[devantler]

🤖 Generated by the Agentic Engineer

Why

The security scanner can report a control as passing "with exceptions" even after its last exception is gone, so the dashboard cannot tell a real pass from a hidden suppression. Upstream fixed this, and the fix first shipped in the scanner release of 14 October.

What

Moves the platform's scanner onto that release, so the next scan replaces stale exception markers with the real result. Exceptions that are still in force keep their marker.

Part of #4523

👉 After merge/promotion: the issue stays open until a scan on the new release is read back live and shows the marker cleared.

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 52 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository YAML (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: ebe6c3df-ff3c-475b-b67b-08bad0d8782a

📥 Commits

Reviewing files that changed from the base of the PR and between c686db9 and 31a00b7.

📒 Files selected for processing: 1

• scripts/validate-eks-ci-role-policy/approved-surface.txt

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository YAML (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 26c1d507-62ed-4623-9061-64f7f987d4ab

📥 Commits

Reviewing files that changed from the base of the PR and between ac1752f and c686db9.

📒 Files selected for processing: 1

• k8s/bases/infrastructure/controllers/kubescape/helm-release.yaml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

⏰ Context from checks skipped due to timeout: 1

• GitHub Check: 🔍 Detect Changes

⚠️ CI failures not shown inline: 7

GitHub Actions: CI / 0_CI - Required Checks.txt: fix(kubescape): run the scanner release that clears stale exception markers

Conclusion: failure

View job details

##[group]Run set -Eeuo pipefail
 �[36;1mset -Eeuo pipefail�[0m
 �[36;1m�[0m
 �[36;1m# Disable globbing so wildcards in input are not expanded.�[0m
 �[36;1mset -f�[0m
 �[36;1mread -r -a results <<< "$JOB_RESULTS"�[0m
 �[36;1m�[0m
 �[36;1mfailed=false�[0m
 �[36;1mabandoned=false�[0m
 �[36;1mallowed_values="success, failure, cancelled, skipped"�[0m
 �[36;1m�[0m
 �[36;1mfor result in "${results[@]}"; do�[0m
 �[36;1m  case "$result" in�[0m
 �[36;1m    success|skipped)�[0m
 �[36;1m      ;;�[0m
 �[36;1m    failure|cancelled)�[0m
 �[36;1m      failed=true�[0m
 �[36;1m      ;;�[0m
 �[36;1m    abandoned)�[0m
 �[36;1m      # Not one of the four documented needs.<job>.result values, but GitHub emits it�[0m
 �[36;1m      # when it gives up on a job. It is a GitHub-side outcome, not a malformed input, so�[0m
 �[36;1m      # it gets its own message and the catch-all below stays reserved for values that�[0m
 �[36;1m      # really are unexpected. It still fails: an abandoned job did not succeed.�[0m
 �[36;1m      abandoned=true�[0m
 �[36;1m      ;;�[0m
 �[36;1m    *)�[0m
 �[36;1m      printf '%s\n' "❌ $CHECK_NAME — unknown job result: '$result'. Allowed values: $allowed_values."�[0m
 �[36;1m      exit 1�[0m
 �[36;1m      ;;�[0m
 �[36;1m  esac�[0m
 �[36;1mdone�[0m
 �[36;1m�[0m
 �[36;1mif [ "$abandoned" = true ]; then�[0m
 �[36;1m  printf '%s\n' "❌ $CHECK_NAME — at least one job was abandoned by GitHub (a runner or infrastructure outcome, not an input error). Re-run the failed jobs."�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1mif [ "$failed" = true ]; then�[0m
 �[36;1m  printf '%s\n' "❌ $CHECK_NAME — at least one job failed or was cancelled."�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1mif [ "$abandoned" = true ] || [ "$failed" = true ]; then�[0m
 �[36;1m  exit 1�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1mprintf '%s\n' "✅ $CHECK_NAME — all jobs succeeded or were skipped."�[0m
 shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0}
 env:
   JOB_RESULTS: failure success success success skipp...

GitHub Actions: CI / CI - Required Checks: fix(kubescape): run the scanner release that clears stale exception markers

Conclusion: failure

View job details

##[group]Run set -Eeuo pipefail
 �[36;1mset -Eeuo pipefail�[0m
 �[36;1m�[0m
 �[36;1m# Disable globbing so wildcards in input are not expanded.�[0m
 �[36;1mset -f�[0m
 �[36;1mread -r -a results <<< "$JOB_RESULTS"�[0m
 �[36;1m�[0m
 �[36;1mfailed=false�[0m
 �[36;1mabandoned=false�[0m
 �[36;1mallowed_values="success, failure, cancelled, skipped"�[0m
 �[36;1m�[0m
 �[36;1mfor result in "${results[@]}"; do�[0m
 �[36;1m  case "$result" in�[0m
 �[36;1m    success|skipped)�[0m
 �[36;1m      ;;�[0m
 �[36;1m    failure|cancelled)�[0m
 �[36;1m      failed=true�[0m
 �[36;1m      ;;�[0m
 �[36;1m    abandoned)�[0m
 �[36;1m      # Not one of the four documented needs.<job>.result values, but GitHub emits it�[0m
 �[36;1m      # when it gives up on a job. It is a GitHub-side outcome, not a malformed input, so�[0m
 �[36;1m      # it gets its own message and the catch-all below stays reserved for values that�[0m
 �[36;1m      # really are unexpected. It still fails: an abandoned job did not succeed.�[0m
 �[36;1m      abandoned=true�[0m
 �[36;1m      ;;�[0m
 �[36;1m    *)�[0m
 �[36;1m      printf '%s\n' "❌ $CHECK_NAME — unknown job result: '$result'. Allowed values: $allowed_values."�[0m
 �[36;1m      exit 1�[0m
 �[36;1m      ;;�[0m
 �[36;1m  esac�[0m
 �[36;1mdone�[0m
 �[36;1m�[0m
 �[36;1mif [ "$abandoned" = true ]; then�[0m
 �[36;1m  printf '%s\n' "❌ $CHECK_NAME — at least one job was abandoned by GitHub (a runner or infrastructure outcome, not an input error). Re-run the failed jobs."�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1mif [ "$failed" = true ]; then�[0m
 �[36;1m  printf '%s\n' "❌ $CHECK_NAME — at least one job failed or was cancelled."�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1mif [ "$abandoned" = true ] || [ "$failed" = true ]; then�[0m
 �[36;1m  exit 1�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1mprintf '%s\n' "✅ $CHECK_NAME — all jobs succeeded or were skipped."�[0m
 shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0}
 env:
   JOB_RESULTS: failure success success success skipp...

GitHub Actions: CI / 14_🔍 Detect Changes.txt: fix(kubescape): run the scanner release that clears stale exception markers

