ci: security scanning, with the findings read and justified #17

Open

marcos-mendez wants to merge 1 commit from ci/security-scan into master

marcos-mendez commented

2026-10-07 14:54:47 -03:00

(Migrated from github.com)

Calls security-scan.yml of keel-linux/.github (gitleaks, bandit,
semgrep, shellcheck on hosted runners, no secrets) on pull requests,
pushes to master and by hand. Not a required check.

A scan of master finds nothing for bandit, semgrep or shellcheck, so there
is no baseline.

gitleaks flags KEEL_APT_KEY in the Makefile, the OpenPGP fingerprint of
the archive staging signing subkey: public by design, allowlisted by
value in .github/gitleaks.toml.

Calls security-scan.yml of keel-linux/.github (gitleaks, bandit, semgrep, shellcheck on hosted runners, no secrets) on pull requests, pushes to master and by hand. Not a required check. A scan of master finds nothing for bandit, semgrep or shellcheck, so there is no baseline. gitleaks flags KEEL_APT_KEY in the Makefile, the OpenPGP fingerprint of the archive staging signing subkey: public by design, allowlisted by value in .github/gitleaks.toml.

Some required checks are missing.

This branch is out-of-date with the base branch

You are not authorized to merge this pull request.

View command line instructions