fix(audit): accept empty OSV source reports

2026-07-21 12:51:19 +02:00
parent a81dc21e90
commit b193d4555f
2 changed files with 100 additions and 3 deletions
--- a/tools/checks/check-security-audit.sh
+++ b/tools/checks/check-security-audit.sh
@@ -444,7 +444,8 @@ for raw_path in sorted(set(sys.argv[2:])):
        errors.append(f"{relative_path}: npm audit returned an invalid or error report")
    elif report_name.startswith("osv-scanner-") and (
        not isinstance(payload, dict)
-        or not isinstance(payload.get("results"), list)
+        or "results" not in payload
+        or (payload["results"] is not None and not isinstance(payload["results"], list))
    ):
        errors.append(f"{relative_path}: invalid OSV-Scanner report")
    elif report_name == "jscpd-report.json" and (