Github Actions - Tag - Lorenzo's Bloghttps://www.k8s.it/tags/github-actions/Github Actions - Tag - Lorenzo's BlogHugo -- gohugo.ioenSat, 08 Aug 2026 00:00:00 +0000AI Security Review Finds the Bug Your CI Gates Missedhttps://www.k8s.it/posts/ai-security-review-finds-the-bug-ci-gates-missed/Sat, 08 Aug 2026 00:00:00 +0000Lorenzo Girardihttps://www.k8s.it/posts/ai-security-review-finds-the-bug-ci-gates-missed/

Table of Contents

  • The Problem
  • Naaa… the alternatives
  • The Pipeline
  • The ai-analysis Job, Commented
  • Downloading Results, Bundling the Source
  • The Empty Report
  • Downloading Artifacts, Watching the Run
  • The AI Scripts
  • The Report That Caught the Bug
  • The Full Results, as an Example
  • The Numbers
  • Security Considerations
  • Monitoring and Observability
  • Conclusion
  • Reflections

Here we are.

My debug/test API, pytbak, runs a proper CI: unit tests, linting, a Docker build, Trivy scanning, Checkov, a Kubernetes syntax check. Every gate maps to a category of failure I have seen before. And yet, I kept being bothered by one specific class of bug, the one that no scanner materializes out of thin air, because it lives in my logic and not in a CVE database.

]]>