feat: add flag to suppress "no package sources found" error #1943
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
308ad89 to
fac7d0f
Compare
e566d08 to
27e8db6
Compare
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #1943 +/- ##
==========================================
- Coverage 65.58% 65.57% -0.02%
==========================================
Files 167 167
Lines 16060 16071 +11
==========================================
+ Hits 10533 10538 +5
- Misses 4861 4868 +7
+ Partials 666 665 -1 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
hogo6002
approved these changes
Jun 13, 2025
f70035c to
ecb8c7e
Compare
ecb8c7e to
f4067f3
Compare
Collaborator
Author
|
@another-rex this is failing CI - I was still trying to sort the test suite out |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Currently we always consider it an error if the scanner does not find any supported files to scan as we assume in most cases it's expected the scanner will be check something and this avoids thinking that there are no vulnerabilities.
While this is a reasonable assumption for the default behaviour, it's annoying for enterprise types that want to use the GitHub Actions action as a required "always on" action for every repository regardless of what they actually hold - to workaround this currently the action eats the 128 exit code, but that's not ideal as it introduces the risk we're trying to avoid by having the error in the first place.
To give more flexibility, I've introduced a new flag to the scanner so that users can explicitly signal they don't want "no lockfiles being found" to be treated as an error, and in turn letting us deprecate our existing exit code overriding workaround in the GHA action in favor of having this flag passed in