fallback is intentional degraded-mode behavior, keep it and add on the return line "# nosemgrep: py-
silent-success-masking -- <why callers may safely treat this failure as an empty success>".
86┆ return None
agent/src/registry/agentcore_client.py
❯❱ semgrep.py-silent-success-masking
❰❰ Blocking ❱❱
This except block swallows the error and returns an empty default, so the caller cannot distinguish
failure from a genuinely empty result (silent-success masking, AI004). Fix: re-raise (`raise`),
raise a typed error that adds context (`raise XError(...) from exc`), or return a result shape that
encodes the failure. Logging alone is not enough — the failure must reach the caller. If this
fallback is intentional degraded-mode behavior, keep it and add on the return line "# nosemgrep: py-
silent-success-masking -- <why callers may safely treat this failure as an empty success>".
84┆ return {}
cdk/src/handlers/github-webhook-processor.ts
❯❱ semgrep.ts-silent-success-masking
❰❰ Blocking ❱❱
This catch block swallows the error and returns an empty default, so the caller cannot distinguish
failure from a genuinely empty result (silent-success masking, AI004). Fix: re-throw (`throw err;`),
throw a typed error that adds context, or return a result shape that encodes the failure. Logging
alone is not enough — the failure must reach the caller. If this fallback is intentional degraded-
mode behavior, keep it and add on the return line "// nosemgrep: ts-silent-success-masking -- <why
callers may safely treat this failure as an empty success>".
448┆ return null;
cdk/src/handlers/jira-webhook-processor.ts
❯❱ semgrep.ts-silent-success-masking
❰❰ Blocking ❱❱
This catch block swallows the error and returns an empty default, so the caller cannot distinguish
failure from a genuinely empty result (silent-success masking, AI004). Fix: re-throw (`throw err;`),
throw a typed error that adds context, or return a result shape that encodes the failure. Logging
alone is not enough — the failure must reach the caller. If this fallback is intentional degraded-
mode behavior, keep it and add on the return line "// nosemgrep: ts-silent-success-masking -- <why
callers may safely treat this failure as an empty success>".
1530┆ return [];
cdk/src/handlers/linear-webhook-processor.ts
❯❱ semgrep.ts-silent-success-masking
❰❰ Blocking ❱❱
This catch block swallows the error and returns an empty default, so the caller cannot distinguish
failure from a genuinely empty result (silent-success masking, AI004). Fix: re-throw (`throw err;`),
throw a typed error that adds context, or return a result shape that encodes the failure. Logging
alone is not enough — the failure must reach the caller. If this fallback is intentional degraded-
mode behavior, keep it and add on the return line "// nosemgrep: ts-silent-success-masking -- <why
callers may safely treat this failure as an empty success>".
532┆ return null;
⋮┆----------------------------------------
2757┆ return null;
⋮┆----------------------------------------
3057┆ return [];
⋮┆----------------------------------------
3108┆ return [];
cdk/src/handlers/orchestration-reconciler.ts
❯❱ semgrep.ts-silent-success-masking
❰❰ Blocking ❱❱
This catch block swallows the error and returns an empty default, so the caller cannot distinguish
failure from a genuinely empty result (silent-success masking, AI004). Fix: re-throw (`throw err;`),
throw a typed error that adds context, or return a result shape that encodes the failure. Logging
alone is not enough — the failure must reach the caller. If this fallback is intentional degraded-
mode behavior, keep it and add on the return line "// nosemgrep: ts-silent-success-masking -- <why
callers may safely treat this failure as an empty success>".
471┆ return null;
⋮┆----------------------------------------
1455┆ return null;
⋮┆----------------------------------------
1476┆ return null;
cdk/src/handlers/registry-publish.ts
❯❱ semgrep.ts-silent-success-masking
❰❰ Blocking ❱❱
This catch block swallows the error and returns an empty default, so the caller cannot distinguish
failure from a genuinely empty result (silent-success masking, AI004). Fix: re-throw (`throw err;`),
throw a typed error that adds context, or return a result shape that encodes the failure. Logging
alone is not enough — the failure must reach the caller. If this fallback is intentional degraded-
mode behavior, keep it and add on the return line "// nosemgrep: ts-silent-success-masking -- <why
callers may safely treat this failure as an empty success>".
116┆ return null;
cdk/src/handlers/shared/jira-feedback.ts
❯❱ semgrep.ts-silent-success-masking
❰❰ Blocking ❱❱
This catch block swallows the error and returns an empty default, so the caller cannot distinguish
failure from a genuinely empty result (silent-success masking, AI004). Fix: re-throw (`throw err;`),
throw a typed error that adds context, or return a result shape that encodes the failure. Logging
alone is not enough — the failure must reach the caller. If this fallback is intentional degraded-
mode behavior, keep it and add on the return line "// nosemgrep: ts-silent-success-masking -- <why
callers may safely treat this failure as an empty success>".
372┆ return null;
⋮┆----------------------------------------
395┆ return null;
cdk/src/handlers/shared/linear-feedback.ts
❯❱ semgrep.ts-silent-success-masking
❰❰ Blocking ❱❱
This catch block swallows the error and returns an empty default, so the caller cannot distinguish
failure from a genuinely empty result (silent-success masking, AI004). Fix: re-throw (`throw err;`),
throw a typed error that adds context, or return a result shape that encodes the failure. Logging
alone is not enough — the failure must reach the caller. If this fallback is intentional degraded-
mode behavior, keep it and add on the return line "// nosemgrep: ts-silent-success-masking -- <why
callers may safely treat this failure as an empty success>".
