Security suite failed (main @ 780161b)

The root `mise run security` suite failed in GitHub Actions. Use the log tail below and reproduce locally with the same command.

| Field | Value |
| --- | --- |
| Workflow run | [Security #22](https://github.com/aws-samples/sample-autonomous-cloud-coding-agents/actions/runs/33390577867) |
| Ref | `refs/heads/main` |
| SHA | [`780161b90048af3938f31249a48e0cec7a0a1129`](https://github.com/aws-samples/sample-autonomous-cloud-coding-agents/commit/780161b90048af3938f31249a48e0cec7a0a1129) |
| Actor | @krokoko |
| Event | `schedule` |

### Log tail (last 200 lines)

```text
raise a typed error that adds context (`raise XError(...) from exc`), or return a result shape that
encodes the failure. Logging alone is not enough — the failure must reach the caller. If this
fallback is intentional degraded-mode behavior, keep it and add on the return line "# nosemgrep: py-
silent-success-masking -- ".

1602┆ return []

agent/src/observability.py
❯❱ semgrep.py-silent-success-masking
❰❰ Blocking ❱❱
This except block swallows the error and returns an empty default, so the caller cannot distinguish
failure from a genuinely empty result (silent-success masking, AI004). Fix: re-raise (`raise`),
raise a typed error that adds context (`raise XError(...) from exc`), or return a result shape that
encodes the failure. Logging alone is not enough — the failure must reach the caller. If this
fallback is intentional degraded-mode behavior, keep it and add on the return line "# nosemgrep: py-
silent-success-masking -- ".

86┆ return None

agent/src/server.py
❯❱ semgrep.py-silent-success-masking
❰❰ Blocking ❱❱
This except block swallows the error and returns an empty default, so the caller cannot distinguish
failure from a genuinely empty result (silent-success masking, AI004). Fix: re-raise (`raise`),
raise a typed error that adds context (`raise XError(...) from exc`), or return a result shape that
encodes the failure. Logging alone is not enough — the failure must reach the caller. If this
fallback is intentional degraded-mode behavior, keep it and add on the return line "# nosemgrep: py-
silent-success-masking -- ".

1447┆ return ""

cdk/src/handlers/github-webhook-processor.ts
❯❱ semgrep.ts-silent-success-masking
❰❰ Blocking ❱❱
This catch block swallows the error and returns an empty default, so the caller cannot distinguish
failure from a genuinely empty result (silent-success masking, AI004). Fix: re-throw (`throw err;`),
throw a typed error that adds context, or return a result shape that encodes the failure. Logging
alone is not enough — the failure must reach the caller. If this fallback is intentional degraded-
mode behavior, keep it and add on the return line "// nosemgrep: ts-silent-success-masking -- ".

448┆ return null;

cdk/src/handlers/jira-webhook-processor.ts
❯❱ semgrep.ts-silent-success-masking
❰❰ Blocking ❱❱
This catch block swallows the error and returns an empty default, so the caller cannot distinguish
failure from a genuinely empty result (silent-success masking, AI004). Fix: re-throw (`throw err;`),
throw a typed error that adds context, or return a result shape that encodes the failure. Logging
alone is not enough — the failure must reach the caller. If this fallback is intentional degraded-
mode behavior, keep it and add on the return line "// nosemgrep: ts-silent-success-masking -- ".

1530┆ return [];

cdk/src/handlers/linear-webhook-processor.ts
❯❱ semgrep.ts-silent-success-masking
❰❰ Blocking ❱❱
This catch block swallows the error and returns an empty default, so the caller cannot distinguish
failure from a genuinely empty result (silent-success masking, AI004). Fix: re-throw (`throw err;`),
throw a typed error that adds context, or return a result shape that encodes the failure. Logging
alone is not enough — the failure must reach the caller. If this fallback is intentional degraded-
mode behavior, keep it and add on the return line "// nosemgrep: ts-silent-success-masking -- ".

532┆ return null;
⋮┆----------------------------------------
2757┆ return null;
⋮┆----------------------------------------
3057┆ return [];
⋮┆----------------------------------------
3108┆ return [];

cdk/src/handlers/orchestration-reconciler.ts
❯❱ semgrep.ts-silent-success-masking
❰❰ Blocking ❱❱
This catch block swallows the error and returns an empty default, so the caller cannot distinguish
failure from a genuinely empty result (silent-success masking, AI004). Fix: re-throw (`throw err;`),
throw a typed error that adds context, or return a result shape that encodes the failure. Logging
alone is not enough — the failure must reach the caller. If this fallback is intentional degraded-
mode behavior, keep it and add on the return line "// nosemgrep: ts-silent-success-masking -- ".

471┆ return null;
⋮┆----------------------------------------
1455┆ return null;
⋮┆----------------------------------------
1476┆ return null;

cdk/src/handlers/registry-publish.ts
❯❱ semgrep.ts-silent-success-masking
❰❰ Blocking ❱❱
This catch block swallows the error and returns an empty default, so the caller cannot distinguish
failure from a genuinely empty result (silent-success masking, AI004). Fix: re-throw (`throw err;`),
throw a typed error that adds context, or return a result shape that encodes the failure. Logging
alone is not enough — the failure must reach the caller. If this fallback is intentional degraded-
mode behavior, keep it and add on the return line "// nosemgrep: ts-silent-success-masking -- ".

