ci: security scanning, with the findings read and justified #1

Open

marcos-mendez wants to merge 2 commits from ci/security-scan into master

marcos-mendez commented

2026-10-07 14:57:10 -03:00

(Migrated from github.com)

Calls security-scan.yml of keel-linux/.github (gitleaks, bandit,
semgrep, shellcheck on hosted runners, no secrets) on pull requests,
pushes to master and by hand. Not a required check.

A scan of master finds no secret in the history and no shellcheck
finding. semgrep's phpinfo-use (ERROR) on overlay/var/www/phpinfo.php is
left out of the baseline on purpose: the page publishes the PHP
configuration to anyone on port 80, which is a real disclosure, so the
semgrep check stays red until the project decides whether an appliance
ships it.

Calls security-scan.yml of keel-linux/.github (gitleaks, bandit, semgrep, shellcheck on hosted runners, no secrets) on pull requests, pushes to master and by hand. Not a required check. A scan of master finds no secret in the history and no shellcheck finding. semgrep's phpinfo-use (ERROR) on overlay/var/www/phpinfo.php is left out of the baseline on purpose: the page publishes the PHP configuration to anyone on port 80, which is a real disclosure, so the semgrep check stays red until the project decides whether an appliance ships it.

This pull request can be merged automatically.

This branch is out-of-date with the base branch

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin ci/security-scan:ci/security-scan

git switch ci/security-scan

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch master

git merge --no-ff ci/security-scan

git switch ci/security-scan

git rebase master

git switch master

git merge --ff-only ci/security-scan

git switch ci/security-scan

git rebase master

git switch master

git merge --no-ff ci/security-scan

git switch master

git merge --squash ci/security-scan