From 9e771c4fc13b9805893ea04c560c63a451a852e3 Mon Sep 17 00:00:00 2001
From: Lukasz <CommanderK5@users.noreply.github.com>
Date: Wed, 15 Apr 2026 15:31:33 +0200
Subject: [PATCH] ci: keep OSV findings from failing security job (#24378)

OSV-Scanner currently causes the scheduled security workflow to fail
whenever it reports findings, which also triggers the Slack failure
notification.

Treat exit code 1 as a successful scan with uploaded SARIF results, and
only fail the job when OSV-Scanner itself errors.
---
 .github/workflows/security.yaml | 23 ++++++++++++++++++-----
 1 file changed, 18 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/security.yaml b/.github/workflows/security.yaml
index 0b34994cc3..4d27280eed 100644
--- a/.github/workflows/security.yaml
+++ b/.github/workflows/security.yaml
@@ -89,13 +89,30 @@ jobs:
 
       - name: Run OSV-Scanner vulnerability scanner
         id: scan
-        continue-on-error: true
         env:
           IMAGE_REF: ghcr.io/coder/coder:latest
         run: |
+          set +e
           osv-scanner scan image "$IMAGE_REF" \
             --format sarif \
             --output-file osv-results.sarif
+          scan_exit_code=$?
+          set -e
+
+          echo "exit_code=${scan_exit_code}" >> "${GITHUB_OUTPUT}"
+
+          if [[ "${scan_exit_code}" -eq 0 ]]; then
+            exit 0
+          fi
+
+          if [[ "${scan_exit_code}" -eq 1 ]]; then
+            echo "OSV-Scanner found vulnerabilities in ${IMAGE_REF}."
+            echo "Results will be uploaded to GitHub Security and as a SARIF artifact."
+            exit 0
+          fi
+
+          echo "::error::OSV-Scanner failed with exit code ${scan_exit_code}"
+          exit "${scan_exit_code}"
 
       - name: Upload OSV-Scanner scan results to GitHub Security tab
         if: ${{ always() && hashFiles('osv-results.sarif') != '' }}
@@ -112,10 +129,6 @@ jobs:
           path: osv-results.sarif
           retention-days: 7
 
-      - name: Fail if OSV-Scanner found vulnerabilities
-        if: ${{ steps.scan.outcome == 'failure' }}
-        run: exit 1
-
       - name: Send Slack notification on failure
         if: ${{ failure() }}
         run: |