ci: security scanning, with the findings read and justified #1

Merged

marcos-mendez merged 1 commit from ci/security-scan into master

2026-10-07 15:21:58 -03:00

marcos-mendez commented

2026-10-07 14:55:29 -03:00

(Migrated from github.com)

Calls security-scan.yml of keel-linux/.github (gitleaks, bandit,
semgrep, shellcheck on hosted runners, no secrets) on pull requests,
pushes to master and by hand. Not a required check.

Baseline from a scan of master, none a risk. bandit B608 in the odoo
inithook: the only value formatted into the UPDATE is passlib's
pbkdf2_sha512 hash, whose alphabet cannot close the quote, so the
password typed never reaches the SQL. Plus one shellcheck warning
(SC1090, a sourced file shellcheck cannot follow).

gitleaks: the SHA-256 and fingerprint of Odoo's public APT key, and a
commented-out db_password in a 2015 template removed since (the
inithooks set the database password at first boot), ignored by
fingerprint in .github/.gitleaksignore.

Calls security-scan.yml of keel-linux/.github (gitleaks, bandit, semgrep, shellcheck on hosted runners, no secrets) on pull requests, pushes to master and by hand. Not a required check. Baseline from a scan of master, none a risk. bandit B608 in the odoo inithook: the only value formatted into the UPDATE is passlib's pbkdf2_sha512 hash, whose alphabet cannot close the quote, so the password typed never reaches the SQL. Plus one shellcheck warning (SC1090, a sourced file shellcheck cannot follow). gitleaks: the SHA-256 and fingerprint of Odoo's public APT key, and a commented-out db_password in a 2015 template removed since (the inithooks set the database password at first boot), ignored by fingerprint in .github/.gitleaksignore.