Security suite failed (main @ 2cee880)

The root `mise run security` suite failed in GitHub Actions. Use the log tail below and reproduce locally with the same command.

| Field | Value |
| --- | --- |
| Workflow run | [Security #21](https://github.com/aws-samples/sample-autonomous-cloud-coding-agents/actions/runs/32725446461) |
| Ref | `refs/heads/main` |
| SHA | [`2cee8800c26ac33cfc3acd782be0da61727b548f`](https://github.com/aws-samples/sample-autonomous-cloud-coding-agents/commit/2cee8800c26ac33cfc3acd782be0da61727b548f) |
| Actor | @krokoko |
| Event | `schedule` |

### Log tail (last 200 lines)

```text
fallback is intentional degraded-mode behavior, keep it and add on the return line "# nosemgrep: py-
silent-success-masking -- ".

86┆ return None

agent/src/registry/agentcore_client.py
❯❱ semgrep.py-silent-success-masking
❰❰ Blocking ❱❱
This except block swallows the error and returns an empty default, so the caller cannot distinguish
failure from a genuinely empty result (silent-success masking, AI004). Fix: re-raise (`raise`),
raise a typed error that adds context (`raise XError(...) from exc`), or return a result shape that
encodes the failure. Logging alone is not enough — the failure must reach the caller. If this
fallback is intentional degraded-mode behavior, keep it and add on the return line "# nosemgrep: py-
silent-success-masking -- ".

84┆ return {}

cdk/src/handlers/github-webhook-processor.ts
❯❱ semgrep.ts-silent-success-masking
❰❰ Blocking ❱❱
This catch block swallows the error and returns an empty default, so the caller cannot distinguish
failure from a genuinely empty result (silent-success masking, AI004). Fix: re-throw (`throw err;`),
throw a typed error that adds context, or return a result shape that encodes the failure. Logging
alone is not enough — the failure must reach the caller. If this fallback is intentional degraded-
mode behavior, keep it and add on the return line "// nosemgrep: ts-silent-success-masking -- ".

448┆ return null;

cdk/src/handlers/jira-webhook-processor.ts
❯❱ semgrep.ts-silent-success-masking
❰❰ Blocking ❱❱
This catch block swallows the error and returns an empty default, so the caller cannot distinguish
failure from a genuinely empty result (silent-success masking, AI004). Fix: re-throw (`throw err;`),
throw a typed error that adds context, or return a result shape that encodes the failure. Logging
alone is not enough — the failure must reach the caller. If this fallback is intentional degraded-
mode behavior, keep it and add on the return line "// nosemgrep: ts-silent-success-masking -- ".

1530┆ return [];

cdk/src/handlers/linear-webhook-processor.ts
❯❱ semgrep.ts-silent-success-masking
❰❰ Blocking ❱❱
This catch block swallows the error and returns an empty default, so the caller cannot distinguish
failure from a genuinely empty result (silent-success masking, AI004). Fix: re-throw (`throw err;`),
throw a typed error that adds context, or return a result shape that encodes the failure. Logging
alone is not enough — the failure must reach the caller. If this fallback is intentional degraded-
mode behavior, keep it and add on the return line "// nosemgrep: ts-silent-success-masking -- ".

532┆ return null;
⋮┆----------------------------------------
2757┆ return null;
⋮┆----------------------------------------
3057┆ return [];
⋮┆----------------------------------------
3108┆ return [];

cdk/src/handlers/orchestration-reconciler.ts
❯❱ semgrep.ts-silent-success-masking
❰❰ Blocking ❱❱
This catch block swallows the error and returns an empty default, so the caller cannot distinguish
failure from a genuinely empty result (silent-success masking, AI004). Fix: re-throw (`throw err;`),
throw a typed error that adds context, or return a result shape that encodes the failure. Logging
alone is not enough — the failure must reach the caller. If this fallback is intentional degraded-
mode behavior, keep it and add on the return line "// nosemgrep: ts-silent-success-masking -- ".

471┆ return null;
⋮┆----------------------------------------
1455┆ return null;
⋮┆----------------------------------------
1476┆ return null;

cdk/src/handlers/registry-publish.ts
❯❱ semgrep.ts-silent-success-masking
❰❰ Blocking ❱❱
This catch block swallows the error and returns an empty default, so the caller cannot distinguish
failure from a genuinely empty result (silent-success masking, AI004). Fix: re-throw (`throw err;`),
throw a typed error that adds context, or return a result shape that encodes the failure. Logging
alone is not enough — the failure must reach the caller. If this fallback is intentional degraded-
mode behavior, keep it and add on the return line "// nosemgrep: ts-silent-success-masking -- ".

116┆ return null;

cdk/src/handlers/shared/jira-feedback.ts
❯❱ semgrep.ts-silent-success-masking
❰❰ Blocking ❱❱
This catch block swallows the error and returns an empty default, so the caller cannot distinguish
failure from a genuinely empty result (silent-success masking, AI004). Fix: re-throw (`throw err;`),
throw a typed error that adds context, or return a result shape that encodes the failure. Logging
alone is not enough — the failure must reach the caller. If this fallback is intentional degraded-
mode behavior, keep it and add on the return line "// nosemgrep: ts-silent-success-masking -- ".

372┆ return null;
⋮┆----------------------------------------
395┆ return null;

cdk/src/handlers/shared/linear-feedback.ts
❯❱ semgrep.ts-silent-success-masking
