chore(ci): add CodeQL analysis + unmask bandit/gosec security gates - #95
Merged
Conversation
Audit found the CI security gates masked (can't fail) and no real CodeQL despite
the org ruleset requiring code-scanning.
- Add .github/workflows/codeql.yml: real CodeQL analysis (python, go,
javascript-typescript), SHA-pinned action, on push/PR to main+v2.1.x+release/**
plus weekly cron. Provides the code-scanning results the org ruleset requires
and adds the previously-absent JS/TS SAST coverage.
- Unmask bandit (build.yml, version-monitor.yml): JSON-report run kept, followed
by a real gating run on the same inputs (no || true, continue-on-error: false),
scoped to app source.
- Unmask gosec: replaced the -no-fail masked action with a gating
`gosec ./...` on squawk-client-go; also fixed 4 ineffective //nolint:gosec
suppressions to gosec-native `// #nosec` syntax (they were silently unsuppressed).
- Resolved the real findings the now-gating scanners surfaced:
* ntp-server binds: `# nosec B104` justified (network daemon must listen broadly)
* dhcp.py/schema.py listen_address DB defaults: `# nosec B104` (config data, not
a socket bind)
* squawk-client k8s-client.py: added missing requests timeout (B113, real bug)
- Coverage gate (--cov-fail-under=98 || true) left non-gating with a rationale
comment — actual coverage is below threshold; raising it is a separate effort.
Verified: bandit gating command exits 0, gosec exits 0, go build passes, all
workflow YAML valid, actions SHA-pinned.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| server_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM) | ||
| server_socket.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1) | ||
| server_socket.bind(("0.0.0.0", self.port)) | ||
| server_socket.bind(("0.0.0.0", self.port)) # nosec B104 - NTP server is a network daemon that must listen on all interfaces to serve clients |
| sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) | ||
| sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1) | ||
| sock.bind(("0.0.0.0", self.port)) | ||
| sock.bind(("0.0.0.0", self.port)) # nosec B104 - NTP server is a network daemon that must listen on all interfaces to serve clients |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes the CI verification-integrity gaps from the audit: security gates were masked (
|| true/-no-fail/continue-on-error) so they couldn't fail, and no real CodeQL ran despite the org ruleset requiring code-scanning.Changes
.github/workflows/codeql.yml— real CodeQL analysis for python, go, javascript-typescript (SHA-pinned action; push/PR to main+v2.1.x+release/** + weekly cron). Provides the code-scanning results the org ruleset requires and adds the previously-absent JS/TS SAST coverage.continue-on-error: false, no|| true).-no-failmasked action with a gatinggosec ./...; also fixed 4 ineffective//nolint:gosecsuppressions to gosec-native// #nosec(they were silently unsuppressed).# nosec B104(network daemon must listen broadly)listen_addressDB defaults →# nosec B104(config data, not a bind)squawk-client/bins/k8s-client.py→ added missingrequeststimeout (B113, a real hang bug)Verification
go build ./...→ exit 0; all workflow YAML parse; every added action SHA-pinned; zizmor clean on the new workflow.--cov-fail-under=98 || true(build.yml, server-release.yml) is still non-gating (added a rationale comment). Actual coverage is well below 98%, so unmasking it would fail every build — that's a coverage-raising effort or a threshold decision, not a safe auto-fix.persist-credentials, missing jobpermissions:,echotemplate-injection, archivedactions/create-release) — flagged for a separate pass.🤖 Generated with Claude Code