Update Wiz policy names with Test - Bala: prefix

Author: bsubramaniam-ib

.github/workflows/wiz-security-scan-reusable.yaml

@@ -207,26 +207,41 @@ jobs:
         timeout-minutes: ${{ inputs.scan-timeout-minutes }}
         run: |
           set +e
-          wiz docker scan \
+          
+          # Capture both stdout and stderr to detect policy name errors
+          SCAN_OUTPUT=$(wiz docker scan \
             -i scan-target:${{ github.sha }} \
-            -p "Code Blocking - Vulnerabilities" \
-            -p "Code Blocking - Secrets" \
-            -p "Code Blocking - Malware" \
+            -p "Test - Bala: Code Blocking - Vulnerabilities" \
+            -p "Test - Bala: Code Blocking - Secrets" \
+            -p "Test - Bala: Code Blocking - Malware" \
             --format json \
             --file-hashes-scan \
-            --output wiz-results-raw.json,json
+            --output wiz-results-raw.json,json 2>&1)
           
           SCAN_EXIT_CODE=$?
           echo "scan_exit_code=${SCAN_EXIT_CODE}" >> $GITHUB_OUTPUT
           
-          # Wiz CLI may append warning messages after the JSON output in the file
-          # Extract only the first line which contains the valid JSON object
-          if [ -f "wiz-results-raw.json" ]; then
+          # Check for policy not found errors
+          if echo "$SCAN_OUTPUT" | grep -q "Policies not found"; then
+            echo "::error::Wiz policies not found. The policy names in the workflow may have changed in Wiz Console."
+            echo "::error::Expected policies: 'Test - Bala: Code Blocking - Vulnerabilities', 'Test - Bala: Code Blocking - Secrets', 'Test - Bala: Code Blocking - Malware'"
+            echo "::error::Please verify the exact policy names in Wiz Console and update the workflow accordingly."
+            echo "::error::Full error: $SCAN_OUTPUT"
+            
+            # Create empty results file for graceful degradation
+            echo '{"result":{"analytics":{"vulnerabilities":{},"secrets":{},"malware":{}}}}' > wiz-results.json
+            echo "policy_error=true" >> $GITHUB_OUTPUT
+          elif [ -f "wiz-results-raw.json" ]; then
+            # Wiz CLI may append warning messages after the JSON output in the file
+            # Extract only the first line which contains the valid JSON object
             head -1 wiz-results-raw.json > wiz-results.json
             rm wiz-results-raw.json
+            echo "policy_error=false" >> $GITHUB_OUTPUT
           else
             echo "::error::Wiz scan did not produce results file"
+            echo "::error::Scan output: $SCAN_OUTPUT"
             echo '{"result":{"analytics":{"vulnerabilities":{},"secrets":{},"malware":{}}}}' > wiz-results.json
+            echo "policy_error=false" >> $GITHUB_OUTPUT
           fi
           
           # Validate JSON
@@ -413,7 +428,29 @@ jobs:
             echo "### Build BLOCKED: Security Policy Violations" >> $GITHUB_STEP_SUMMARY
             echo "" >> $GITHUB_STEP_SUMMARY
             echo "**Failed Policies:** ${FAILED_POLICIES}" >> $GITHUB_STEP_SUMMARY
+            
+          
+          # Add configuration warning if policies not found
+          POLICY_ERROR="${{ steps.scan.outputs.policy_error }}"
+          if [ "${POLICY_ERROR}" = "true" ]; then
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "---" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "### ⚠️ Configuration Error: Wiz Policies Not Found" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "The Wiz security scan failed because the configured policy names do not exist in Wiz Console." >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "**Expected Policies:**" >> $GITHUB_STEP_SUMMARY
+            echo "- \`Test - Bala: Code Blocking - Vulnerabilities\`" >> $GITHUB_STEP_SUMMARY
+            echo "- \`Test - Bala: Code Blocking - Secrets\`" >> $GITHUB_STEP_SUMMARY
+            echo "- \`Test - Bala: Code Blocking - Malware\`" >> $GITHUB_STEP_SUMMARY
             echo "" >> $GITHUB_STEP_SUMMARY
+            echo "**Action Required:**" >> $GITHUB_STEP_SUMMARY
+            echo "1. Verify the exact policy names in Wiz Console" >> $GITHUB_STEP_SUMMARY
+            echo "2. Update the policy names in the workflow file: \`.github/workflows/wiz-security-scan-reusable.yaml\`" >> $GITHUB_STEP_SUMMARY
+            echo "3. Re-run the workflow" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+          fiecho "" >> $GITHUB_STEP_SUMMARY
             echo "**This PR cannot be merged until these issues are resolved.**" >> $GITHUB_STEP_SUMMARY
             echo "" >> $GITHUB_STEP_SUMMARY
             echo "**Required Actions:**" >> $GITHUB_STEP_SUMMARY
@@ -503,14 +540,25 @@ jobs:
               await github.rest.issues.createComment({
                 owner: context.repo.owner,
                 repo: context.repo.repo,
-                issue_number: context.issue.number,
-                body: summary
-              });
-            }
-      
-      - name: Upload scan results
-        if: always()
-        uses: actions/upload-artifact@v4
+          # Check if this is a policy configuration error vs actual security violations
+          if [ "${{ steps.scan.outputs.policy_error }}" = "true" ]; then
+            echo "::error::Wiz scan failed due to policy configuration error"
+            echo "::error::The configured policy names do not exist in Wiz Console"
+            echo "::error::Please update the policy names in the workflow and re-run"
+            echo ""
+            echo "Expected policies: 'Test - Bala: Code Blocking - Vulnerabilities', 'Test - Bala: Code Blocking - Secrets', 'Test - Bala: Code Blocking - Malware'"
+            echo ""
+            echo "This build is BLOCKED due to configuration error."
+          else
+            echo "::error::Security scan failed - Policy violations detected"
+            echo "::error::Failed policies: ${{ steps.scan.outputs.failed_policies }}"
+            echo ""
+            echo "Critical/High vulnerabilities: ${{ steps.scan.outputs.vuln_critical }}/${{ steps.scan.outputs.vuln_high }}"
+            echo "Secrets detected: ${{ steps.scan.outputs.secrets_total }}"
+            echo "Malware detected: ${{ steps.scan.outputs.malware_total }}"
+            echo ""
+            echo "This build is BLOCKED until security issues are resolved."
+          fi
         with:
           name: wiz-scan-results-${{ github.sha }}
           path: wiz-results.json