Conclusion: failure

View job details

##[group]Run go test ./...
 �[36;1mgo test ./...�[0m
 shell: /usr/bin/bash -e {0}
 env:
   GOTOOLCHAIN: local
 ##[endgroup]
 go: downloading gopkg.in/yaml.v3 v3.0.1
 go: downloading mvdan.cc/sh/v3 v3.14.1
 go: downloading sigs.k8s.io/yaml v1.6.0
 go: downloading gopkg.in/evanphx/json-patch.v5 v5.9.11
 go: downloading cel.dev/cel-go v0.32.0
 go: downloading google.golang.org/protobuf v1.36.12
 go: downloading github.com/coroot/logparser v1.4.2
 go: downloading github.com/santhosh-tekuri/jsonschema/v6 v6.0.3
 go: downloading go.yaml.in/yaml/v2 v2.4.4
 go: downloading github.com/siderolabs/talos/pkg/machinery v1.14.2
 go: downloading cel.dev/expr v0.25.2
 go: downloading google.golang.org/genproto/googleapis/api v0.0.0-20260810153831-ec0a7760b754
 go: downloading golang.org/x/text v0.41.0
 go: downloading golang.org/x/time v0.15.0
 go: downloading go.yaml.in/yaml/v3 v3.0.5
 go: downloading github.com/antlr4-go/antlr/v4 v4.13.1
 go: downloading google.golang.org/genproto/googleapis/rpc v0.0.0-20260810153831-ec0a7760b754
 go: downloading github.com/dustin/go-humanize v1.0.1
 go: downloading github.com/planetscale/vtprotobuf v0.6.1-0.20260702190614-8ae5a48058df
 go: downloading google.golang.org/grpc v1.83.2
 go: downloading github.com/blang/semver/v4 v4.0.0
 go: downloading github.com/siderolabs/gen v0.8.8
 go: downloading golang.org/x/exp v0.0.0-20260709172345-9ea1abe57597
 go: downloading golang.org/x/net v0.58.0
 go: downloading golang.org/x/sys v0.47.0
 go: downloading github.com/containerd/go-cni v1.1.13
 go: downloading github.com/siderolabs/crypto v0.6.5
 go: downloading github.com/containernetworking/cni v1.3.0
 ok  	github.com/devantler-tech/platform/internal/portalstorage	0.010s
 ok  	github.com/devantler-tech/platform/scripts/analyze-cri-logs	0.084s
 ok  	github.com/devantler-tech/platform/scripts/annotate-vendored-checkov	2.375s
 ok  	github.com/devantler-tech/platform/scripts/assess-backstage-retirement	1.099s
 ok  	github.com/devantler-tech/platform/scri...

GitHub Actions: CI / 🔍 Detect Changes: fix(kubescape): run the scanner release that clears stale exception markers

Conclusion: failure

View job details

##[group]Run go test ./...
 �[36;1mgo test ./...�[0m
 shell: /usr/bin/bash -e {0}
 env:
   GOTOOLCHAIN: local
 ##[endgroup]
 go: downloading gopkg.in/yaml.v3 v3.0.1
 go: downloading mvdan.cc/sh/v3 v3.14.1
 go: downloading sigs.k8s.io/yaml v1.6.0
 go: downloading gopkg.in/evanphx/json-patch.v5 v5.9.11
 go: downloading cel.dev/cel-go v0.32.0
 go: downloading google.golang.org/protobuf v1.36.12
 go: downloading github.com/coroot/logparser v1.4.2
 go: downloading github.com/santhosh-tekuri/jsonschema/v6 v6.0.3
 go: downloading go.yaml.in/yaml/v2 v2.4.4
 go: downloading github.com/siderolabs/talos/pkg/machinery v1.14.2
 go: downloading cel.dev/expr v0.25.2
 go: downloading google.golang.org/genproto/googleapis/api v0.0.0-20260810153831-ec0a7760b754
 go: downloading golang.org/x/text v0.41.0
 go: downloading golang.org/x/time v0.15.0
 go: downloading go.yaml.in/yaml/v3 v3.0.5
 go: downloading github.com/antlr4-go/antlr/v4 v4.13.1
 go: downloading google.golang.org/genproto/googleapis/rpc v0.0.0-20260810153831-ec0a7760b754
 go: downloading github.com/dustin/go-humanize v1.0.1
 go: downloading github.com/planetscale/vtprotobuf v0.6.1-0.20260702190614-8ae5a48058df
 go: downloading google.golang.org/grpc v1.83.2
 go: downloading github.com/blang/semver/v4 v4.0.0
 go: downloading github.com/siderolabs/gen v0.8.8
 go: downloading golang.org/x/exp v0.0.0-20260709172345-9ea1abe57597
 go: downloading golang.org/x/net v0.58.0
 go: downloading golang.org/x/sys v0.47.0
 go: downloading github.com/containerd/go-cni v1.1.13
 go: downloading github.com/siderolabs/crypto v0.6.5
 go: downloading github.com/containernetworking/cni v1.3.0
 ok  	github.com/devantler-tech/platform/internal/portalstorage	0.010s
 ok  	github.com/devantler-tech/platform/scripts/analyze-cri-logs	0.084s
 ok  	github.com/devantler-tech/platform/scripts/annotate-vendored-checkov	2.375s
 ok  	github.com/devantler-tech/platform/scripts/assess-backstage-retirement	1.099s
 ok  	github.com/devantler-tech/platform/scri...