❰❰ Blocking ❱❱
This catch block swallows the error and returns an empty default, so the caller cannot distinguish
failure from a genuinely empty result (silent-success masking, AI004). Fix: re-throw (`throw err;`),
throw a typed error that adds context, or return a result shape that encodes the failure. Logging
alone is not enough — the failure must reach the caller. If this fallback is intentional degraded-
mode behavior, keep it and add on the return line "// nosemgrep: ts-silent-success-masking -- ".

280┆ return null;

cdk/src/handlers/shared/linear-subissue-fetch.ts
❯❱ semgrep.ts-silent-success-masking
❰❰ Blocking ❱❱
This catch block swallows the error and returns an empty default, so the caller cannot distinguish
failure from a genuinely empty result (silent-success masking, AI004). Fix: re-throw (`throw err;`),
throw a typed error that adds context, or return a result shape that encodes the failure. Logging
alone is not enough — the failure must reach the caller. If this fallback is intentional degraded-
mode behavior, keep it and add on the return line "// nosemgrep: ts-silent-success-masking -- ".

333┆ return null;

cdk/src/handlers/shared/orchestration-rollup.ts
❯❱ semgrep.ts-silent-success-masking
❰❰ Blocking ❱❱
This catch block swallows the error and returns an empty default, so the caller cannot distinguish
failure from a genuinely empty result (silent-success masking, AI004). Fix: re-throw (`throw err;`),
throw a typed error that adds context, or return a result shape that encodes the failure. Logging
alone is not enough — the failure must reach the caller. If this fallback is intentional degraded-
mode behavior, keep it and add on the return line "// nosemgrep: ts-silent-success-masking -- ".

490┆ return null;

cdk/src/handlers/shared/orchestration-store.ts
❯❱ semgrep.ts-silent-success-masking
❰❰ Blocking ❱❱
This catch block swallows the error and returns an empty default, so the caller cannot distinguish
failure from a genuinely empty result (silent-success masking, AI004). Fix: re-throw (`throw err;`),
throw a typed error that adds context, or return a result shape that encodes the failure. Logging
alone is not enough — the failure must reach the caller. If this fallback is intentional degraded-
mode behavior, keep it and add on the return line "// nosemgrep: ts-silent-success-masking -- ".

344┆ return [];

cdk/src/handlers/shared/registry/agentcore-client.ts
❯❱ semgrep.ts-silent-success-masking
❰❰ Blocking ❱❱
This catch block swallows the error and returns an empty default, so the caller cannot distinguish
failure from a genuinely empty result (silent-success masking, AI004). Fix: re-throw (`throw err;`),
throw a typed error that adds context, or return a result shape that encodes the failure. Logging
alone is not enough — the failure must reach the caller. If this fallback is intentional degraded-
mode behavior, keep it and add on the return line "// nosemgrep: ts-silent-success-masking -- ".

158┆ return {};
⋮┆----------------------------------------
432┆ if (err instanceof ResourceNotFoundException) return null;

cdk/src/handlers/shared/slack-api.ts
❯❱ semgrep.ts-silent-success-masking
❰❰ Blocking ❱❱
This catch block swallows the error and returns an empty default, so the caller cannot distinguish
failure from a genuinely empty result (silent-success masking, AI004). Fix: re-throw (`throw err;`),
throw a typed error that adds context, or return a result shape that encodes the failure. Logging
alone is not enough — the failure must reach the caller. If this fallback is intentional degraded-
mode behavior, keep it and add on the return line "// nosemgrep: ts-silent-success-masking -- ".

112┆ return null;

cli/src/commands/linear.ts
❯❱ semgrep.ts-silent-success-masking
❰❰ Blocking ❱❱
This catch block swallows the error and returns an empty default, so the caller cannot distinguish
failure from a genuinely empty result (silent-success masking, AI004). Fix: re-throw (`throw err;`),
throw a typed error that adds context, or return a result shape that encodes the failure. Logging
alone is not enough — the failure must reach the caller. If this fallback is intentional degraded-
mode behavior, keep it and add on the return line "// nosemgrep: ts-silent-success-masking -- ".

1721┆ return [];

cli/src/linear-oauth.ts
❯❱ semgrep.ts-silent-success-masking
❰❰ Blocking ❱❱
This catch block swallows the error and returns an empty default, so the caller cannot distinguish
failure from a genuinely empty result (silent-success masking, AI004). Fix: re-throw (`throw err;`),
throw a typed error that adds context, or return a result shape that encodes the failure. Logging
alone is not enough — the failure must reach the caller. If this fallback is intentional degraded-
mode behavior, keep it and add on the return line "// nosemgrep: ts-silent-success-masking -- ".

382┆ if (isNotFound(err)) return undefined; // genuine first install

[//:security:sast:masking] ERROR task failed
```

Close this issue after `mise run security` succeeds on `main` (or the branch you merge to).

Start by running the root `mise run security` command and compare the output with the linked GitHub Actions run. Review the reported findings in `agent/src/registry/agentcore_client.py` and the listed files under `cdk/src/handlers/`, then confirm that every finding is fixed or has an explicit justified suppression and that the security suite passes.

Written by the indexing model from the issue text.