Skip to content

fix: warn and suppress fail-on exit when fix mode is active in the Ac… #828

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sonukapoor merged 4 commits into from
Jul 14, 2026
Merged

fix: warn and suppress fail-on exit when fix mode is active in the Ac… #828

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
be1e0be
fix: warn and suppress fail-on exit when fix mode is active in the Ac…
coder-Yash886 Jul 11, 2026
1efb616
fix: only suppress exit 1 in fix mode, clarify fail-on warning
coder-Yash886 Jul 13, 2026
a30b241
Merge branch 'main' into fix/action-fail-on-fix-mode
coder-Yash886 Jul 13, 2026
e7b7f28
Merge branch 'main' into fix/action-fail-on-fix-mode
sonukapoor Jul 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 13 additions & 3 deletions action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -236,9 +236,14 @@ runs:
INPUT_CHECK_OVERRIDES: ${{ inputs.check-overrides }}
INPUT_AUDIT_LOG: ${{ inputs.audit-log }}
INPUT_REPORT: ${{ inputs.report }}
INPUT_FIX: ${{ inputs.fix }}
run: |
set -euo pipefail

if [[ "${INPUT_FIX}" == "true" && -n "${INPUT_FAIL_ON}" ]]; then
echo "::warning::fail-on is set with fix: true - job failure is suppressed so the fix step can run. Add a second scan step without fix: true if you want to gate on remaining findings after fixing."
fi

args=("${PROJECT_PATH}")

if [[ "${INPUT_ALL}" == "true" ]]; then
Expand Down Expand Up @@ -295,9 +300,14 @@ runs:
args+=("--report" "${INPUT_REPORT}" "--no-open")
fi

Comment thread
coder-Yash886 marked this conversation as resolved.
# set -e propagates the scan exit code, including exit 2 when a --fix
# verify pass fails, so the job fails the same way the CLI does.
cve-lite "${args[@]}"
if [[ "${INPUT_FIX}" == "true" ]]; then
cve-lite "${args[@]}" || EXIT_CODE=$?
if [[ "${EXIT_CODE:-0}" -gt 1 ]]; then
exit "${EXIT_CODE:-0}"
fi
else
cve-lite "${args[@]}"
fi

- name: Apply security fixes
if: ${{ inputs.fix == 'true' }}
Expand Down