ci: keep the Dockle threshold at WARN in the server template

[lovelinuxalot]

The Dockle step in the server CVE scan template now uses failure-threshold: WARN, the level that the server repositories run today.

Why

#263 changed the value from high to FATAL. Dockle does not accept high. It falls back to WARN, so the scan has always failed on WARN findings. On ory/kratos and ory/hydra, the Dockle step passes with that value. FATAL would relax the scan, which is a policy change and not a fix. WARN keeps the current behavior with a valid value.

Evidence

actionlint, scripts/check-workflows.sh and make test pass.

Risk

None for synced repositories. scripts/sync.sh excludes all four server repositories, so this template reaches no repository.

Co-authored-by: Claude noreply@anthropic.com

Summary by CodeRabbit

• Updates
  • Container image scans now treat warning-level findings as failures, in addition to fatal findings. The existing failure exit code is unchanged.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 7e99c77e-48f1-4375-9638-bc24d3c5a6df

📥 Commits

Reviewing files that changed from the base of the PR and between 5683249 and 52daf31.

📒 Files selected for processing (1)

• templates/repository/server/.github/workflows/cve-scan.yaml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The Dockle Linter failure threshold in the repository server CVE scan workflow changes from FATAL to WARN. The exit code remains 42.

Changes

Dockle workflow threshold

Layer / File(s)	Summary
Update Dockle threshold templates/repository/server/.github/workflows/cve-scan.yaml	The Dockle Linter failure threshold changes from FATAL to WARN. Its exit code remains 42.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~5 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 52daf

WARN-level findings will now fail the scan with exit code 42, rather than only FATAL findings. This is a stricter gate, and no concrete merge-blocking risk is established.

Architecture Summary

Architecture risk: 🔵 Low · up to 52daf

The change affects 1 system.

Changed systems: templates

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — templates (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

• observed — Modified behavior in templates/repository/server/.github/workflows/cve-scan.yaml: The Dockle Linter now uses the WARN failure threshold instead of FATAL.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: setting the Dockle failure threshold to WARN in the server template.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}