[devantler]

🤖 Generated by the Agentic Engineer

Why

The security score only covers the namespaces the scanner is allowed to look at. A namespace can be dropped from that set with a one-word edit, and nothing would say so: the score looks exactly as if the namespace were clean. That includes the scanner's own namespace.

What

Keeps a reviewed list of every namespace the scanner skips, each with the reason, and fails CI when the scanner's actual exclusions differ from that list in either direction. Leaving scan coverage now takes a visible, reviewed change with a written reason. What gets scanned is unchanged.

Fixes #3215

[devantler]

🤖 Generated by the Agentic Engineer

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-25T11:33:20.945783Z	f49eaa1	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5f6ab232f4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 7c888512-cd3d-458b-a852-c9333d72d53f

📥 Commits

Reviewing files that changed from the base of the PR and between 51fa8a6 and 2a935cc.

⛔ Files ignored due to path filters (1)

• scripts/kubescape-unscanned-namespaces.tsv is excluded by !**/*.tsv

📒 Files selected for processing (4)

• .github/workflows/ci.yaml
• k8s/bases/infrastructure/controllers/kubescape/helm-release.yaml
• scripts/guard-kubescape-scan-scope.sh
• scripts/tests/test-guard-kubescape-scan-scope.sh

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

🧰 Additional context used

🧠 Learnings (1)

📚 Learning: 2026-08-10T13:01:12.782Z

Learnt from: devantler
Repo: devantler-tech/platform PR: 3057
File: .github/workflows/ci.yaml:622-659
Timestamp: 2026-08-10T13:01:12.782Z
Learning: Repository shell tests and scripts must remain compatible with macOS Bash 3.2. Do not use Bash 4+ features such as `mapfile`; use portable constructs, such as a `while IFS= read -r` loop, instead.

Applied to files:

• scripts/tests/test-guard-kubescape-scan-scope.sh

🔇 Additional comments (3)

k8s/bases/infrastructure/controllers/kubescape/helm-release.yaml (1)

60-62: LGTM!

scripts/tests/test-guard-kubescape-scan-scope.sh (1)

1-263: LGTM!

.github/workflows/ci.yaml (1)

693-697: LGTM!

Also applies to: 1853-1864

---

📝 Walkthrough

Walkthrough

The change adds a guard that checks Kubescape’s configured excludeNamespaces against a reviewed TSV list with a reason for each namespace. It checks for scan-scope overrides in manifests and rendered provider layers. CI runs the guard and its tests when Kubernetes paths change. Comments in the base HelmRelease describe the relationship between its exclusions and the TSV list.

Priority: ➖ Normal

Severity of issue fixed: Medium

Merge Risk: ⚪ Minimal · up to 2a935

The identified bypass cannot change the deployed scan scope without being caught. No actionable merge-blocking issue remains after normal checks.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 2a935

The new check makes excluded namespaces subject to a documented review process without changing what Kubescape scans. Its effectiveness still depends on the CI check and repository review protections being enforced.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — A merged exclusion change could affect posture visibility for a namespace wherever the affected provider configuration deploys Kubescape. The new guard checks that repository-level change; it does not itself grant cluster authority or scan excluded workloads.

Trust Boundaries and Controls

• observed — PR-controlled Kubernetes manifests and reviewed rows enter CI validation. Alternate manifest setters and valuesFrom are rejected, while rendered provider releases must retain the base scope.

Resilience and Maintainability Implications

• observed — The test file includes cases for unreviewed exclusions, patches, valuesFrom, replacements, and missing provider rendering. Their presence supports the intended boundary but does not establish that required CI checks or live reconciliation are enforced.

Hardening Proposals

• proposed — Ensure the validation job is a required merge check and changes to the workflow and reviewed list receive appropriate ownership review; those protections were not verified here.

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 42.86% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 7 functions across 2 files. (2 skipped: 2…	Write docstrings for the functions missing them to satisfy the coverage threshold.
Linked Issues check	❓ Inconclusive	The changes implement the coverage guard for issue #3215: they compare configured excludeNamespaces with a reviewed list, require non-empty reasons, reject overrides in manifest and rendered provide…	Provide reviewable evidence for scripts/kubescape-unscanned-namespaces.tsv, or an independent equivalent that shows the kubescape namespace and every excluded namespace with reasons. Provide reviewable evidence that the `pod-security-mu…

✅ Passed checks (3 passed)

Check name	Status	Explanation
Out of Scope Changes check	✅ Passed	The changed workflow wiring, HelmRelease comments, scan-scope guard, and guard tests all support issue #3215. The tests cover configuration drift and provider-layer overrides. No unrelated change is i…
Title check	✅ Passed	The title clearly and concisely describes the main change: CI now fails when a namespace leaves Kubescape scan coverage without reviewed justification.
Description check	✅ Passed	The description directly explains the reviewed exclusion list, CI validation behavior, unchanged scanned set, and the related issue.

Full details: Linked Issues check

Explanation

The changes implement the coverage guard for issue #3215: they compare configured excludeNamespaces with a reviewed list, require non-empty reasons, reject overrides in manifest and rendered provider layers, require a rendered Kubescape HelmRelease, and add tests. The summary also states that the real tree passes. However, scripts/kubescape-unscanned-namespaces.tsv is intentionally excluded from review, so the actual namespace entries, including kubescape, and their reasons cannot be verified. The summary provides no evidence that the pod-security-mutations rationale was corrected. The complete issue compliance cannot be established.

Resolution

Provide reviewable evidence for scripts/kubescape-unscanned-namespaces.tsv, or an independent equivalent that shows the kubescape namespace and every excluded namespace with reasons. Provide reviewable evidence that the pod-security-mutations rationale does not imply nonexistent coverage.

Full details: Docstring Coverage

Explanation

Docstring coverage is 42.86% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 7 functions across 2 files. (2 skipped: 2 unsupported.)

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devantler]

🤖 Generated by the Agentic Engineer

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f49eaa18dc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[devantler]

🤖 Generated by the Agentic Engineer

Readiness at 2a935cc6104b95f038bebedbf14d5ca96db92e29

• Tested: all checks green at head; CI job 108057384979 ran the guard against the real tree plus its test suite (step "Validate every unscanned namespace is reviewed" → success). Locally: 16 cases pass, including RED cases for an overlay patch, valuesFrom, a JSON6902 op, an inline patch, a Kustomize replacements override (rendered scope verified changed before asserting) and a Flux spec.patches override; neutralising the override detection and the rendered comparison each fails the corresponding cases.
• Reviewed: CodeRabbit GREEN at this head (summary verdict for the 12:09Z request); 0 unresolved threads.
• Tried as a user: this is a CI guard with no runtime surface beyond CI. I ran it as a contributor would hit it: on the real tree it reports OK — 7 unscanned namespace(s), rendering the hetzner layer (the docker layer does not deploy Kubescape and is skipped); on each override fixture it names the file or layer and says to set the scope only in the base HelmRelease.