[maksimtech]

From 2026-10-24 every run of docker-scout.yml failed, and GitHub mailed a failure for each push to main (seven today). The CVE scan worked and was printed; then the scout CLI crashed in the recommendations part — panic: runtime error: invalid memory address or nil pointer dereference in internal/format/recommendations/markdown.go — on the images built on python:3.12-slim-trixie, with scout-action 1.27 and 1.28 alike. The Security Posture gate stayed green throughout: the SARIF was uploaded before the crash.

• docker-scout.yml: command: cves in its own step, writing the SARIF; if it fails, the job does. command: recommendations in a second step with continue-on-error: true and no SARIF. The comment that explains why the recommendations are worth having moves with them.
• docker.yml scanned with cves alone and is unchanged; a test says so.
• CHANGELOG: under [2026.47], not yet released, so it ships with this release.

TDD: tests/test_scout_steps.py (4 tests on the parsed workflows): not both commands in one step; the scan writes the SARIF and has no continue-on-error; the recommendations have it and write no SARIF; docker.yml stays cves only. Red on the first and third before the change; full suite 719 passed.

The same crash hits releaseradar, apkradar and cookieradar (also python:3.12); the same change follows there.

🤖 Generated with Claude Code

[codspeed]

Merging this PR will not alter performance

✅ 4 untouched benchmarks

---

_{Comparing ci/scout-recommendations-advisory (48bda14) with main (a80dc77)}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!