Repository navigation
Repair CI workflow pins, lint violations, and scanner fixtures - #107
Conversation
This repo's standards reusable pins are re-pointed at the standards default-branch HEAD, resolved live at sweep time. The prior refs are recorded in the verification line below. Three kinds of drift are repaired together and the body does not claim which one this repo had: an UNREACHABLE sha kills the run at workflow STARTUP, so GitHub reports no check at all rather than a failing one and the gate disappears instead of going red; a FLOATING ref (@main) is unpinned supply chain; a merely STALE but reachable sha silently reintroduces every bug fixed since it. files=6 pins=6 perms=0 permlines=0 from=fad242d35291de1898242d6737ba02b74a59a2f2 target=8f2ee508 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0178nN4Nm3neFRy5K9StZKnB
|
Important Review skippedThis PR was authored by the user configured for CodeRabbit reviews. CodeRabbit does not review PRs authored by this user. It's recommended to use a dedicated user account to post CodeRabbit review feedback. ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Essentials Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| path: "src/config.rs".to_string(), | ||
| }, | ||
| content: r#"let api_key = "supersecretkey12345""#.to_string(), // scanner-allow: rust-secrets | ||
| content: r#"let api_key = "supersecretkey12345""#.to_string(), // scanner-allow: rust-secrets |
There was a problem hiding this comment.
okay this needs to be fixed right away
| let request = GatingRequest::new(create_proposal( | ||
| "config.rs", | ||
| r#"let password = "supersecret123456""#, // scanner-allow: rust-secrets | ||
| r#"let password = "supersecret123456""#, // scanner-allow: rust-secrets |
There was a problem hiding this comment.
can you fix this stuff if it needs it, but I mean whatever you do here - is it about putting an exclusion in or is it something else (I realise now it's just a fake one)
| path: "main.ts".to_string(), | ||
| }, | ||
| content: r#"const x: string = 'hello'; let password = "secret123""#.to_string(), // scanner-allow: rust-secrets | ||
| content: r#"const x: string = 'hello'; let password = "secret123""#.to_string(), // scanner-allow: rust-secrets |
| }, | ||
| content: r#"const API_KEY = "abcdef1234567890abcdef""#.to_string(), // test fixture — scanner-allow: rust-secrets | ||
| content: format!( | ||
| r#"const API_KEY = "{}""#, |
2 participants
Update six reusable standards workflows to a current immutable revision. Resolve Rust formatting and Clippy failures, implement FromStr for red-team categories, add audit metadata, correct the AffineScript remediation assertion, and construct test secrets dynamically to avoid scanner false positives while preserving coverage.
Validation was not run; no results are recorded in the inspected commits.
View coding task