Skip to content

Security Scanning #2443

Security Scanning

Security Scanning #2443

Triggered via schedule July 20, 2026 03:06
Status Success
Total duration 8m 19s
Artifacts 5

security-scan.yml

on: schedule
Static Application Security Testing
2m 49s
Static Application Security Testing
Dependency Vulnerability Scan
7m 13s
Dependency Vulnerability Scan
Container Security Scan
2m 7s
Container Security Scan
Infrastructure Security Scan
4m 50s
Infrastructure Security Scan
Secret Scanning
1m 14s
Secret Scanning
License Compliance Scan
2m 5s
License Compliance Scan
Security Policy Compliance
41s
Security Policy Compliance
Security Report
58s
Security Report
Fit to window
Zoom out
Zoom in

Annotations

19 errors and 25 warnings
Security Policy Compliance
Process completed with exit code 1.
Secret Scanning
Process completed with exit code 2.
Secret Scanning
Process completed with exit code 1.
Secret Scanning
BASE and HEAD commits are the same. TruffleHog won't scan anything. Please see documentation (https://github.com/trufflesecurity/trufflehog#octocat-trufflehog-github-action).
Container Security Scan
Path does not exist: scout-results.sarif
Container Security Scan
could not authenticate: user githubactions not entitled to use Docker Scout
Container Security Scan
Invalid SARIF. JSON syntax error: Unexpected end of JSON input
Container Security Scan
grype had a non-zero exit status when running
Container Security Scan
Path does not exist: trivy-results.sarif
Container Security Scan
Process completed with exit code 1.
Container Security Scan
buildx failed with: ERROR: failed to build: failed to solve: failed to read dockerfile: open Dockerfile: no such file or directory
Static Application Security Testing
Path does not exist: bandit-results.sarif
Static Application Security Testing
Process completed with exit code 2.
Infrastructure Security Scan
KICS scan failed with exit code 60
Infrastructure Security Scan
Path does not exist: checkov-results.sarif
Dependency Vulnerability Scan
Path does not exist: snyk-results.sarif
Dependency Vulnerability Scan
Process completed with exit code 1.
Dependency Vulnerability Scan
Process completed with exit code 2.
Security Report
Unable to download artifact(s): Unable to download and extract artifact: Artifact download failed after 5 retries.
Security Policy Compliance
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Secret Scanning
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, gitleaks/gitleaks-action@v2. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Secret Scanning
🛑 Leaks detected, see job summary for details
License Compliance Scan
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Container Security Scan
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, docker/setup-buildx-action@v3, github/codeql-action/upload-sarif@v3. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Container Security Scan
CodeQL Action v3 will be deprecated in December 2026. Please update all occurrences of the CodeQL Action in your workflow files to v4. For more information, see https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/
Static Application Security Testing
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, github/codeql-action/upload-sarif@v3. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Static Application Security Testing
CodeQL Action v3 will be deprecated in December 2026. Please update all occurrences of the CodeQL Action in your workflow files to v4. For more information, see https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/
Infrastructure Security Scan
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, github/codeql-action/upload-sarif@v3. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
[HIGH] Missing User Instruction: vendor/ruvector/scripts/training/Dockerfile#L6
Always set a user in the runtime stage of your Dockerfile. Without it, the container defaults to root, even if earlier build stages define a user.
[HIGH] Missing User Instruction: vendor/ruvector/examples/ruvLLM/esp32-flash/Dockerfile#L9
Always set a user in the runtime stage of your Dockerfile. Without it, the container defaults to root, even if earlier build stages define a user.
[HIGH] Missing User Instruction: vendor/ruvector/crates/mcp-brain-server/Dockerfile#L92
Always set a user in the runtime stage of your Dockerfile. Without it, the container defaults to root, even if earlier build stages define a user.
[HIGH] Missing User Instruction: vendor/ruvector/examples/edge-net/dashboard/Dockerfile#L19
Always set a user in the runtime stage of your Dockerfile. Without it, the container defaults to root, even if earlier build stages define a user.
[HIGH] Missing User Instruction: vendor/ruvector/tests/integration/distributed/Dockerfile#L22
Always set a user in the runtime stage of your Dockerfile. Without it, the container defaults to root, even if earlier build stages define a user.
[HIGH] Missing User Instruction: vendor/ruvector/crates/ruvector-postgres/Dockerfile#L149
Always set a user in the runtime stage of your Dockerfile. Without it, the container defaults to root, even if earlier build stages define a user.
[HIGH] Missing User Instruction: vendor/ruvector/ui/ruvocal/Dockerfile#L79
Always set a user in the runtime stage of your Dockerfile. Without it, the container defaults to root, even if earlier build stages define a user.
[HIGH] Missing User Instruction: vendor/ruvector/tests/docker-integration/Dockerfile#L2
Always set a user in the runtime stage of your Dockerfile. Without it, the container defaults to root, even if earlier build stages define a user.
[HIGH] Global Security Field Is Undefined (v3): vendor/ruvector/examples/exo-ai-2025/docs/OPENAPI.yaml#L1
Global security field should be defined to prevent API to have insecure paths and have this rules defined on securitySchemes
Infrastructure Security Scan
CodeQL Action v3 will be deprecated in December 2026. Please update all occurrences of the CodeQL Action in your workflow files to v4. For more information, see https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/
Infrastructure Security Scan
The `set-output` command is deprecated and will be disabled soon. Please upgrade to using Environment Files. For more information see: https://github.blog/changelog/2022-10-11-github-actions-deprecating-save-state-and-set-output-commands/
Infrastructure Security Scan
Unexpected input(s) 'output_file_path', valid inputs are ['entryPoint', 'args', 'directory', 'check', 'skip_check', 'quiet', 'api-key', 'soft_fail', 'framework', 'external_checks_dirs', 'external_checks_repos', 'output_format', 'download_external_modules', 'log_level', 'config_file', 'baseline', 'soft_fail_on', 'hard_fail_on', 'container_user']
Dependency Vulnerability Scan
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/upload-artifact@v4, github/codeql-action/upload-sarif@v3. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Dependency Vulnerability Scan
CodeQL Action v3 will be deprecated in December 2026. Please update all occurrences of the CodeQL Action in your workflow files to v4. For more information, see https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/
Security Report
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/download-artifact@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Artifacts

Produced during runtime
Name Size Digest
gitleaks-results.sarif
12.8 KB
sha256:adef4661b663e39593b16f0140446bd908171c5425f8fe24a1a81c79228d09e8
license-report
1.8 KB
sha256:631965ca565379eb7c49ed6e037de3ba0b0e6c36ebdc5434ca6fd3d427e93c18
ruvnet~RuView~JNEZN8.dockerbuild
6.81 KB
sha256:cd3c1bddddc1d3e983f5bbfe818ef0e070ff65baac28b4cf72b05eb4e5acca7f
security-summary
298 Bytes
sha256:d9ec3cec821ca0935f25de4ce3eeafc86b3f618c33d74e74b52bb4864e20d74f
vulnerability-reports
2.24 KB
sha256:c2764ef0b37787953e65d5a00f98af803e9f36955e46c2b71771343ceaf50be4