GitHub Actions: CI / 16_🔏 Validate Cosign Matcher Efficacy.txt: fix(kubescape): run the scanner release that clears stale exception markers

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1m�[0m
 �[36;1mgo test ./scripts/validate-matcher-efficacy�[0m
 �[36;1m�[0m
 �[36;1mMATCHER_JSON="$(go run ./scripts/validate-matcher-efficacy --print-matcher \�[0m
 �[36;1m  ksail.prod.yaml \�[0m
 �[36;1m  k8s/providers/hetzner/infrastructure/controllers/flux-instance/flux-instance.yaml)"�[0m
 �[36;1m# 🔴 DECODE AS JSON, never line-per-value. A matcher value may legitimately�[0m
 �[36;1m# contain a newline — a YAML literal block is valid for these fields — and a�[0m
 �[36;1m# line-based read would take only its first line, verifying against a�[0m
 �[36;1m# truncated regex while Flux enforces the whole thing. That is a matcher�[0m
 �[36;1m# inert in production and green here: exactly what this job refuses.�[0m
 �[36;1m# `jq -e` fails on a null or missing field, so a malformed handoff stops�[0m
 �[36;1m# the build instead of silently yielding an empty pattern.�[0m
 �[36;1mISSUER="$(jq -er '.issuer' <<<"${MATCHER_JSON}")"�[0m
 �[36;1mSUBJECT="$(jq -er '.subject' <<<"${MATCHER_JSON}")"�[0m
 �[36;1mif [ -z "${ISSUER}" ] || [ -z "${SUBJECT}" ]; then�[0m
 �[36;1m  echo "::error::could not read the matcher out of the manifests"�[0m
...
 �[36;1m  --certificate-oidc-issuer-regexp "${ISSUER}" \�[0m
 �[36;1m  --certificate-identity-regexp "${SUBJECT}" \�[0m
 �[36;1m  "${ARTIFACT}" 2>&1 > /dev/null | tee "${COSIGN_LOG}" >&2; then�[0m
 �[36;1m  FAILURE_CLASS="$(cosign_failure_class "${COSIGN_LOG}")"�[0m
 �[36;1m  if [ "${FAILURE_CLASS}" = "rejected" ]; then�[0m
 �[36;1m    echo "::error::the cosign matcher in the manifests does not verify ${ARTIFACT}."�[0m
 �[36;1m    echo "::error::a matcher that matches nothing is inert: present, green, and enforcing nothing."�[0m
...
 �[36;1m# job exists to prevent.�[0m
 �[36;1mif cosign verify \�[0m
 �[36;1m  --certificate-oidc-issuer-regexp "${ISSUER}" \�[0m
 �[36;1m  --certificate-identity-regexp '^https://github\.com/devantler-tech/NOT-A-REAL-REPO/.*$' \�[0m
 �[36;1m  "...

GitHub Actions: CI / 🔏 Validate Cosign Matcher Efficacy: fix(kubescape): run the scanner release that clears stale exception markers

