Skip to content

Commit 43c8a6b

Browse files
committed
Update security scan scripts to improve error handling and output redirection
- Modified run_checkov.sh and run_snyk.sh to redirect error output to /dev/null while ensuring failure messages are logged for transparency. - Enhanced report generation processes to create minimal output in case of failures, improving user experience by reducing clutter in logs.
1 parent 4395794 commit 43c8a6b

2 files changed

Lines changed: 3 additions & 3 deletions

File tree

scripts/tools/run_checkov.sh

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -43,14 +43,14 @@ if command -v checkov &>/dev/null; then
4343

4444
# Generate JSON report for multiple frameworks
4545
# Note: Not limiting to --framework terraform, using default auto-detection
46-
checkov -d "$TARGET_PATH" --output json --output-file "$CHECKOV_JSON" --quiet 2>/dev/null || {
46+
checkov -d "$TARGET_PATH" --output json --output-file "$CHECKOV_JSON" --quiet >/dev/null 2>&1 || {
4747
echo "[run_checkov.sh][Checkov] JSON report generation failed." >> "$LOG_FILE"
4848
# Create minimal JSON if generation fails
4949
echo '{"check_type":"","results":{"passed_checks":[],"failed_checks":[],"skipped_checks":[]},"summary":{"passed":0,"failed":0,"skipped":0}}' > "$CHECKOV_JSON"
5050
}
5151

5252
# Generate text report (output to stdout, redirect to file)
53-
checkov -d "$TARGET_PATH" --output cli --quiet 2>/dev/null > "$CHECKOV_TEXT" || {
53+
checkov -d "$TARGET_PATH" --output cli --quiet >/dev/null 2>&1 > "$CHECKOV_TEXT" || {
5454
echo "[run_checkov.sh][Checkov] Text report generation failed." >> "$LOG_FILE"
5555
echo "Checkov scan completed but no results available." > "$CHECKOV_TEXT"
5656
}

scripts/tools/run_snyk.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ if command -v snyk &>/dev/null; then
5656
echo "[run_snyk.sh][Snyk] Text report generation failed, trying alternative approach..." | tee -a "$LOG_FILE"
5757

5858
# Try with different options
59-
snyk test $SNYK_AUTH_FLAG 2>&1 > "$SNYK_TEXT" || {
59+
snyk test $SNYK_AUTH_FLAG > "$SNYK_TEXT" 2>&1 || {
6060
echo "[run_snyk.sh][Snyk] Alternative text scan also failed, creating minimal report..." | tee -a "$LOG_FILE"
6161
echo "Snyk Scan Results" > "$SNYK_TEXT"
6262
echo "=================" >> "$SNYK_TEXT"

0 commit comments

Comments
 (0)