Remove CVSS threshold checks

Signed-off-by: Jakub Stejskal <xstejs24@gmail.com>

Author: Frawless

.github/actions/security/snyk-container-scan/action.yml

@@ -1,5 +1,5 @@
 name: "Snyk Container Scan"
-description: "Scan a single container image with Snyk, upload results to Code Scanning, and check CVSS threshold"
+description: "Scan a single container image with Snyk, upload results to Code Scanning"
 
 inputs:
   imageFile:
@@ -8,10 +8,6 @@ inputs:
   image:
     description: "Image name for SARIF naming and categorization"
     required: true
-  cvssThreshold:
-    description: "Fail if any CVE has CVSS score above this value"
-    required: false
-    default: "8.0"
   snykMonitor:
     description: "Whether to also run 'snyk container monitor'"
     required: false
@@ -104,26 +100,3 @@ runs:
             --project-name="$MONITOR_PROJECT" \
             --target-reference="$MONITOR_REVISION"
         fi
-
-    - name: Check CVSS threshold
-      shell: bash
-      env:
-        IMAGE_NAME: ${{ inputs.image }}
-      run: |
-        THRESHOLD=${{ inputs.cvssThreshold }}
-        JSON_FILE="snyk-container-${IMAGE_NAME}.json"
-        if [ -f "$JSON_FILE" ]; then
-          COUNT=$(jq --argjson t "$THRESHOLD" '
-            if type == "array" then
-              [.[].vulnerabilities[]? | select(.cvssScore > $t)] | length
-            else
-              [.vulnerabilities[]? | select(.cvssScore > $t)] | length
-            end' "$JSON_FILE")
-          if [ "$COUNT" -gt 0 ]; then
-            echo "::error::Image $IMAGE_NAME has $COUNT vulnerabilities with CVSS score > $THRESHOLD"
-            exit 1
-          fi
-          echo "No vulnerabilities found with CVSS score > $THRESHOLD"
-        else
-          echo "No Snyk results file found, skipping CVSS threshold check"
-        fi

.github/actions/security/snyk-maven-scan/action.yml

@@ -1,11 +1,7 @@
 name: "Snyk Maven Scan"
-description: "Run Snyk scan on Maven dependencies with SARIF upload and CVSS threshold check"
+description: "Run Snyk scan on Maven dependencies with SARIF upload"
 
 inputs:
-  cvssThreshold:
-    description: "Fail if any CVE has CVSS score above this value"
-    required: false
-    default: "8.0"
   snykMonitor:
     description: "Whether to also run 'snyk monitor'"
     required: false
@@ -71,23 +67,3 @@ runs:
       run: |
         REPO_NAME="${GITHUB_REPOSITORY##*/}"
         snyk monitor --project-name="${PROJECT_PREFIX}/${REPO_NAME}"
-
-    - name: Check CVSS threshold
-      shell: bash
-      run: |
-        THRESHOLD=${{ inputs.cvssThreshold }}
-        if [ -f snyk-results.json ]; then
-          COUNT=$(jq --argjson t "$THRESHOLD" '
-            if type == "array" then
-              [.[].vulnerabilities[]? | select(.cvssScore > $t)] | length
-            else
-              [.vulnerabilities[]? | select(.cvssScore > $t)] | length
-            end' snyk-results.json)
-          if [ "$COUNT" -gt 0 ]; then
-            echo "::error::Found $COUNT vulnerabilities with CVSS score > $THRESHOLD"
-            exit 1
-          fi
-          echo "No vulnerabilities found with CVSS score > $THRESHOLD"
-        else
-          echo "No Snyk results file found, skipping CVSS threshold check"
-        fi

.github/workflows/test-snyk.yml

@@ -58,7 +58,6 @@ jobs:
       - name: Run Snyk Maven scan
         uses: ./.github/actions/security/snyk-maven-scan
         with:
-          cvssThreshold: "99.0"
           # Keep false to avoid uploading testing results to Snyk App
           snykMonitor: "false"
           # Keep false to avoid uploading results to GitHub Code Scanning page
@@ -205,7 +204,6 @@ jobs:
         with:
           imageFile: docker-images/container-archives/${{ matrix.image }}.tar.gz
           image: ${{ matrix.image }}
-          cvssThreshold: "99.0"
           snykMonitor: "false"
           uploadToCodeScanning: "false"
           projectPrefix: test-operators
@@ -255,7 +253,6 @@ jobs:
         with:
           imageFile: drain-cleaner-container-amd64.tar.gz
           image: drain-cleaner-amd64
-          cvssThreshold: "99.0"
           # Keep false to avoid uploading testing results to Snyk App
           snykMonitor: "false"
           # Keep false to avoid uploading results to GitHub Code Scanning page