ci: security scanning, with the findings read and justified #13

Open

marcos-mendez wants to merge 1 commit from ci/security-scan into master

marcos-mendez commented

2026-10-07 14:54:10 -03:00

(Migrated from github.com)

Calls security-scan.yml of keel-linux/.github (gitleaks, bandit,
semgrep, shellcheck on hosted runners, no secrets) on pull requests,
pushes to master and by hand. Not a required check.

A scan of master finds no Python and nothing for semgrep or shellcheck.

gitleaks flags KEEL_APT_KEY in the Makefile, the OpenPGP fingerprint of
the archive staging signing subkey: public by design, allowlisted by
value in .github/gitleaks.toml. The other two hits, curl --user admin:fixture in
tests/v19-upgrade.sh (since removed), are a throwaway test login,
allowlisted by path.

Calls security-scan.yml of keel-linux/.github (gitleaks, bandit, semgrep, shellcheck on hosted runners, no secrets) on pull requests, pushes to master and by hand. Not a required check. A scan of master finds no Python and nothing for semgrep or shellcheck. gitleaks flags KEEL_APT_KEY in the Makefile, the OpenPGP fingerprint of the archive staging signing subkey: public by design, allowlisted by value in .github/gitleaks.toml. The other two hits, curl --user admin:fixture in tests/v19-upgrade.sh (since removed), are a throwaway test login, allowlisted by path.

This pull request is blocked because it's outdated.

This branch is out-of-date with the base branch

You are not authorized to merge this pull request.

View command line instructions