Conclusion: failure

View job details

##[group]Run shellcheck -x scripts/cosign-failure-lib.sh scripts/tests/test-cosign-failure-lib.sh
 �[36;1mshellcheck -x scripts/cosign-failure-lib.sh scripts/tests/test-cosign-failure-lib.sh�[0m
 �[36;1mbash scripts/tests/test-cosign-failure-lib.sh�[0m
 shell: /usr/bin/bash -e {0}
 env:
   GOTOOLCHAIN: local
 ##[endgroup]
 cosign-failure-lib: classifier
   ✅ infrastructure-bad-gateway-body → infrastructure
   ✅ infrastructure-bare-eof → infrastructure
   ✅ infrastructure-body-timeout → infrastructure
   ✅ infrastructure-connection-reset → infrastructure
   ✅ infrastructure-denied → infrastructure
   ✅ infrastructure-dial-timeout → infrastructure
   ✅ infrastructure-dns → infrastructure
   ✅ infrastructure-forbidden-bare-status → infrastructure
   ✅ infrastructure-rate-limited → infrastructure
   ✅ infrastructure-registry-unavailable → infrastructure
   ✅ infrastructure-representative-mixed-with-rejection → infrastructure
   ✅ infrastructure-representative-sigstore-deadline → infrastructure
   ✅ infrastructure-server-error → infrastructure
   ✅ infrastructure-tag-not-found → infrastructure
   ✅ infrastructure-tls-handshake → infrastructure
   ✅ infrastructure-tuf-http-status → infrastructure
   ✅ infrastructure-unauthorized → infrastructure
   ✅ rejected-bundle-identity → rejected
   ✅ rejected-bundle-issuer → rejected
   ✅ rejected-legacy-identity → rejected
   ✅ rejected-subject-names-registry-code → rejected
   ✅ unrecognised-empty → unrecognised
   ✅ unrecognised-invalid-signature → unrecognised
   ✅ unrecognised-no-signatures → unrecognised
   ✅ unrecognised-unknown-shape → unrecognised
   ✅ every class has fixtures (rejected=4 infrastructure=17 unrecognised=4)
   ✅ the #3545 dial timeout is among the fixtures
   ✅ a missing log ('<empty path>') is unrecognised
   ✅ a missing log ('/tmp/tmp.lDKvHpnuJc/does-not-exist.log') is unrecognised
   ✅ the evidence for an outage is cosign's own first error line
   ✅ an unrecognised failure claims no deciding line
   ✅ ...

GitHub Actions: CI / 🔏 Validate Cosign Matcher Efficacy: fix(kubescape): run the scanner release that clears stale exception markers

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1m�[0m
 �[36;1mgo test ./scripts/validate-matcher-efficacy�[0m
 �[36;1m�[0m
 �[36;1mMATCHER_JSON="$(go run ./scripts/validate-matcher-efficacy --print-matcher \�[0m
 �[36;1m  ksail.prod.yaml \�[0m
 �[36;1m  k8s/providers/hetzner/infrastructure/controllers/flux-instance/flux-instance.yaml)"�[0m
 �[36;1m# 🔴 DECODE AS JSON, never line-per-value. A matcher value may legitimately�[0m
 �[36;1m# contain a newline — a YAML literal block is valid for these fields — and a�[0m
 �[36;1m# line-based read would take only its first line, verifying against a�[0m
 �[36;1m# truncated regex while Flux enforces the whole thing. That is a matcher�[0m
 �[36;1m# inert in production and green here: exactly what this job refuses.�[0m
 �[36;1m# `jq -e` fails on a null or missing field, so a malformed handoff stops�[0m
 �[36;1m# the build instead of silently yielding an empty pattern.�[0m
 �[36;1mISSUER="$(jq -er '.issuer' <<<"${MATCHER_JSON}")"�[0m
 �[36;1mSUBJECT="$(jq -er '.subject' <<<"${MATCHER_JSON}")"�[0m
 �[36;1mif [ -z "${ISSUER}" ] || [ -z "${SUBJECT}" ]; then�[0m
 �[36;1m  echo "::error::could not read the matcher out of the manifests"�[0m
...
 �[36;1m  --certificate-oidc-issuer-regexp "${ISSUER}" \�[0m
 �[36;1m  --certificate-identity-regexp "${SUBJECT}" \�[0m
 �[36;1m  "${ARTIFACT}" 2>&1 > /dev/null | tee "${COSIGN_LOG}" >&2; then�[0m
 �[36;1m  FAILURE_CLASS="$(cosign_failure_class "${COSIGN_LOG}")"�[0m
 �[36;1m  if [ "${FAILURE_CLASS}" = "rejected" ]; then�[0m
 �[36;1m    echo "::error::the cosign matcher in the manifests does not verify ${ARTIFACT}."�[0m
 �[36;1m    echo "::error::a matcher that matches nothing is inert: present, green, and enforcing nothing."�[0m
...
 �[36;1m# job exists to prevent.�[0m
 �[36;1mif cosign verify \�[0m
 �[36;1m  --certificate-oidc-issuer-regexp "${ISSUER}" \�[0m
 �[36;1m  --certificate-identity-regexp '^https://github\.com/devantler-tech/NOT-A-REAL-REPO/.*$' \�[0m
 �[36;1m  "...

