ci: ratchet the Kubescape scan threshold toward 100 via ksail workload scan --exceptions (#5369 shipped) #2264

🤖 Generated by the Daily AI Assistant

Context

The CI Kubescape gate (ksail workload scan --framework nsa --compliance-threshold 85 in .github/workflows/ci.yaml) sits below 100 partly because residual findings are runtime-enforced (Kyverno/Cilium) or genuinely unfixable — notably C-0002 (the KubeVirt operator's pods/exec RBAC, which can only be excepted). The platform already maintains ClusterSecurityException CRs for these in k8s/bases/infrastructure/security-exceptions/, but historically the ksail workload scan CLI couldn't consume them.

That blocker is now resolved upstream: native exceptions support shipped in devantler-tech/ksail#5369 (--exceptions / config).

Proposal

1. Wire the platform's exceptions into the CI scan step: ksail workload scan --framework nsa --exceptions <…> --compliance-threshold <new-floor> (confirm the exact input format the shipped flag expects — kubescape exceptions JSON vs. the ClusterSecurityException CRs in security-exceptions/; adapt/generate as needed).
2. Read the new stable CI score with exceptions applied (a few merge-queue / PR runs), then ratchet --compliance-threshold up to a floor a few points under it — toward 100 for the genuinely-excepted residual (C-0002 etc.).
3. Update AGENTS.md (the Validation "threshold" bullets) to reflect the exceptions wiring and the new floor.

Why this is separate from the pin-lift PR

The Kubescape compliance score is environment-dependent and not reproducible offline (documented in AGENTS.md: ≈87% on the Linux CI runner vs ≈94% locally), so the new stable floor can only be established by CI — it can't be validated in a draft locally. Keeping it out of the determinism-pin-lift PR keeps that change clean and CI-verifiable on its own.

Acceptance criteria

• CI scan step passes the platform's exceptions to ksail workload scan.
• --compliance-threshold raised to the new observed floor (the excepted residual no longer caps it).
• AGENTS.md threshold bullets updated and self-consistent.

Filed from a holistic platform↔ksail review (the same review that lifted the 7.65.0 determinism pin once #5371 was resolved).