[simar7]

Description

If there are no results returned upon processing an invalid policy, it should not be treated as an error as there are simply no errors that have actually taken place.

Checklist

• I've read the guidelines for contributing to this repository.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[Copilot]

Pull Request Overview

This PR fixes an issue where the policy evaluation system incorrectly treats invalid rego policies as errors when they produce no results. The change allows the system to handle invalid policies gracefully by returning empty results instead of failing with an error.

• Removes error handling that treated nil scan results as failures
• Updates test expectations to verify that invalid policies return empty results rather than errors
• Removes redundant test cases that were testing the same error condition

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
pkg/policy/policy.go	Removes the error condition that was triggered when scan results were nil
pkg/policy/policy_test.go	Updates test expectations and removes duplicate test cases for invalid policy handling

Comments suppressed due to low confidence (1)

pkg/policy/policy_test.go:549

• The test case expects empty results for an invalid policy, but there's no assertion to verify that no error is returned. Consider adding an explicit check that expectedError is empty or nil to ensure the fix is properly validated.

			results: []Result{}, // passing an invalid policy should not return any results but not an error

[Copilot]

Returning a nil scanResult without any validation could cause nil pointer dereferences in calling code. Consider returning an empty slice or struct instead of nil when no results are found.

Suggested change

	}
	}
	if scanResult == nil {
	scanResult = scan.Results{}
	}

[afdesk]

LGTM!
I tested it with next options:

$ helm install trivy-operator aquasecurity/trivy-operator --create-namespace --namespace trivy-system \
     --set image.repository=afdesk/trivy-operator --set image.tag=fix-invalid-logic \
     --set operator.scanJobTTL=30m --set trivy.resources.limits.memory=1Gi