ci: security scanning, with the findings read and justified #1

Merged

marcos-mendez merged 1 commit from ci/security-scan into master

2026-10-07 15:22:11 -03:00

marcos-mendez commented

2026-10-07 14:57:27 -03:00

(Migrated from github.com)

Calls security-scan.yml of keel-linux/.github (gitleaks, bandit,
semgrep, shellcheck on hosted runners, no secrets) on pull requests,
pushes to master and by hand. Not a required check.

A scan of master finds no secret in the history, nothing for bandit
or semgrep, and five shellcheck warnings of the build and inithook
scripts (word splitting of build paths, rm -rf of the build's own source
directory, a literal brace, a sourced file), justified in
.github/security-baseline. bandit cannot parse the Python 2 inithook
ejabberd.py and reports it as a warning.

Calls security-scan.yml of keel-linux/.github (gitleaks, bandit, semgrep, shellcheck on hosted runners, no secrets) on pull requests, pushes to master and by hand. Not a required check. A scan of master finds no secret in the history, nothing for bandit or semgrep, and five shellcheck warnings of the build and inithook scripts (word splitting of build paths, rm -rf of the build's own source directory, a literal brace, a sourced file), justified in .github/security-baseline. bandit cannot parse the Python 2 inithook ejabberd.py and reports it as a warning.