities that your container needs. Drop unnecessary capabilities as well.
|
|
[HIGH] Workload Mounting With Sensitive OS Directory:
logging/fluentd-config.yml#L544
Workload is mounting a volume with sensitive OS Directory
|
|
[HIGH] Workload Mounting With Sensitive OS Directory:
logging/fluentd-config.yml#L541
Workload is mounting a volume with sensitive OS Directory
|
|
[HIGH] Workload Mounting With Sensitive OS Directory:
logging/fluentd-config.yml#L550
Workload is mounting a volume with sensitive OS Directory
|
|
[HIGH] Privilege Escalation Allowed:
logging/fluentd-config.yml#L481
Containers should not run with allowPrivilegeEscalation in order to prevent them from gaining more privileges than their parent process
|
|
[HIGH] Passwords And Secrets - Password in URL:
.github/workflows/ci.yml#L148
Query to find passwords and secrets in infrastructure code.
|
|
[HIGH] Passwords And Secrets - Password in URL:
.github/workflows/ci.yml#L140
Query to find passwords and secrets in infrastructure code.
|
|
[HIGH] Passwords And Secrets - Generic Password:
.github/workflows/ci.yml#L102
Query to find passwords and secrets in infrastructure code.
|
|
Infrastructure Security Scan
The `set-output` command is deprecated and will be disabled soon. Please upgrade to using Environment Files. For more information see: https://github.blog/changelog/2022-10-11-github-actions-deprecating-save-state-and-set-output-commands/
|
|
Infrastructure Security Scan
The `set-output` command is deprecated and will be disabled soon. Please upgrade to using Environment Files. For more information see: https://github.blog/changelog/2022-10-11-github-actions-deprecating-save-state-and-set-output-commands/
|
|
Infrastructure Security Scan
CodeQL Action v3 will be deprecated in December 2026. Please update all occurrences of the CodeQL Action in your workflow files to v4. For more information, see https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/
|
|
Static Application Security Testing
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/checkout@v4, actions/setup-python@v5, github/codeql-action/upload-sarif@v3. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
Static Application Security Testing
CodeQL Action v3 will be deprecated in December 2026. Please update all occurrences of the CodeQL Action in your workflow files to v4. For more information, see https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/
|
|
License Compliance Scan
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/checkout@v4, actions/setup-python@v5, actions/upload-artifact@v4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
Dependency Vulnerability Scan
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/checkout@v4, actions/setup-python@v5, actions/upload-artifact@v4, github/codeql-action/upload-sarif@v3. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
Dependency Vulnerability Scan
CodeQL Action v3 will be deprecated in December 2026. Please update all occurrences of the CodeQL Action in your workflow files to v4. For more information, see https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/
|
|
Security Report
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/download-artifact@v4, actions/github-script@v6, actions/upload-artifact@v4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
Artifacts
Produced during runtime
| Name | Size | Digest | |
|---|---|---|---|
|
gitleaks-results.sarif
|
6.6 KB |
sha256:6c4274967429e6ad61681574381fdd354948a1d567e6a6449f1ad8f7af254371
|
|
|
license-report
|
1.73 KB |
sha256:2029961bad6592357189e1cd1ca8500ef8d60930ecb5447ddd2c539e781012ca
|
|
|
security-summary
|
305 Bytes |
sha256:948cecff1be27fbc2dc0235575307886063db556ebc9817fe1a21d1950126626
|
|
|
vulnerability-reports
|
1.79 KB |
sha256:2b48bedd5fa5e058d2eeaaa9c3569e88559fa174f2d7900193f0f6596c9a5e26
|
|