TT-17509: Disable vulnerability scanning in S1 PR workflow

[probelabs]

Problem / Task

TT-17509: Disable vulnerability scanning in S1 PR workflow.

Changes

• Added vuln_enabled: false to the with block in .github/workflows/s1-cns-scans.yml.

Testing

• N/A (CI configuration change)

---

Trace: cde3f3f061b84d682cd29d1faf79a196
Requested by: @U02SC7C53TQ
Slack thread: https://tyktech.slack.com/archives/C09C27R77TL/p1785509297523669
Generated with Visor AI Assistant

Ticket Details

TT-17509

Status	Ready for Dev
Summary	Run S1 vulnerability scanner on a schedule and disable it on PRs

Generated at: 2026-08-03 10:56:25

[probelabs]

This PR disables the vulnerability scanning step in the s1-cns-scans.yml GitHub Actions workflow.

Files Changed Analysis

• .github/workflows/s1-cns-scans.yml: A single line, vuln_enabled: false, has been added. This is a configuration change to an existing CI workflow file.

Architecture & Impact Assessment

• What this PR accomplishes: It prevents the S1 vulnerability scan from running on pull requests, as defined in this specific workflow.
• Key technical changes introduced: A boolean parameter vuln_enabled is set to false for the GitHub Action being called in the s1-cns-scans job. This is a standard mechanism for toggling features within a reusable action.
• Affected system components: The change directly affects the repository's CI/CD pipeline. The primary impact is on the security validation process for pull requests, as one of the automated security checks will no longer be performed.

Scope Discovery & Context Expansion

• The change is narrowly focused on a single CI workflow configuration file.
• The immediate effect is a reduction in the automated security scanning coverage for code changes. The reasons for this change are likely detailed in the associated Jira ticket (TT-17509) and the linked Slack thread.
• To fully assess the impact, a reviewer should consider whether other workflows provide similar vulnerability scanning, ensuring this change doesn't leave a critical gap in the security process.

Metadata

• Review Effort: 1 / 5
• Primary Label: chore

---

Powered by Visor from Probelabs

Last updated: 2026-08-03T10:56:52.356Z | Triggered by: pr_opened | Commit: 90e4903

💡 TIP: You can chat with Visor using /visor ask <your question>

[probelabs]

Security Issues (1)

Severity	Location	Issue
🔴 Critical	.github/workflows/s1-cns-scans.yml:15	Vulnerability scanning has been explicitly disabled in the S1 pull request workflow. This action removes a critical security control designed to detect vulnerabilities in dependencies and application code. Disabling this scan significantly increases the risk of introducing and merging code with known security flaws, which could be exploited in production. 💡 Suggestion Re-enable the vulnerability scan by removing the `vuln_enabled: false` line. If the scan is being disabled due to performance issues, false positives, or other operational problems, those specific issues should be addressed and remediated rather than disabling the security control entirely. If this scanner is being replaced by another tool, ensure the new tool is active and provides equivalent or better coverage.

✅ Architecture Check Passed

No architecture issues found – changes LGTM.

✅ Performance Check Passed

No performance issues found – changes LGTM.

---

Powered by Visor from Probelabs

Last updated: 2026-08-03T10:56:34.489Z | Triggered by: pr_opened | Commit: 90e4903

💡 TIP: You can chat with Visor using /visor ask <your question>

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud