Skip to content

fix(security): resolve error-severity code scanning alerts #242

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
harmjeff merged 2 commits into from
May 5, 2026
Merged

fix(security): resolve error-severity code scanning alerts #242

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
261909a
fix(security): resolve all error-severity code scanning alerts (issue…
harmjeff May 5, 2026
260f758
fix(security): suppress gitleaks false positives in credential scrubb…
harmjeff May 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 7 additions & 6 deletions .github/workflows/pull-request-lint.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,19 +38,20 @@ jobs:
env:
GH_TOKEN: ${{ github.token }}
PR_LABELS_JSON: ${{ toJson(github.event.pull_request.labels.*.name) }}
PR_NUMBER_INPUT: ${{ github.event.pull_request.number }}
steps:
- name: Get PR info
id: get-pr
run: |
if [ "${{ github.event_name }}" == "merge_group" ]; then
PR_NUMBER=$(echo "${{ github.ref }}" | grep -oP '(?<=/pr-)\d+' || echo "")
PR_LABELS=$(gh api repos/${{ github.repository }}/pulls/$PR_NUMBER | jq -c '[.labels[].name] // []')
if [ "$GITHUB_EVENT_NAME" == "merge_group" ]; then
PR_NUMBER=$(echo "$GITHUB_REF" | grep -oP '(?<=/pr-)\d+' || echo "")
PR_LABELS=$(gh api "repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER" | jq -c '[.labels[].name] // []')
echo "::group::Getting Information"
gh api repos/${{ github.repository }}/pulls/$PR_NUMBER
gh api "repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER"
echo $PR_LABELS
echo "::endgroup::"
elif [ "${{ github.event_name }}" == "pull_request" -o "${{ github.event_name }}" == "pull_request_target" ]; then
PR_NUMBER="${{ github.event.pull_request.number }}"
elif [ "$GITHUB_EVENT_NAME" == "pull_request" -o "$GITHUB_EVENT_NAME" == "pull_request_target" ]; then
PR_NUMBER="$PR_NUMBER_INPUT"
PR_LABELS=$(echo "$PR_LABELS_JSON" | jq -c '.')
fi
echo "::group::Debug Output Values"
Expand Down
1 change: 1 addition & 0 deletions .gitleaks.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,4 +12,5 @@ description = "Global allowlist"
paths = [
'''\.gitleaks-baseline\.json$''',
'''uv\.lock$''',
'''packages/shared/tests/test_credential_scrubber\.py$''',
]
2 changes: 2 additions & 0 deletions scripts/aidlc-evaluator/packages/quantitative/src/quantitative/analyzers.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,6 +107,7 @@ def run_ruff(project_root: Path) -> ToolResult:
sev = "error" if item.get("code", "").startswith("E") else "warning"
raw_path = item.get("filename", "?")
try:
# nosemgrep: ai.ai-best-practices.hooks-path-traversal - relative_to() enforces path stays within project_root; ValueError on escape
rel_path = str(Path(raw_path).relative_to(project_root))
except ValueError:
rel_path = raw_path
Expand Down Expand Up @@ -320,6 +321,7 @@ def run_semgrep(project_root: Path) -> ToolResult:
sev = _SEMGREP_SEVERITY_MAP.get(raw_sev, "medium")
raw_path = item.get("path", "?")
try:
# nosemgrep: ai.ai-best-practices.hooks-path-traversal - relative_to() enforces path stays within project_root; ValueError on escape
rel_path = str(Path(raw_path).relative_to(project_root))
except ValueError:
rel_path = raw_path
Expand Down
14 changes: 7 additions & 7 deletions scripts/aidlc-evaluator/packages/shared/tests/test_credential_scrubber.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,14 +26,14 @@

def test_jwt_token(self):
"""Test JWT token redaction."""
text = "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"
text = "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c" # nosemgrep: generic.secrets.security.detected-jwt-token # gitleaks:allow
result = scrub_credentials(text)
assert "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9" not in result
assert "[REDACTED-JWT-TOKEN]" in result

def test_github_token(self):
"""Test GitHub personal access token redaction."""
text = "GITHUB_TOKEN=ghp_1234567890abcdefghijklmnopqrstuv"
text = "GITHUB_TOKEN=ghp_1234567890abcdefghijklmnopqrstuv" # gitleaks:allow

Check notice

Code scanning / Semgrep OSS

Semgrep Finding: generic.secrets.gitleaks.generic-api-key.generic-api-key Note test

