Add error handling to Synopsys workflow wget and unzip commands

[Copilot]

Requires

• Add Synopsys Intelligent Security Scan workflow #5

Supports

Description

Addresses missing error handling in the Synopsys Intelligent Security Scan workflow. Without proper error handling, wget or unzip failures (network issues, invalid URLs, corrupted archives) would allow the workflow to continue, causing unclear downstream failures.

Changes

• Added set -e and set -o pipefail to the Static Analysis with Polaris step shell script
• Workflow now fails fast with clear error context when download or extraction fails

- name: Static Analysis with Polaris
  run: |
      set -e
      set -o pipefail
      export POLARIS_SERVER_URL=${{ secrets.POLARIS_SERVER_URL}}
      export POLARIS_ACCESS_TOKEN=${{ secrets.POLARIS_ACCESS_TOKEN}}
      wget -q ${{ secrets.POLARIS_SERVER_URL}}/api/tools/polaris_cli-linux64.zip
      unzip -j polaris_cli-linux64.zip -d /tmp
      /tmp/polaris analyze -w

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[Lawrence Lucas Large (LukeLarge)]

Add error handling to Synopsys workflow wget and unzip commands
#8

[Copilot]

Pull request overview

Improves the Synopsys Intelligent Security Scan GitHub Actions workflow by making the Polaris download/extract step fail fast when a command errors, reducing confusing downstream failures.

Changes:

• Added set -e to stop the step on first command failure.
• Added set -o pipefail to propagate failures through pipelines (when present).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The secret-expanded values should be quoted to avoid word-splitting/globbing if the URL/token contain special characters. Also, since POLARIS_SERVER_URL is exported, prefer using it for the wget URL to avoid duplicating the secret expression (and keep the command consistent with the exported env var).

Suggested change

	wget -q ${{ secrets.POLARIS_SERVER_URL}}/api/tools/polaris_cli-linux64.zip
	wget -q "${POLARIS_SERVER_URL}/api/tools/polaris_cli-linux64.zip"

[Copilot]

set -o pipefail is shell-dependent (works in bash, not in plain sh). To ensure consistent behavior across runners/config, explicitly set the step shell to bash (e.g., add shell: bash to this step).

Suggested change

	if: ${{steps.prescription.outputs.sastScan == 'true' }}
	if: ${{steps.prescription.outputs.sastScan == 'true' }}
	shell: bash

[Copilot]

Using wget -q can suppress useful diagnostics in logs, which works against the stated goal of providing clearer error context when downloads fail. Consider using a less-silent mode (e.g., -nv) or removing -q so failures are easier to diagnose from workflow output.

Suggested change

	wget -q ${{ secrets.POLARIS_SERVER_URL}}/api/tools/polaris_cli-linux64.zip
	wget -nv ${{ secrets.POLARIS_SERVER_URL}}/api/tools/polaris_cli-linux64.zip