Make Trustabl scan advisory as intended

[ruslanmv]

Summary

PR #59 added Trustabl as an advisory scanner, but the workflow still let Trustabl's native medium+ exit code fail the scan job. The original job-level continue-on-error only tolerated the failed job at the workflow level; it did not make the scan job/step itself green.

This PR aligns the implementation with that stated intent:

• upgrades trustabl/trustabl-action from v0.4.1 to v0.4.3, pinned to commit d97575c864814bf4965fa2c72c044224d372723a;
• upgrades the Trustabl binary from v0.1.6 to v0.1.9;
• sets severity-threshold: none explicitly;
• moves continue-on-error: true to the Trustabl step instead of the entire job, so scanner findings are advisory without masking checkout/setup failures.

Root cause observed

The scan reports seven CREW-006 medium findings for mutating CrewAI tools without idempotency keys. Those findings pre-date PR #59 and are real reliability issues, but they are not caused by the scanner workflow itself.

The old v0.1.6 scan also skipped 13 newer rules because the engine could not understand them. v0.1.9 removes that incomplete-scan notice.

Validation

PR run 34700359806 completed the scan job successfully. The seven medium findings are still reported, SARIF/artifacts are still uploaded, and the scanner remains advisory as intended.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
gitpilot	Ready	Preview	Sep 12, 2026 2:48pm UTC

[github-actions]

Trustabl scan

ruslanmv/gitpilot · fix/trustabl-advisory-gate · 8 findings

Readiness goes from 99 → 100 (+1)

Readiness now   🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩   99 / 100

Projected if all findings resolved   🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩   100 / 100   +1

Findings by severity

Severity	Count
critical	0	▱▱▱▱▱▱▱▱
high	0	▱▱▱▱▱▱▱▱
medium	7	▰▰▰▰▰▰▰▰
low	0	▱▱▱▱▱▱▱▱
info	1	▰▱▱▱▱▱▱▱

Projected headroom — estimate, not a re-scan

Fix scope	Readiness	Δ
Fix critical	99 → 99	+0
+ high	99 → 99	+0
+ medium	99 → 100	+1
+ low	100 → 100	+0
+ info (all)	100 → 100	+0

Projected by re-applying trustabl's own scoring with the listed findings resolved (nothing new introduced). Treat as guidance, not a guarantee.

Metric	Value
Repository	ruslanmv/gitpilot
Branch	fix/trustabl-advisory-gate
Readiness score	99
Risk score	1
Findings	8
Max severity	medium
Native exit	1
Rules version	184118273e833a55b83be9a77da993b616cd0b1588c66610f55c328b82243503

❌ Failed

Gate	Threshold	Detected	Result
trustabl native	exit 0	exit 1	❌

Failed due to: trustabl gated (medium+ or --strict)

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.