[VforVitorio]

Change

The first full OSV scan on main surfaced existing dependency advisories and failed after uploading SARIF. Make full push/scheduled scans report-only while retaining SARIF upload. Keep the pull-request comparison blocking (ail-on-vuln: true) so newly introduced findings cannot pass.

Verification

• Workflow YAML parses locally.
• This change does not suppress or remove findings; the full inventory remains in the uploaded scan results.
• The PR will run the required CI and security checks.

Summary by CodeRabbit

• Security
  • Scheduled vulnerability scans now upload the full findings baseline without failing the workflow.
  • Pull request scans continue to fail when they detect vulnerabilities, helping catch newly introduced issues.
• Bug Fixes
  • Logs now retain exception details for messages unrelated to tool calls or validation.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: ec47f951-07a9-42cf-827b-a579cec489b9

📥 Commits

Reviewing files that changed from the base of the PR and between 888e4f3 and 0654aaf.

📒 Files selected for processing: 2

• .github/workflows/osv-scanner.yml
• backend/core/mcp_audit.py

+-----------------------------+
| ░R░e░v░i░e░w░ ░i░n░ ░b░i░o░ |
+-----------------------------+
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}