A gitleaks generic-api-key was detected which attempts to identify hard-coded credentials. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). This rule can introduce a lot of false positives, it is not recommended to be used in PR comments.
Comment thread
scottschreckengaust marked this conversation as resolved.
Dismissed
result = scrub_credentials(text)
assert "ghp_1234567890abcdefghijklmnopqrstuv" not in result
assert "[REDACTED-GITHUB-TOKEN]" in result
Expand All @@ -60,7 +60,7 @@

def test_api_key_hex(self):
"""Test generic API key redaction (hex format)."""
text = "api_key=a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4"
text = "api_key=a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4" # nosemgrep: generic.secrets.security.detected-generic-api-key # gitleaks:allow
result = scrub_credentials(text)
assert "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4" not in result
assert "[REDACTED-API-KEY]" in result
Expand All @@ -70,7 +70,7 @@
text = """
AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
TOKEN=ghp_1234567890abcdefghijklmnopqrstuv
TOKEN=ghp_1234567890abcdefghijklmnopqrstuv # gitleaks:allow

Check notice

Code scanning / Semgrep OSS

Semgrep Finding: generic.secrets.gitleaks.generic-api-key.generic-api-key Note test

A gitleaks generic-api-key was detected which attempts to identify hard-coded credentials. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). This rule can introduce a lot of false positives, it is not recommended to be used in PR comments.
Comment thread
scottschreckengaust marked this conversation as resolved.
Dismissed
"""
result = scrub_credentials(text)
assert "AKIAIOSFODNN7EXAMPLE" not in result
Expand Down Expand Up @@ -104,7 +104,7 @@
def test_scrub_all_strings(self):
"""Test scrubbing all string values in a dict."""
data = {
"token": "ghp_1234567890abcdefghijklmnopqrstuv",
"token": "ghp_1234567890abcdefghijklmnopqrstuv", # gitleaks:allow

Check notice

Code scanning / Semgrep OSS

Semgrep Finding: generic.secrets.gitleaks.generic-api-key.generic-api-key Note test

A gitleaks generic-api-key was detected which attempts to identify hard-coded credentials. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). This rule can introduce a lot of false positives, it is not recommended to be used in PR comments.
Comment thread
scottschreckengaust marked this conversation as resolved.
Dismissed
"count": 42,
"message": "Hello world",
}
Expand All @@ -116,8 +116,8 @@
def test_scrub_specific_keys(self):
"""Test scrubbing only targeted keys."""
data = {
"token": "ghp_1234567890abcdefghijklmnopqrstuv",
"message": "ghp_1234567890abcdefghijklmnopqrstuv",
"token": "ghp_1234567890abcdefghijklmnopqrstuv", # gitleaks:allow

Check notice

Code scanning / Semgrep OSS

Semgrep Finding: generic.secrets.gitleaks.generic-api-key.generic-api-key Note test

A gitleaks generic-api-key was detected which attempts to identify hard-coded credentials. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). This rule can introduce a lot of false positives, it is not recommended to be used in PR comments.
Comment thread
scottschreckengaust marked this conversation as resolved.
Dismissed
"message": "ghp_1234567890abcdefghijklmnopqrstuv", # gitleaks:allow
}
result = scrub_dict_values(data, keys_to_scrub={"token"})
assert "ghp_1234567890abcdefghijklmnopqrstuv" not in result["token"]
Expand Down
2 changes: 2 additions & 0 deletions scripts/aidlc-evaluator/packages/trend-reports/src/trend_reports/fetcher.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -138,6 +138,8 @@ def fetch_workflow_runs(
if event is not None:
cmd.extend(["--event", event])

# nosec B603, B607 - cmd is a static gh CLI invocation with validated string arguments (repo, branch, event)
# nosemgrep: python.lang.security.audit.dangerous-subprocess-use-audit.dangerous-subprocess-use-audit
result = subprocess.run(cmd, capture_output=True, text=True, check=False)
if result.returncode != 0:
raise FetchError(f"Failed to list workflow runs for {repo}: {result.stderr.strip()}")
Expand Down
2 changes: 1 addition & 1 deletion scripts/aidlc-evaluator/packages/trend-reports/tests/test_models.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@ def test_ordering(self):
assert SemVer(0, 1, 9) < SemVer(1, 0, 0)

def test_equality(self):
assert SemVer(1, 2, 3) == SemVer(1, 2, 3)
assert SemVer(1, 2, 3) == SemVer(1, 2, 3) # nosemgrep: template.eqeq-is-bad - dataclass equality via __eq__ is intentional here

def test_frozen(self):
sv = SemVer(1, 2, 3)
Expand Down