DefectDojo Reimport When Scans Are Empty
The Trivy and DefectDojo writing post covered import versus reimport and the skip path when secrets are missing. A quieter bug showed up later: when the latest scan is empty, skipping the API call leaves yesterday's HIGH findings open in the engagement.
Two follow-up commits fixed reimport on empty scans so a clean push closes stale findings. This article is the why — empty is a result, not an absence of work.
Gitleaks and Trivy write report files even when findings.length is zero. DefectDojo's engagement is a time series. If you only reimport when the file is non-empty, the last dirty import remains the source of truth.