Fix: [AEA-0000] - Always run valid trivy scans even if a previous scan failed, so that all vulnerabilities are identified at once. Shorten feedback cycle for vulnerabilities across multiple scans. (#78)

connoravo-nhs · tstephen-nhs · web-flow · commit d116ba935f2a · 2026-03-05T16:22:39.000Z
## Summary

- Routine Change

### Details

Always run required trivy vulnerability scans for all that apply, even
if the previous scan has identified vulnerabilities and has failed. This
shortens the feedback cycle for vulnerabilities across multiple scan
types.

---------

Signed-off-by: Connor Avery &lt;214469360+connoravo-nhs@users.noreply.github.com&gt;
Co-authored-by: tstephen-nhs &lt;231503406+tstephen-nhs@users.noreply.github.com&gt;
diff --git a/.github/workflows/quality-checks.yml b/.github/workflows/quality-checks.yml
@@ -263,7 +263,7 @@ jobs:
           path: sbom.cdx.json
 
       - name: Check python vulnerabilities
-        if: ${{ steps.check_languages.outputs.uses_poetry == 'true' }}
+        if: ${{ always() && steps.check_languages.outputs.uses_poetry == 'true'}}
         uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478
         with:
           scan-type: "fs"
@@ -276,7 +276,7 @@ jobs:
           exit-code: "1"
           trivy-config: trivy.yaml
       - name: Check node vulnerabilities
-        if: ${{ steps.check_languages.outputs.uses_node == 'true' }}
+        if: ${{ always() && steps.check_languages.outputs.uses_node == 'true' }}
         uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478
         with:
           scan-type: "fs"
@@ -289,7 +289,7 @@ jobs:
           exit-code: "1"
           trivy-config: trivy.yaml
       - name: Check go vulnerabilities
-        if: ${{ steps.check_languages.outputs.uses_go == 'true' }}
+        if: ${{ always() && steps.check_languages.outputs.uses_go == 'true' }}
         uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478
         with:
           scan-type: "fs"
@@ -301,7 +301,7 @@ jobs:
           output: "dependency_results_go.txt"
           exit-code: "1"
       - name: Check java vulnerabilities
-        if: ${{ steps.check_languages.outputs.uses_java == 'true' }}
+        if: ${{ always() && steps.check_languages.outputs.uses_java == 'true' }}
         uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478
         with:
           scan-type: "fs"
