Repository navigation
fix(ci): unblock SAST gate — fix workflow shell-injection, suppress 7 false positives - #32
Merged
Merged
Conversation
…alse positives The semgrep gate blocked 8 HIGH/MEDIUM findings. One is a real best-practice issue (fixed); the rest are false positives added to the documented SUPPRESSED allowlist: FIXED: provenance step interpolated GitHub context (repository/ref/sha/run_id) directly into the shell heredoc (run-shell-injection). Pass them via env vars and reference as shell variables instead. SUPPRESSED (false positives, justified inline): sqlite_store raw queries are fully parameterized (user values bound via '?'; only static column/clause fragments are f-string interpolated); the finding-dedup fingerprint uses SHA-1 with usedforsecurity=False (not a security digest); the Kyverno ECR-read role uses short-lived IRSA tokens (same rationale as the existing iam_oidc suppression). Suite green with AWS creds unset; coverage 100%. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
Someone is attempting to deploy this pull request to the Bihan Banerjee's projects Team on Vercel. No GitHub account was found matching the commit author email address. To deploy this pull request, the commit author's email address needs to be associated with a GitHub account. Learn more about how to change the commit author information. |
This branch had an error being deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The SAST (semgrep) CI gate blocked the pipeline on 8 HIGH/MEDIUM findings. This is the
only remaining red gate —
mainalready has the test/pusher and morning-start fixes(PRs #30/#31); this commit (
4af2840) was pushed after #31 merged and never reachedmain.Build & Test is already green on
main(verified in run for23807f2); SAST is what's left.What changed
1 real issue → fixed
ci.yamlprovenance step interpolated${{ github.repository/ref/sha/run_id }}directlyinto a shell heredoc (
run-shell-injection). Now passed viaenv:and referenced asshell variables — the correct pattern, and it clears the finding.
7 false positives → justified entries in the documented
SUPPRESSEDallowlistsqlalchemy-execute-raw-query(sqlite_store.py) — queries are fullyparameterized (user values bound via
?); only static column names /WHERE/JOINstructure are f-string interpolated. No injection path.
insecure-hash-algorithm-sha1(sqlite_store.py:386) — finding-dedupfingerprint, not a security digest. Marked
usedforsecurity=False(keeps the digestbyte-identical) and suppressed.
no-iam-creds-exposure(kyverno/main.tf) — short-lived IRSA tokens, samerationale already accepted for the
iam_oidcrole.Verification
ci.yamlis valid YAML; gateis_suppressedsubstrings confirmed to matchthe reported
check_id+ path for all three new entries.🤖 Generated with Claude Code