feat(workload): print the compliance score on successful scans, not only in threshold failures
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 72/100
Research direction
Start at the workload scan command and trace the existing compliance-threshold failure output. Add coverage for both successful and failing scans, with and without --compliance-threshold, and verify that each scan ends with the per-framework or aggregate compliance score.
Written by the indexing model from the issue text.
Description
🤖 Generated by the Daily AI Engineer
Problem
ksail workload scan --compliance-threshold <n> prints the measured compliance score only when the gate fails (security scan failed: compliance score 94.99% is below threshold 100.00%). On a passing run the score is not printed at all — neither in the summary tables nor as a closing line.
This makes threshold ratcheting needlessly awkward in CI: the score is environment-dependent (documented in devantler-tech/platform AGENTS.md — the same binary/manifests score differently on Linux runners vs macOS), so operators must learn the CI-side score to place the floor. Today the only way is to push a deliberate threshold-100 failing run and read the error (exactly what platform#2584 had to do). It also hides gradual posture drift: a repo can decay from 99% to 86% with a floor of 85 and no run output ever shows it.
Proposed direction
Always print one line with the per-framework (or aggregate) compliance score at the end of the scan — on success and failure alike, e.g. ✔ compliance score 98.87% (threshold 85.00%). No new flag needed; it is a pure output addition. Cover both states in tests (with/without --compliance-threshold).
Rough size
S.
- Dominant language
- Go
- Stars
- 165
- Forks
- 13
- Avg merge
- 4h 17m
- Merged PRs (30d)
- 362
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from devantler-tech/ksail
-
dependencies go
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
devantler-tech/ksail#7135 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
devantler-tech/ksail#6977 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
devantler-tech/ksail#6975 ·
-
fix(webui): unmanaged clusters with URL-unsafe context names (EKS ARNs) 404 from every web request Openbug
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
devantler-tech/ksail#6908 ·
-
Opt ci-go's workflow_call arm out of signed auto-fixes so it does not race the org-required signer Open
Difficulty 1/5 Under an hour Newbie friendliness 88/100
devantler-tech/ksail#6863 ·
All issues in devantler-tech/ksail
Similar issues
-
Difficulty 1/5 Under an hour Newbie friendliness 84/100
-
enhancement needs triage
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
kind/cleanup
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
kubernetes-sigs/kueue#15947 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
sympozium-ai/sympozium#627 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100