fix: switch kubescape exceptions from alertOnly to disable

[adamwalach]

Kubescape v4.0.13 (released 2026-09-02) bumps opa-utils to v0.0.312, which changes the semantics of alertOnly posture exceptions (kubescape/opa-utils#190, kubescape/kubescape#3615). Previously alertOnly and disable behaved identically and both suppressed a finding. Now alertOnly only acknowledges the finding and the resource still counts as failed.

The CI workflow runs kubescape/github-action@main with version: latest and severityThreshold: high, so every Check Helm Chart job started failing with compliance result exceeds severity threshold: high as soon as v4.0.13 was picked up, without any change in this repository. See https://github.com/ory/k8s/actions/runs/33642590257.

This PR has three commits:

1. fix: switch kubescape exceptions from alertOnly to disable. All exceptions in .github/kubescape-exceptions.json were meant to suppress accepted findings, so this switches them to disable, which is the action upstream now designates for that.
2. ci: run chart checks when kubescape config changes. .github/kubescape-*.json was not covered by any path filter, so a PR touching only the scanner config skipped the whole Check Helm Chart matrix. It is now part of the cicd-definitions filter, which forces a full run.
3. ci: restore action versions downgraded by the template sync. The Aug 28 template sync (6428f39) reverted five action pins that renovate had already bumped: actions/checkout v7 → v2/v3, amannn/action-semantic-pull-request v6 → v4 and actions/stale v11 → v4. actionlint rejects the old checkout and stale runners, which made both Validation - GHA Linter and the Lint GithubAction files CI job fail on any PR touching .github/**. This restores the pre-sync versions. The files are auto-generated from ory/meta, so the same change is proposed at the source in chore: bump action versions in common workflow templates meta#257 to stop the next sync from reintroducing the downgrade. This also covers what chore(deps): update dependency node to v24 #895 does for these four files.

Related Issue or Design Document

Fixes the failing CI on master and the v0.64.0 tag. No issue filed; the bug and reproduction are described above. Companion PR: ory/meta#257.

Verification

Ran the exact CI command locally with kubescape v4.0.12 and v4.0.13 against all eight charts in the matrix:

Chart	v4.0.12, alertOnly (old baseline)	v4.0.13, alertOnly (broken)	v4.0.13, disable (this PR)
example-idp	pass, 83	fail, 78	pass, 83
hydra	pass, 81	fail, 75	pass, 81
hydra-maester	pass, 85	fail, 78	pass, 85
keto	pass, 83	fail, 78	pass, 83
kratos	pass, 84	fail, 79	pass, 84
kratos-selfservice-ui-node	pass, 83	fail, 78	pass, 83
oathkeeper	pass, 82	fail, 78	pass, 82
oathkeeper-maester	pass, 84	fail, 80	pass, 84

Compliance scores with disable on v4.0.13 are identical to the v4.0.12 baseline, so nothing is suppressed beyond what the exceptions already covered.

With the path filter change, CI on this PR runs the full matrix: all eight Check Helm Chart jobs pass with kubescape v4.0.13 and the CI scores match the local table. With the action version fix, Validation - GHA Linter and Lint GithubAction files pass as well; actionlint 1.7.7 (pinned) and 1.7.12 (latest) both report zero errors locally.

Checklist

• I have read the contributing guidelines and signed the CLA.
• I have referenced an issue containing the design document if my change introduces a new feature.
• I have read the security policy.
• I confirm that this pull request does not address a security vulnerability.
• I have added tests that prove my fix is effective or that my feature works.
• I have added the necessary documentation within the code base (if appropriate).

Further comments

A follow-up worth considering is pinning the version: input of kubescape/github-action so a new upstream release cannot break CI without a change in this repo. Left out of this PR to keep it to the root cause.

🤖 Generated with Claude Code

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 72a5cf93-d786-4eb8-8d83-68f67d37d45a

📥 Commits

Reviewing files that changed from the base of the PR and between f7366ed and eb0580d.

📒 Files selected for processing (1)

• .github/workflows/ci.yaml

Included review availability: Your plan provides up to 2 included reviews per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The Kubescape configuration changes eight policies from alertOnly to disable. The CI workflow now detects changes to matching Kubescape exception files as CI/CD definition changes.

Changes

Kubescape exception configuration

Layer / File(s)	Summary
Disable Kubescape exception policies .github/kubescape-exceptions.json	Eight policies now use disable actions instead of alertOnly.
Detect Kubescape exception changes .github/workflows/ci.yaml	The cicd-definitions path filter now matches .github/kubescape-*.json files.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to eb058

This PR restores the intended suppression behavior for accepted Kubescape findings and updates the related CI configuration. No actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely describes the primary change: switching Kubescape exceptions from alertOnly to disable.
Description check	✅ Passed	The description explains the root cause, changes, related context, verification results, checklist status, and follow-up considerations. It is complete and aligned with the repository template.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

🟢 Approval recommended

The change is a straightforward, repo-local config update that consistently applies the intended exception action across all existing entries.

Pull request overview

Updates the Kubescape posture exception configuration to preserve the previous “suppress finding” behavior after Kubescape v4.0.13 changed alertOnly semantics, restoring CI stability for Helm chart checks.

Changes:

• Switch all posture exception entries in .github/kubescape-exceptions.json from actions: ["alertOnly"] to actions: ["disable"] so accepted findings are actually suppressed again.

File summaries

File	Description
.github/kubescape-exceptions.json	Updates Kubescape posture exception actions to disable to match new upstream semantics and stop CI failures.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.