sast: adjust snyk to be the same with sonar

Signed-off-by: David Korczynski <[email protected]>
ossf · Dec 13, 2023 · 5789512 · 5789512
1 parent 3f06176
commit 5789512
Showing 1 changed file with 3 additions and 5 deletions.
diff --git a/checks/evaluation/sast.go b/checks/evaluation/sast.go
@@ -72,18 +72,16 @@ func SAST(name string,
 	if sonarScore == checker.MaxResultScore {
 		return checker.CreateMaxScoreResult(name, "SAST tool detected")
 	}
+	if snykScore == checker.MaxResultScore {
+		return checker.CreateMaxScoreResult(name, "SAST tool detected: Snyk")
+	}
 
 	if sastScore == checker.InconclusiveResultScore &&
 		codeQlScore == checker.InconclusiveResultScore {
 		// That can never happen since sastToolInCheckRuns can never
 		// retun checker.InconclusiveResultScore.
 		return checker.CreateRuntimeErrorResult(name, sce.ErrScorecardInternal)
 	}
-	if snykScore != checker.InconclusiveResultScore {
-		if snykScore == checker.MaxResultScore {
-			return checker.CreateMaxScoreResult(name, "SAST tool detected: Snyk")
-		}
-	}
 
 	// Both scores are conclusive.
 	// We assume the CodeQl config uses a cron and is not enabled as pre-submit.