From 1015dd28c78cac9b11a0387b40ee28b722a9aabe Mon Sep 17 00:00:00 2001 From: Martin Vogel Date: Wed, 8 Jul 2026 15:39:18 +0200 Subject: [PATCH] ci(smoke): fail soft when the Windows Defender scan engine can't run The Defender step treated any non-zero MpCmdRun exit as 'flagged binary!' and failed the job. But MpCmdRun -Scan returns 2 for a real detection and 0 for clean; any other non-zero means the scan engine itself could not run (e.g. hr=0x800106ba: the Defender antimalware service is unavailable on the runner), which is a transient runner-side flake, not a detection. This false-failed the v0.9.0 release on its first attempt. Only exit 2 now hard- blocks; an engine failure emits a warning and continues. Signed-off-by: Martin Vogel --- .github/workflows/_smoke.yml | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/.github/workflows/_smoke.yml b/.github/workflows/_smoke.yml index 67e022280..97b2e5802 100644 --- a/.github/workflows/_smoke.yml +++ b/.github/workflows/_smoke.yml @@ -248,9 +248,20 @@ jobs: run: | & "C:\Program Files\Windows Defender\MpCmdRun.exe" -SignatureUpdate 2>$null $result = & "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "$PWD\codebase-memory-mcp.exe" -DisableRemediation + $code = $LASTEXITCODE Write-Host $result - if ($LASTEXITCODE -ne 0) { Write-Host "BLOCKED: Windows Defender flagged binary!"; exit 1 } - Write-Host "=== Windows Defender: clean ===" + # MpCmdRun -Scan exit codes: 0 = clean, 2 = threat found. Any OTHER non-zero + # means the scan engine could not run at all (e.g. hr=0x800106ba: the Defender + # antimalware service is unavailable on the runner) — that is NOT a detection. + # Fail soft on an engine failure so a transient runner-side AV outage can't + # false-fail a release; only a real detection (exit 2) hard-blocks. + if ($code -eq 2) { + Write-Host "BLOCKED: Windows Defender flagged binary!"; exit 1 + } elseif ($code -ne 0) { + Write-Host "::warning::Windows Defender scan could not run (exit $code) - skipping AV gate on this runner" + } else { + Write-Host "=== Windows Defender: clean ===" + } smoke-linux-portable: needs: setup-matrix