From a50b54c5c9e446fc4f7ed0000a5817e3d622d77c Mon Sep 17 00:00:00 2001
From: "Lukas.Kuzavas" <lukas.kuzavas@genesis.global>
Date: Tue, 21 Jul 2026 14:24:50 +0100
Subject: [PATCH] fix: repair corrupted security scan action YAML (DCD-5066)

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 build-image/action.yaml                    |  2 +-
 build-image/jfrog-scanning/action.yaml     | 19 ++------
 build-image/trivy-scanning/action.yaml     | 52 ++++++++++------------
 build-image/upload-sast-report/action.yaml | 21 ++++-----
 4 files changed, 37 insertions(+), 57 deletions(-)

diff --git a/build-image/action.yaml b/build-image/action.yaml
index 6ac2ffd1..1ffa08cc 100644
--- a/build-image/action.yaml
+++ b/build-image/action.yaml
@@ -131,7 +131,7 @@ runs:
       with:
         aws-access-key-id: ${{ inputs.aws-access-key-id }}
         aws-secret-access-key: ${{ inputs.aws-secret-access-key }}
-        aws-region: eu-west-2
+        aws-region: ${{ inputs.region }}
 
     - name: Log into ECR
       if: inputs.push-image == 'true'
diff --git a/build-image/jfrog-scanning/action.yaml b/build-image/jfrog-scanning/action.yaml
index 327601fc..5473b684 100644
--- a/build-image/jfrog-scanning/action.yaml
+++ b/build-image/jfrog-scanning/action.yaml
@@ -144,15 +144,7 @@ runs:
       shell: bash
       working-directory: ${{ inputs.working-directory }}/${{ inputs.server-path }}
       run: |
-    - name: Run the JFrog scan
-      id: scan
-      if: steps.check_dist.outputs.dist_exists == 'true' || steps.check_task.outputs.appDistZip == 'true'
-      shell: bash
-      working-directory: ${{ inputs.working-directory }}/${{ inputs.server-path }}
-      run: |
-        set -euo pipefail
-
-        FULL_REPORT="${{ steps.report_paths.outputs.full_report_file }}"
+        set -uo pipefail
 
         FULL_REPORT="${{ steps.report_paths.outputs.full_report_file }}"
         TABLE_REPORT="${{ steps.report_paths.outputs.table_report_file }}"
@@ -235,8 +227,7 @@ runs:
     - name: Create markdown summary
       if: always() && steps.scan.outputs.scan_exit_code == '0'
       uses: genesislcap/appdev-workflows/build-image/json-to-md@develop
-    - name: Upload JFrog full scan report
-      if: always() && steps.scan.outcome != 'skipped'
+      with:
         json_path: ${{ steps.report_paths.outputs.full_report_file }}
 
     - name: Upload JFrog full scan report
@@ -244,8 +235,7 @@ runs:
       uses: actions/upload-artifact@v4
       with:
         name: xray-full-report-${{ inputs.app-name }}-${{ github.run_number }}
-    - name: Upload JFrog scan table report
-      if: always() && steps.scan.outcome != 'skipped'
+        path: ${{ steps.report_paths.outputs.full_report_file }}
         if-no-files-found: warn
 
     - name: Upload JFrog scan table report
@@ -253,8 +243,7 @@ runs:
       uses: actions/upload-artifact@v4
       with:
         name: xray-dependencies-scan-${{ inputs.app-name }}-${{ github.run_number }}
-    - name: Evaluate JFrog vulnerability threshold
-      if: always() && steps.scan.outcome != 'skipped'
+        path: ${{ steps.report_paths.outputs.table_report_file }}
         if-no-files-found: warn
 
     - name: Evaluate JFrog vulnerability threshold
diff --git a/build-image/trivy-scanning/action.yaml b/build-image/trivy-scanning/action.yaml
index 1993ec6f..ace2a0fe 100644
--- a/build-image/trivy-scanning/action.yaml
+++ b/build-image/trivy-scanning/action.yaml
@@ -104,13 +104,7 @@ runs:
       shell: bash
       run: |
         set -uo pipefail
-    - name: Run Trivy scan
-      id: scan
-      shell: bash
-      run: |
-        set -euo pipefail
 