🔇 Additional comments: 1

k8s/bases/infrastructure/controllers/kubescape/helm-release.yaml: 1

231-236: 🩺 Stability & Availability

No image-tag change is required.

Chart kubescape-operator 1.40.5 defaults to quay.io/kubescape/kubescape. The v4.0.16 tag exists and includes kubescape#4044, so the claimed ImagePullBackOff risk and missing-fix concern do not apply.

The line-length remark and request to keep #4523 open are not code defects established by this change.

📝 Walkthrough

The Kubescape image tag changes from v4.0.14 to v4.0.16. The scanner-version guidance now recommends v4.0.16 and adds a comment about kubescape#4044’s aggregate-status replacement behavior.

Priority: ⬇️ Low

Merge Risk: ⚪ Minimal · up to c686d

The scanner pin is updated to v4.0.16, and the guidance states when the override can be removed. No actionable merge risk was identified; live confirmation that a scan clears the marker remains the stated follow-up.

Pre-merge checks: 5

Passed checks: 5 passed

Check name	Status	Explanation
Title check		The title clearly identifies the Kubescape scanner fix and its purpose of clearing stale exception markers. It matches the main change.
Description check		The description explains the stale exception marker issue, the scanner upgrade, the expected behavior, and the validation step after deployment. It is directly related to the changeset.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches: 💡 1

🛠️ Fix failing CI checks: 💡

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devantler]

🤖 Generated by the Agentic Engineer

Authorization-surface re-approval evidence (31a00b7a)

The first head failed 🔍 Detect Changes in the authorization-ledger tests (run 38706164941): exactly one ledger entry changed, nothing added or removed.

• helm.toolkit.fluxcd.io/v2|HelmRelease|kubescape|kubescape moves from 289532a2…3f184f45 to fc4feb22…2972cc1.

Conservation: against origin/main, the only non-comment manifest change on this branch is the scanner image tag (v4.0.14 → v4.0.16). A HelmRelease is a controller-RBAC emitter, so its whole spec is fingerprinted and an image-only change moves the entry. No ClusterRole, Role, binding, ServiceAccount, identity, subject, verb, wildcard or AWS permission changes.

Renderer: the new value is the one CI's checksum-verified renderer printed. The local test package (kubectl v1.37.1, Kustomize v5.8.1) passes 349 of 349 with it; CI stays the authority.

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[devantler]

🤖 Generated by the Agentic Engineer

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-15T08:57:45.012074Z	31a00b7	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Can't wait for the next one!

Reviewed commit: 31a00b7ac0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[devantler]

🤖 Generated by the Agentic Engineer

Ready at 31a00b7ac04ec34c43f62bcb1b7c0a9cfdd20c0a.

• Tested: all checks complete (24 pass, 9 skipped by design), including manifest validation, the Kubescape scan gate, the post-renderer and authorization-ledger checks. CLEAN against base. Locally, ksail --config ksail.prod.yaml workload validate passes and lists the kubescape files.
• Reviewed: Codex approved this head (👍 at 08:57Z after the request at this head), and there are no review threads. CodeRabbit reviewed the first head with no actionable comments; it is rate-limited for this one.
• Evaluated (platform evaluation, pre-deploy): the rendered Hetzner controllers layer carries the scanner image quay.io/kubescape/kubescape:v4.0.16, and that tag is published on the registry (pushed 2026-10-14). The release's own changelog and a compare against chore(deps): update dependency siderolabs/talos to v1.14.4 #4044's merge commit confirm v4.0.16 contains the fix. Post-deploy check (stays on fix(security): reconcile inconsistent aggregate exception markers #4523): a scan on the new image, read back live, shows the stale w/exceptions marker cleared on the affected control.

Promoting and adding to the merge queue, pinned to this head.