fix(ci): bypass hardened entrypoint for image asset smoke test #2437
ruvnetsecurity-scan.yml
on: pull_request
Static Application Security Testing
3m 9s
Dependency Vulnerability Scan
6m 13s
Container Security Scan
0s
Infrastructure Security Scan
2m 15s
Secret Scanning
1m 7s
License Compliance Scan
2m 24s
Security Policy Compliance
27s
Security Report
4s
Annotations
9 errors and 22 warnings
|
Security Policy Compliance
Process completed with exit code 1.
|
|
Secret Scanning
Process completed with exit code 2.
|
|
Infrastructure Security Scan
KICS scan failed with exit code 60
|
|
Infrastructure Security Scan
Path does not exist: checkov-results.sarif
|
|
Static Application Security Testing
Path does not exist: bandit-results.sarif
|
|
Static Application Security Testing
Process completed with exit code 2.
|
|
Dependency Vulnerability Scan
Path does not exist: snyk-results.sarif
|
|
Dependency Vulnerability Scan
Process completed with exit code 1.
|
|
Dependency Vulnerability Scan
Process completed with exit code 2.
|
|
Security Policy Compliance
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
Secret Scanning
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, gitleaks/gitleaks-action@v2. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
Infrastructure Security Scan
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, github/codeql-action/upload-sarif@v3. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
[HIGH] Missing User Instruction:
vendor/ruvector/crates/ruvector-postgres/Dockerfile#L149
Always set a user in the runtime stage of your Dockerfile. Without it, the container defaults to root, even if earlier build stages define a user.
|
|
[HIGH] Missing User Instruction:
vendor/ruvector/tests/docker-integration/Dockerfile#L2
Always set a user in the runtime stage of your Dockerfile. Without it, the container defaults to root, even if earlier build stages define a user.
|
|
[HIGH] Missing User Instruction:
vendor/ruvector/tests/integration/distributed/Dockerfile#L22
Always set a user in the runtime stage of your Dockerfile. Without it, the container defaults to root, even if earlier build stages define a user.
|
|
[HIGH] Missing User Instruction:
vendor/ruvector/examples/vwm-viewer/Dockerfile#L1
Always set a user in the runtime stage of your Dockerfile. Without it, the container defaults to root, even if earlier build stages define a user.
|
|
[HIGH] Missing User Instruction:
vendor/ruvector/crates/mcp-brain-server/Dockerfile#L92
Always set a user in the runtime stage of your Dockerfile. Without it, the container defaults to root, even if earlier build stages define a user.
|
|
[HIGH] Missing User Instruction:
vendor/ruvector/examples/edge-net/dashboard/Dockerfile#L19
Always set a user in the runtime stage of your Dockerfile. Without it, the container defaults to root, even if earlier build stages define a user.
|
|
[HIGH] Missing User Instruction:
vendor/ruvector/ui/ruvocal/Dockerfile#L79
Always set a user in the runtime stage of your Dockerfile. Without it, the container defaults to root, even if earlier build stages define a user.
|
|
[HIGH] Missing User Instruction:
vendor/ruvector/crates/ruvector-postgres/docker/benchmark/Dockerfile#L14
Always set a user in the runtime stage of your Dockerfile. Without it, the container defaults to root, even if earlier build stages define a user.
|
|
[HIGH] Global Security Field Is Undefined (v3):
vendor/ruvector/examples/exo-ai-2025/docs/OPENAPI.yaml#L1
Global security field should be defined to prevent API to have insecure paths and have this rules defined on securitySchemes
|
|
[CRITICAL] SQL DB Instance Publicly Accessible:
vendor/ruvector/npm/packages/ruvbot/deploy/gcp/terraform/main.tf#L226
Cloud SQL instances should not be publicly accessible.
|
|
Infrastructure Security Scan
CodeQL Action v3 will be deprecated in December 2026. Please update all occurrences of the CodeQL Action in your workflow files to v4. For more information, see https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/
|
|
Infrastructure Security Scan
The `set-output` command is deprecated and will be disabled soon. Please upgrade to using Environment Files. For more information see: https://github.blog/changelog/2022-10-11-github-actions-deprecating-save-state-and-set-output-commands/
|
|
Infrastructure Security Scan
Unexpected input(s) 'output_file_path', valid inputs are ['entryPoint', 'args', 'directory', 'check', 'skip_check', 'quiet', 'api-key', 'soft_fail', 'framework', 'external_checks_dirs', 'external_checks_repos', 'output_format', 'download_external_modules', 'log_level', 'config_file', 'baseline', 'soft_fail_on', 'hard_fail_on', 'container_user']
|
|
License Compliance Scan
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
Static Application Security Testing
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, github/codeql-action/upload-sarif@v3. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
Static Application Security Testing
CodeQL Action v3 will be deprecated in December 2026. Please update all occurrences of the CodeQL Action in your workflow files to v4. For more information, see https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/
|
|
Dependency Vulnerability Scan
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/upload-artifact@v4, github/codeql-action/upload-sarif@v3. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
Dependency Vulnerability Scan
CodeQL Action v3 will be deprecated in December 2026. Please update all occurrences of the CodeQL Action in your workflow files to v4. For more information, see https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/
|
|
Security Report
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/download-artifact@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
Artifacts
Produced during runtime
| Name | Size | Digest | |
|---|---|---|---|
|
gitleaks-results.sarif
|
6.6 KB |
sha256:8435289ed83b9369b70b7c1d47dbd2955f03f1075511cd095b0c755e5a551f54
|
|
|
license-report
|
1.8 KB |
sha256:188f0a7c7e38a29cae0776075543bcf850deb6ba8f19f6664791b66ea488de0b
|
|
|
security-summary
|
304 Bytes |
sha256:aab9023d2347f9504b3ea6602aa932af404702205b0ae81ca9daee8c6f9fd514
|
|
|
vulnerability-reports
|
2.24 KB |
sha256:9af65a18e03087eca816bf3b1abb4b6f5c9bd59f4dae69a598b27c4d8bf3ac22
|
|