Repository navigation
Start container scans from the CLI (0.5.16) - #54
harshit905 wants to merge 2 commits into
Conversation
|
@CodeAnt-AI: review |
|
| Status | Commit | Started (UTC) | Finished (UTC) |
|---|---|---|---|
✅ #d1300 Reviewed your PR |
d257529 |
Nov 03, 2026 · 04:30 | 04:31 |
✅ #733cf Reviewed your PR |
d257529 |
Nov 02, 2026 · 05:30 | 05:34 |
✅ #c5526 Reviewed your PR |
8c1fb14 |
Nov 02, 2026 · 05:06 | 05:09 |
codeant-ai
Bot
added
the
size:L
![codeant-ai[bot]](https://avatars.githubusercontent.com/in/646884?s=60&v=4){kind=small}
| const timeout = options.timeout ?? 1800; | ||
| const deadline = Date.now() + timeout * 1000; | ||
| for (;;) { | ||
| const scan = await request(provider, 'container', 'results/paginated', options, { scan_id: started.scan_id, limit: 25 }, tenant); |
There was a problem hiding this comment.
Suggestion: The deadline is checked only after this request returns, so a slow poll can finish after --timeout and prevent the CLI from exiting 4 on time.
Assessment: 🟠 Major · 🔁 Occurrence: Rarely · 🏷️ Logic error
Prompt for AI Agent 🤖
This is a comment left during a code review.
**Path:** src/findings/cloud.js
**Line:** 158:158
**Comment:**
*Logic Error: The deadline is checked only after this request returns, so a slow poll can finish after `--timeout` and prevent the CLI from exiting 4 on time.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fixThere was a problem hiding this comment.
@CodeAnt-AI: While a scan is running, this poll only reads the scan meta.json and lists its repos/ prefix, and the API in front of it cuts requests off at about 60 s, so the overrun should be at most one short request. Is there a path where a single running-status poll could take much longer than that, enough to justify passing an AbortSignal through request() and fetchAppApi()?
There was a problem hiding this comment.
The normal running-scan path—reading scan metadata and listing repositories—shouldn’t take much longer than the API’s roughly 60-second cutoff, so there’s no known backend operation that would routinely cause a large overrun.
However, that cutoff isn’t a client-side deadline: a stalled connection could leave fetch waiting, and even a 60-second response exceeds a valid --timeout 1. A late response could also report completion after the deadline and be returned as success. Since --timeout is documented as a maximum wait, I’d bound each poll by the remaining time with an AbortSignal and report exit 4 when that deadline expires. If the timeout is intended to be approximate, the signal plumbing isn’t necessary—but the docs should say an in-flight poll may overrun it.
|
|
@CodeAnt-AI: review |
|
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
User description
What
Adds
codeant findings cloud start --kind containerto start an AWS ECR, Azure ACR, or GCP Artifact Registry container scan without the UI, and to gate a CI pipeline on the result.--provider aws|azure|gcp,--region(required for AWS),--config-id(AWS),--repositories a,b:tag(default: every repository)--waitchecks/cloud/<provider>/container-scanning/results/paginatedevery 15 s, up to--timeoutseconds (default 1800)--fail-on <severity>checks the finished scan'sseverity_rollupfor that severity and every higher one--wait), or finished below--fail-on--fail-oncompleted_with_errors)--timeoutWhy
Container results were already readable through
findings cloud history/list/get, but starting a scan needed the UI.codeant api requestcan reach the start routes but does not sendusername, which they read. This builds onrequest()insrc/findings/cloud.js, which already sends it.No backend change:
results/paginatedreturns the running scan's meta, and each call finalizes the scan once every image has a result.Docs
findings.md(examples, target format per provider, exit codes, GitHub Actions step), changelog 0.5.16. Public docs: CodeAnt-AI/docs#121.Testing
npm test: 205 passed--kind,--fail-on,--provider,--timeout 0,--fail-onwithout--wait, and AWS without--regionexit 1 before any network call; without a login the command exits 1 withMissing API keyCodeAnt-AI Description
Start and gate cloud container scans from the CLI
What Changed
Impact
✅ Container scans start without opening the CodeAnt app✅ CI can block on a selected finding severity✅ Failed and timed-out scans have distinct outcomes💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.