280┆ return null;
cdk/src/handlers/shared/linear-subissue-fetch.ts
❯❱ semgrep.ts-silent-success-masking
❰❰ Blocking ❱❱
This catch block swallows the error and returns an empty default, so the caller cannot distinguish
failure from a genuinely empty result (silent-success masking, AI004). Fix: re-throw (`throw err;`),
throw a typed error that adds context, or return a result shape that encodes the failure. Logging
alone is not enough — the failure must reach the caller. If this fallback is intentional degraded-
mode behavior, keep it and add on the return line "// nosemgrep: ts-silent-success-masking -- <why
callers may safely treat this failure as an empty success>".
333┆ return null;
cdk/src/handlers/shared/orchestration-rollup.ts
❯❱ semgrep.ts-silent-success-masking
❰❰ Blocking ❱❱
This catch block swallows the error and returns an empty default, so the caller cannot distinguish
failure from a genuinely empty result (silent-success masking, AI004). Fix: re-throw (`throw err;`),
throw a typed error that adds context, or return a result shape that encodes the failure. Logging
alone is not enough — the failure must reach the caller. If this fallback is intentional degraded-
mode behavior, keep it and add on the return line "// nosemgrep: ts-silent-success-masking -- <why
callers may safely treat this failure as an empty success>".
490┆ return null;
cdk/src/handlers/shared/orchestration-store.ts
❯❱ semgrep.ts-silent-success-masking
❰❰ Blocking ❱❱
This catch block swallows the error and returns an empty default, so the caller cannot distinguish
failure from a genuinely empty result (silent-success masking, AI004). Fix: re-throw (`throw err;`),
throw a typed error that adds context, or return a result shape that encodes the failure. Logging
alone is not enough — the failure must reach the caller. If this fallback is intentional degraded-
mode behavior, keep it and add on the return line "// nosemgrep: ts-silent-success-masking -- <why
callers may safely treat this failure as an empty success>".
344┆ return [];
cdk/src/handlers/shared/registry/agentcore-client.ts
❯❱ semgrep.ts-silent-success-masking
❰❰ Blocking ❱❱
This catch block swallows the error and returns an empty default, so the caller cannot distinguish
failure from a genuinely empty result (silent-success masking, AI004). Fix: re-throw (`throw err;`),
throw a typed error that adds context, or return a result shape that encodes the failure. Logging
alone is not enough — the failure must reach the caller. If this fallback is intentional degraded-
mode behavior, keep it and add on the return line "// nosemgrep: ts-silent-success-masking -- <why
callers may safely treat this failure as an empty success>".
158┆ return {};
⋮┆----------------------------------------
432┆ if (err instanceof ResourceNotFoundException) return null;
cdk/src/handlers/shared/slack-api.ts
❯❱ semgrep.ts-silent-success-masking
❰❰ Blocking ❱❱
This catch block swallows the error and returns an empty default, so the caller cannot distinguish
failure from a genuinely empty result (silent-success masking, AI004). Fix: re-throw (`throw err;`),
throw a typed error that adds context, or return a result shape that encodes the failure. Logging
alone is not enough — the failure must reach the caller. If this fallback is intentional degraded-
mode behavior, keep it and add on the return line "// nosemgrep: ts-silent-success-masking -- <why
callers may safely treat this failure as an empty success>".
112┆ return null;
cli/src/commands/linear.ts
❯❱ semgrep.ts-silent-success-masking
❰❰ Blocking ❱❱
This catch block swallows the error and returns an empty default, so the caller cannot distinguish
failure from a genuinely empty result (silent-success masking, AI004). Fix: re-throw (`throw err;`),
throw a typed error that adds context, or return a result shape that encodes the failure. Logging
alone is not enough — the failure must reach the caller. If this fallback is intentional degraded-
mode behavior, keep it and add on the return line "// nosemgrep: ts-silent-success-masking -- <why
callers may safely treat this failure as an empty success>".
1721┆ return [];
cli/src/linear-oauth.ts
❯❱ semgrep.ts-silent-success-masking
❰❰ Blocking ❱❱
This catch block swallows the error and returns an empty default, so the caller cannot distinguish
failure from a genuinely empty result (silent-success masking, AI004). Fix: re-throw (`throw err;`),
throw a typed error that adds context, or return a result shape that encodes the failure. Logging
alone is not enough — the failure must reach the caller. If this fallback is intentional degraded-
mode behavior, keep it and add on the return line "// nosemgrep: ts-silent-success-masking -- <why
callers may safely treat this failure as an empty success>".
382┆ if (isNotFound(err)) return undefined; // genuine first install
�[35m�[2m[//:security:sast:masking]�[0m �[31mERROR�[0m task failed
The root
mise run securitysuite failed in GitHub Actions. Use the log tail below and reproduce locally with the same command.refs/heads/main2cee8800c26ac33cfc3acd782be0da61727b548fscheduleLog tail (last 200 lines)
Close this issue after
mise run securitysucceeds onmain(or the branch you merge to).