Repository navigation
Accept verified empty ECR scan results without severity counts - #41
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ECR can return a successfully completed scan with an explicit empty findings list and no optional
findingSeverityCountsmap. v2.0.0 rejects this clean-image response. Read-only ECR and Inspector inspection confirmed this response shape and successful coverage with zero active findings.Accept an omitted summary only when the response identifies the exact requested registry/repository/digest, includes explicitly empty findings lists, and has no remaining page. The existing completed-status, 24-hour freshness and MEDIUM/HIGH/CRITICAL/UNDEFINED gates remain in force. Missing evidence, nonempty findings without a summary, partial results and malformed counts fail closed. No IAM permission or scanning-configuration changes are required. See the AWS response schema.
Validation: 69 tests pass locally and inside the pinned CircleCI executor; regression cases cover empty basic/enhanced scans, missing/malformed evidence, wrong image identity, partial pagination, stale/future scans and prohibited severities. Shell syntax and diff checks pass. The new parser accepts the actual empty response; that existing image is older than 24 hours and remains ineligible for release. No image was pushed and no ECS deployment was performed during this fix.
Release follow-up: merge into master, publish a new patch release, then update the tag and verified commit in challenge-api-v6 PR #178 before its first dev deployment. The existing v2.0.0 tag is unchanged.