Instance Scan always a Success, irrespective of the number of findings it generated.

[ramyaramdasan]

Hi,

The instance-scan step added to the pipeline is always a success. Is there an option to control the workflow based on the number of findings generated by the scan? If zero findings, move to next step, if there findings, fail the workflow.

Thanks
Ramya

[chiarng]

Hi Ramya,
Ultimately this boils down to a misunderstanding I had with the Instance Scan feature, and I should have caught it. We need to hit the Progress API endpoint to return the success/fail of the Scan itself, instead of the success/fail response of the request to trigger the Instance Scan (which is generally going to be success unless you asked for a nonexistent scan or instance). I don't quite have the budget confirmed to address this fix yet, but I'll start looking for it.
Thanks,
Chiarng

[chiarng]

@ramyaramdasan After inquiring with the dev who implemented, and then personally testing with the API and the GitHub Action, I have to retract my earlier statement. The GitHub Action and APIs are behaving as designed, that is the finding count is not directly reported via the progress API response when there are findings, and doesn't impact the status_label being Successful value or not. I'm following up with the Instance Scan team to better understand how their feature is expected to be used, and why the current design of the API is the way it is. Please help me forward this update to Sharath as well. Thanks!