Skip to content

ci: security scanning, with the findings read and justified #12

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
marcos-mendez merged 1 commit into from
Oct 7, 2026
Merged

ci: security scanning, with the findings read and justified #12

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions .github/security-baseline
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
# Security scan baseline (keel-linux/.github, security-scan.yml): findings
# that were read and are not a risk, one per line, the fingerprint and why.
bandit:B103:fab:ffd27f9c28e2 a build script copied into the chroot's private temporary directory must be executable to run; 0755 grants no write
bandit:B103:fablib/installer.py:d10b35a2f4b7 RevertibleScript writes a script that must be executable; 0755 grants no write
bandit:B324:fablib/annotate.py:804854d3f4b1 md5 keys a dict of comments while annotating a plan, not a security digest
bandit:B324:fablib/installer.py:65a598eb8621 the MD5sum field of a local build-time Packages index, written beside SHA256, which apt verifies
semgrep:python.lang.security.audit.insecure-file-permissions.insecure-file-permissions:fab:ffd27f9c28e2 a build script copied into the chroot's private temporary directory must be executable to run; 0755 grants no write
semgrep:python.lang.security.audit.insecure-file-permissions.insecure-file-permissions:fablib/installer.py:d10b35a2f4b7 RevertibleScript writes a script that must be executable; 0755 grants no write
semgrep:python.lang.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5:fablib/annotate.py:804854d3f4b1 md5 keys a dict of comments while annotating a plan, not a security digest
semgrep:python.lang.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5:fablib/installer.py:65a598eb8621 the MD5sum field of a local build-time Packages index, written beside SHA256, which apt verifies
shellcheck:SC2034:share/initctl.dummy:643b2d76d880 shell lint, not a security risk: a variable read by a sourcing script or left unused
shellcheck:SC2034:share/initctl.dummy:e9d8ec72bc58 shell lint, not a security risk: a variable read by a sourcing script or left unused
shellcheck:SC2046:share/initctl.dummy:964e4d091e7d shell lint, not a security risk: unquoted command substitution over values the script itself produces
shellcheck:SC2166:share/initctl.dummy:8e802790ac73 shell lint, not a security risk: -a/-o in test
shellcheck:SC2166:share/initctl.dummy:d03c108e3f50 shell lint, not a security risk: -a/-o in test
19 changes: 19 additions & 0 deletions .github/workflows/security.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
# Security scanning (keel-linux/.github, profile/WORKFLOWS.md "Security
# scanning"): gitleaks, bandit, semgrep and shellcheck on GitHub-hosted
# runners, no secrets. Findings that are not a risk are listed, each with its
# justification, in .github/security-baseline; gitleaks fixtures, if any, in
# .github/gitleaks.toml.
name: security
on:
pull_request:
push:
branches: [master]
workflow_dispatch:
permissions:
contents: read
jobs:
security:
uses: keel-linux/.github/.github/workflows/security-scan.yml@main
permissions:
contents: read
security-events: write
Loading