ci: security scanning, with the findings read and justified #2

Merged

marcos-mendez merged 1 commit from ci/security-scan into keel/trixie

2026-10-07 15:20:50 -03:00

marcos-mendez commented

2026-10-07 14:57:19 -03:00

(Migrated from github.com)

Calls security-scan.yml of keel-linux/.github (gitleaks, bandit,
semgrep, shellcheck on hosted runners, no secrets) on pull requests,
pushes to keel/trixie and by hand. Not a required check.

A scan of keel/trixie finds no secret in the history, nothing for
semgrep and one bandit finding, not a risk: B108 flags a table that maps
the /tmp mount point to a partition label; no temporary file is made.
It is justified in .github/security-baseline.

Calls security-scan.yml of keel-linux/.github (gitleaks, bandit, semgrep, shellcheck on hosted runners, no secrets) on pull requests, pushes to keel/trixie and by hand. Not a required check. A scan of keel/trixie finds no secret in the history, nothing for semgrep and one bandit finding, not a risk: B108 flags a table that maps the /tmp mount point to a partition label; no temporary file is made. It is justified in .github/security-baseline.