-        TRIVY_BIN="$RUNNER_TEMP/trivy-bin/trivy"
         TRIVY_BIN="$RUNNER_TEMP/trivy-bin/trivy"
         JSON_FILE="${{ steps.meta.outputs.json_file }}"
         HTML_FILE="${{ steps.meta.outputs.html_file }}"
@@ -138,14 +132,14 @@ runs:
 
         if [ ! -s "$JSON_FILE" ]; then
           cat > "$JSON_FILE" <<EOF
-{
-  "SchemaVersion": 2,
-  "ArtifactName": "$IMAGE_REF",
-  "ArtifactType": "container_image",
-  "Results": [],
-  "ScanError": "Trivy scan failed with exit code $TRIVY_EXIT_CODE"
-}
-EOF
+        {
+          "SchemaVersion": 2,
+          "ArtifactName": "$IMAGE_REF",
+          "ArtifactType": "container_image",
+          "Results": [],
+          "ScanError": "Trivy scan failed with exit code $TRIVY_EXIT_CODE"
+        }
+        EOF
         fi
 
         set +e
@@ -154,23 +148,25 @@ EOF
           "$HTML_FILE"
         HTML_EXIT_CODE=$?
         set -e
+
         if [ "$HTML_EXIT_CODE" -ne 0 ] || [ ! -s "$HTML_FILE" ]; then
           cat > "$HTML_FILE" <<EOF
-<!doctype html>
-<html>
-  <head>
-    <meta charset="utf-8">
-    <title>Trivy scan report</title>
-  </head>
-  <body>
-    <h1>Trivy scan report</h1>
-    <p>Image: $IMAGE_REF</p>
-    <p>HTML report generation failed.</p>
-    <p>See the JSON artifact for complete scan output.</p>
-  </body>
-</html>
-EOF
+        <!doctype html>
+        <html>
+          <head>
+            <meta charset="utf-8">
+            <title>Trivy scan report</title>
+          </head>
+          <body>
+            <h1>Trivy scan report</h1>
+            <p>Image: $IMAGE_REF</p>
+            <p>HTML report generation failed.</p>
+            <p>See the JSON artifact for complete scan output.</p>
+          </body>
+        </html>
+        EOF
         fi
+
         exit 0
 
     - name: Create markdown summary
diff --git a/build-image/upload-sast-report/action.yaml b/build-image/upload-sast-report/action.yaml
index c8481c2f..ce57fff9 100644
--- a/build-image/upload-sast-report/action.yaml
+++ b/build-image/upload-sast-report/action.yaml
@@ -42,17 +42,10 @@ runs:
 
         echo "$PWD/bin" >> "$GITHUB_PATH"
 
-    - name: Run SAST security scan
-      id: sast_scan
     - name: Run SAST security scan
       id: sast_scan
       working-directory: ${{ inputs.working-directory }}
       shell: bash
-      run: |
-        set -euo pipefail
-
-        REPORT_PATH="${{ steps.report.outputs.report_file }}"
-      shell: bash
       run: |
         set -uo pipefail
 
@@ -77,14 +70,16 @@ runs:
 
         if [ ! -s "$REPORT_PATH" ]; then
           cat > "$REPORT_PATH" <<EOF
-{
-  "\$schema": "https://json.schemastore.org/sarif-2.1.0.json",
-  "version": "2.1.0",
-  "runs": []
-}
-EOF
+        {
+          "\$schema": "https://json.schemastore.org/sarif-2.1.0.json",
+          "version": "2.1.0",
+          "runs": []
+        }
+        EOF
         fi
 
+        exit 0
+
     - name: Upload SAST security report
       if: always()
       uses: actions/upload-artifact@v4