116┆ return null;

cdk/src/handlers/shared/jira-feedback.ts
❯❱ semgrep.ts-silent-success-masking
❰❰ Blocking ❱❱
This catch block swallows the error and returns an empty default, so the caller cannot distinguish
failure from a genuinely empty result (silent-success masking, AI004). Fix: re-throw (`throw err;`),
throw a typed error that adds context, or return a result shape that encodes the failure. Logging
alone is not enough — the failure must reach the caller. If this fallback is intentional degraded-
mode behavior, keep it and add on the return line "// nosemgrep: ts-silent-success-masking -- ".

372┆ return null;
⋮┆----------------------------------------
395┆ return null;

cdk/src/handlers/shared/linear-feedback.ts
❯❱ semgrep.ts-silent-success-masking
❰❰ Blocking ❱❱
This catch block swallows the error and returns an empty default, so the caller cannot distinguish
failure from a genuinely empty result (silent-success masking, AI004). Fix: re-throw (`throw err;`),
throw a typed error that adds context, or return a result shape that encodes the failure. Logging
alone is not enough — the failure must reach the caller. If this fallback is intentional degraded-
mode behavior, keep it and add on the return line "// nosemgrep: ts-silent-success-masking -- ".

280┆ return null;

cdk/src/handlers/shared/linear-subissue-fetch.ts
❯❱ semgrep.ts-silent-success-masking
❰❰ Blocking ❱❱
This catch block swallows the error and returns an empty default, so the caller cannot distinguish
failure from a genuinely empty result (silent-success masking, AI004). Fix: re-throw (`throw err;`),
throw a typed error that adds context, or return a result shape that encodes the failure. Logging
alone is not enough — the failure must reach the caller. If this fallback is intentional degraded-
mode behavior, keep it and add on the return line "// nosemgrep: ts-silent-success-masking -- ".

333┆ return null;

cdk/src/handlers/shared/orchestration-rollup.ts
❯❱ semgrep.ts-silent-success-masking
❰❰ Blocking ❱❱
This catch block swallows the error and returns an empty default, so the caller cannot distinguish
failure from a genuinely empty result (silent-success masking, AI004). Fix: re-throw (`throw err;`),
throw a typed error that adds context, or return a result shape that encodes the failure. Logging
alone is not enough — the failure must reach the caller. If this fallback is intentional degraded-
mode behavior, keep it and add on the return line "// nosemgrep: ts-silent-success-masking -- ".

490┆ return null;

cdk/src/handlers/shared/orchestration-store.ts
❯❱ semgrep.ts-silent-success-masking
❰❰ Blocking ❱❱
This catch block swallows the error and returns an empty default, so the caller cannot distinguish
failure from a genuinely empty result (silent-success masking, AI004). Fix: re-throw (`throw err;`),
throw a typed error that adds context, or return a result shape that encodes the failure. Logging
alone is not enough — the failure must reach the caller. If this fallback is intentional degraded-
mode behavior, keep it and add on the return line "// nosemgrep: ts-silent-success-masking -- ".

344┆ return [];

cdk/src/handlers/shared/slack-api.ts
❯❱ semgrep.ts-silent-success-masking
❰❰ Blocking ❱❱
This catch block swallows the error and returns an empty default, so the caller cannot distinguish
failure from a genuinely empty result (silent-success masking, AI004). Fix: re-throw (`throw err;`),
throw a typed error that adds context, or return a result shape that encodes the failure. Logging
alone is not enough — the failure must reach the caller. If this fallback is intentional degraded-
mode behavior, keep it and add on the return line "// nosemgrep: ts-silent-success-masking -- ".

112┆ return null;

cli/src/commands/linear.ts
❯❱ semgrep.ts-silent-success-masking
❰❰ Blocking ❱❱
This catch block swallows the error and returns an empty default, so the caller cannot distinguish
failure from a genuinely empty result (silent-success masking, AI004). Fix: re-throw (`throw err;`),
throw a typed error that adds context, or return a result shape that encodes the failure. Logging
alone is not enough — the failure must reach the caller. If this fallback is intentional degraded-
mode behavior, keep it and add on the return line "// nosemgrep: ts-silent-success-masking -- ".

1721┆ return [];

cli/src/linear-oauth.ts
❯❱ semgrep.ts-silent-success-masking
❰❰ Blocking ❱❱
This catch block swallows the error and returns an empty default, so the caller cannot distinguish
failure from a genuinely empty result (silent-success masking, AI004). Fix: re-throw (`throw err;`),
throw a typed error that adds context, or return a result shape that encodes the failure. Logging
alone is not enough — the failure must reach the caller. If this fallback is intentional degraded-
mode behavior, keep it and add on the return line "// nosemgrep: ts-silent-success-masking -- ".

382┆ if (isNotFound(err)) return undefined; // genuine first install

[//:security:sast:masking] ERROR task failed
```

Close this issue after `mise run security` succeeds on `main` (or the branch you merge to).

Run `mise run security` locally and review the Semgrep findings in agent/src/observability.py, agent/src/server.py, and the listed cdk/src/handlers files. Trace each flagged fallback to its caller, then rerun the security suite; done means the workflow passes or intentional degraded-mode cases are explicitly justified as requested by the log.

Written by the indexing model from the issue text.