Follow the guide to enable codebase context checks.

Objective: To create a detailed and reliable record of critical system actions for security analysis
and compliance.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure all identifiers clearly express their purpose and intent, making code
self-documenting

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure comprehensive error handling that provides meaningful context and graceful
degradation

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: To prevent the leakage of sensitive system information through error messages while
providing sufficient detail for internal debugging.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: To ensure logs are useful for debugging and auditing without exposing sensitive
information like PII, PHI, or cardholder data.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent
vulnerabilities

Status:
Unvalidated targets input: The workflow passes needs.filter-targets.outputs.targets directly into a shell-executed
bazel test command, so a human should verify the upstream targets output cannot be
influenced to inject unexpected shell tokens/flags.

run: >
  bazel test
  --keep_going
  --build_tests_only
  --flaky_test_attempts 3
  --local_test_jobs 1
  --test_tag_filters=${{ matrix.browser }}
  --pin_browsers=false
  --test_env=SE_FORCE_BROWSER_DOWNLOAD=true
  --test_env=SE_SKIP_DRIVER_IN_PATH=true
  ${{ needs.filter-targets.outputs.targets }}

Learn more about managing compliance generic rules or creating your own custom rules

Simplify the workflow invocation by removing the run-full-suite input and
instead passing an empty targets string to trigger a full suite run, delegating
the logic to the called workflow.

.github/workflows/ci.yml [57-63]

-run-full-suite: >-
+targets: >-
   ${{
-    github.event_name == 'schedule' ||
-    github.event_name == 'workflow_dispatch' ||
-    github.event_name == 'workflow_call' ||
-    contains(github.event.pull_request.title, '[dotnet]')
+    ( github.event_name == 'schedule' ||
+      github.event_name == 'workflow_dispatch' ||
+      github.event_name == 'workflow_call' ||
+      contains(github.event.pull_request.title, '[dotnet]')
+    ) && '' || needs.check.outputs.targets
   }}

• Apply / Chat

Modify the build job to always run, building the specific targets from
filter-targets to improve caching and speed up the workflow.

.github/workflows/ci-dotnet.yml [20-27]

 build:
   name: Build
-  if: ${{ inputs.run-full-suite }}
+  needs: filter-targets
   uses: ./.github/workflows/bazel.yml
   with:
     name: Build
     os: windows
-    run: bazel build //dotnet:all
+    run: bazel build ${{ needs.filter-targets.outputs.targets }}

• Apply / Chat

Avoid unquoted word-splitting and accept only well-formed Bazel labels to
prevent malformed/empty inputs or unexpected characters from being passed into
the command line.

.github/workflows/ci-dotnet.yml [38-50]

 run: |
   targets="${{ inputs.targets }}"
+  targets="$(echo "$targets" | xargs)"  # trim
   filtered=()
 
-  for t in $targets; do
-    [[ "$t" == //dotnet/* ]] && filtered+=("$t")
-  done
+  if [[ -n "$targets" ]]; then
+    read -r -a arr <<<"$targets"
+    for t in "${arr[@]}"; do
+      [[ "$t" =~ ^//dotnet/[^[:space:]]+$ ]] && filtered+=("$t")
+    done
+  fi
 
   if [ ${#filtered[@]} -eq 0 ]; then
-    echo "targets=//dotnet/..." >> "$GITHUB_OUTPUT"
+    printf 'targets=%s\n' '//dotnet/...' >>"$GITHUB_OUTPUT"
   else
-    echo "targets=${filtered[*]}" >> "$GITHUB_OUTPUT"
+    printf 'targets=%s\n' "${filtered[*]}" >>"$GITHUB_OUTPUT"
   fi

• Apply / Chat

Add quotes around the ${{ matrix.browser }} variable in the bazel test command
to prevent potential word-splitting issues.

.github/workflows/ci-dotnet.yml [71]

---test_tag_filters=${{ matrix.browser }}
+--test_tag_filters="${{ matrix.browser }}"

• Apply / Chat