From c645c9b96d3c32170d5ae2f4754e3897fe2aa6d0 Mon Sep 17 00:00:00 2001 From: Timothy Date: Tue, 27 Oct 2026 23:27:03 +0100 Subject: [PATCH] docs(931): a failing setup command's exit is its own status, and the Hosts row names no excluded host The exit list gave "any other code" to a set -e setup failure, but `docker pull` usually exits 1, which collides with the ZAP FAIL code; it now says such a failure exits with that command's own status. The jazz Hosts row said the scan runs "not [on] this one", which would stay wrong once jazz gets semgrep; it now says any docker host that meets the requirements. Co-Authored-By: Claude Opus 5.5 Claude-Session: f9ce6bc6-5b36-491a-8d72-89c1f70dd3e1 --- docs/ci-cd.md | 4 ++-- scripts/security-scan.sh | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/ci-cd.md b/docs/ci-cd.md index 8d516629d..b7b739057 100644 --- a/docs/ci-cd.md +++ b/docs/ci-cd.md @@ -9,7 +9,7 @@ server-management#481. | Host | IP | Role | |---|---|---| -| **jazz** | 192.168.1.29 | **Docker host for the media transcoders** — prod `ersatztv` (8409), `ersatztv-test` (8410), Jellyfin. The prod-copy `migration-smoke.sh` runs here. The release scan (`security-scan.sh`) boots its own throwaway target, so it needs a docker host that meets its requirements (Security scanning → Where/when), not this one. | +| **jazz** | 192.168.1.29 | **Docker host for the media transcoders** — prod `ersatztv` (8409), `ersatztv-test` (8410), Jellyfin. The prod-copy `migration-smoke.sh` runs here. The release scan (`security-scan.sh`) boots its own throwaway target from the registry, so it runs on any docker host that meets its requirements (Security scanning → Where/when). | | **bumblebee** | 192.168.1.99 | CI runners (`bumblebee-runner`, `small-runner`), plus every other Docker stack. All the memory/lane measurements below were taken here. | | **ci-runner** | VM 127 (pve4) | The other `ubuntu-latest` CI runner. | @@ -2682,7 +2682,7 @@ running product from outside our C#/review stack. tool error, or the throwaway target never came up or its key was unreadable; **2** — *not* ZAP's WARN — a scanner half did not run: semgrep missing (before the scan) or erroring (after it), or docker missing; if ZAP already classified non-zero, that status stands and the semgrep error prints beside - it; **any other** code is a setup command (e.g. `docker pull`) failing under `set -e`. Run + it. A setup command that fails under `set -e` (e.g. `docker pull`) exits with its own status. Run `scripts/security-scan.sh --selftest` for a docker-free regression check: it pins every ZAP classification, and runs the script itself with shimmed tools (ZAP reporting clean) to pin the semgrep gate — missing → exit 2 before docker is checked, erroring → 2, succeeding → 0 with semgrep diff --git a/scripts/security-scan.sh b/scripts/security-scan.sh index dd9f00c6a..2809ef1ae 100755 --- a/scripts/security-scan.sh +++ b/scripts/security-scan.sh @@ -39,7 +39,7 @@ # 2 NOT ZAP's WARN: a scanner half did not run — semgrep missing (checked before the scan) or erroring # (after it), or docker missing. If ZAP already classified non-zero, that status stands and the # semgrep error is printed alongside it. -# other a setup command failed under `set -e` (e.g. `docker pull`), exiting with that command's status +# A setup command that fails under `set -e` (e.g. `docker pull`) exits with that command's own status. set -euo pipefail