fix(ci): fail the Agent Security Scan job at high severity
Summary
The Agent Security Scan job in ci.yml ran ecc-agentshield scan --min-severity high and relied on its exit code. The scanner's --min-severity only filters the report, and it exits non-zero only for critical findings, so a high-severity finding passed the job. This is the same issue fixed for the AgentShield reusable in #1438.
- The scan step writes the JSON report to
$RUNNER_TEMP. Exit 2 (critical findings in the report) is left to the gate, and any other non-zero exit fails the job as a scanner error. - A new Enforce AgentShield severity threshold step sources
.github/scripts/agent-shield/lib/severity-gate.shfrom #1438. No new decision logic. - The threshold is set once, as the job-level
AGENTSHIELD_MIN_SEVERITY: high. ci-tests.ymlalso runs when.github/scripts/agent-shield/**changes, because the ci suite now depends on the gate lib.
The latest main scan reported 0 findings, so this PR is not expected to change any current result.
Tests
test/workflows/ci/agent-security-gate.bats runs the job's real steps from ci.yml against a stubbed npx:
| Case | Expected |
|---|---|
| exit 0 with a high finding | job fails |
| exit 2 with a critical finding | job fails, finding listed |
| medium finding, or a clean report | job passes |
| scanner exit 4 | job fails with exit 4 |
| empty report | job fails |
| npx args | keep --ignore-scripts, --format json, --min-severity high |
Local: bats test/workflows/ci/ passes 30/30. actionlint and shellcheck are clean.
š¤ Generated with Claude Code
Problem
See the linked issue.
Risk
Medium ā changes GitHub Actions workflow behavior, which is exercised only post-merge; verify via the affected workflow runs.
Test plan
Tests added/updated: test/workflows/ci/agent-security-gate.bats. Verification: bash scripts/dev-lead-lint.sh (shellcheck --severity=warning) ran pre-commit; the bats suite runs in CI.
Rollback
Revert this PR. No non-revertible side effects (no tags, migrations, or external state).
Monitoring
Watch the affected workflow run(s) in the Actions tab and this PR's Lint check for regressions.