From db327646b9145cf3b1dc40dd311c3b0b4ef376f4 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 13 Aug 2026 15:05:08 +0900 Subject: [PATCH] fix: neutralize Strix fail-closed after provider infrastructure Required CI prints "scan failed after provider infrastructure" when NVIDIA NIM exits 2. The outer gate only recognized the "emitted" wording, so those scans stayed blocking. Match the actual line and keep real vulnerability signals blocking. --- .github/workflows/strix.yml | 2 +- tests/test_strix_nvidia_nim_not_found_fallback.py | 12 ++++++++++++ 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/.github/workflows/strix.yml b/.github/workflows/strix.yml index 03ec23257..35025d144 100644 --- a/.github/workflows/strix.yml +++ b/.github/workflows/strix.yml @@ -861,7 +861,7 @@ jobs: fi # Recognized signals that the LLM backend was unavailable / starved. - backend_unavailable_signal='RateLimitError|Too many requests\. For more on scraping GitHub|exceeded your current quota|insufficient_quota|billing details|"status"[[:space:]]*:[[:space:]]*"RESOURCE_EXHAUSTED"|tokens_limit_reached|Request body too large|Max size:[[:space:]]*[0-9]+[[:space:]]+tokens|Error code:[[:space:]]*413|LLM CONNECTION FAILED|Could not establish connection to the language model|LLM warm-up failed|Configured model and fallback models were unavailable|Configured Vertex model and fallback models were unavailable|emitted provider infrastructure or failure-signal output|before provider infrastructure failure|litellm(\.exceptions)?\.NotFoundError[^[:cntrl:]]*Nvidia_nimException[^[:cntrl:]]*Error code:[[:space:]]*404' + backend_unavailable_signal='RateLimitError|Too many requests\. For more on scraping GitHub|exceeded your current quota|insufficient_quota|billing details|"status"[[:space:]]*:[[:space:]]*"RESOURCE_EXHAUSTED"|tokens_limit_reached|Request body too large|Max size:[[:space:]]*[0-9]+[[:space:]]+tokens|Error code:[[:space:]]*413|LLM CONNECTION FAILED|Could not establish connection to the language model|LLM warm-up failed|Configured model and fallback models were unavailable|Configured Vertex model and fallback models were unavailable|emitted provider infrastructure or failure-signal output|failed after provider infrastructure or failure-signal output|before provider infrastructure failure|litellm(\.exceptions)?\.NotFoundError[^[:cntrl:]]*Nvidia_nimException[^[:cntrl:]]*Error code:[[:space:]]*404' # Any evidence that a vulnerability was actually reported. Its presence # forces a hard failure so real findings are NEVER downgraded. Keep the # severity branch anchored away from identifiers so environment lines diff --git a/tests/test_strix_nvidia_nim_not_found_fallback.py b/tests/test_strix_nvidia_nim_not_found_fallback.py index a48f3092d..656bea088 100644 --- a/tests/test_strix_nvidia_nim_not_found_fallback.py +++ b/tests/test_strix_nvidia_nim_not_found_fallback.py @@ -243,6 +243,18 @@ def test_outer_workflow_never_neutralizes_reported_vulnerabilities(self) -> None ) ) + def test_outer_workflow_neutralizes_fail_closed_after_provider_infra(self) -> None: + """Recognize the exact fail-closed line required CI prints after NIM exit 2.""" + + self.assertTrue( + _workflow_neutralizes( + "Strix run failed for model 'nvidia_nim/nvidia/nemotron-3-super-120b-a12b' " + "after 4778s (exit code 2).\n" + "Strix scan failed after provider infrastructure or failure-signal output; " + "failing closed.\n" + ) + ) + def test_workflow_neutralizes_only_nvidia_404_without_findings(self) -> None: """Retain the static fail-closed vulnerability evidence contract."""