[Wave 3] Medium — Module sweep: Dev tooling: code, release & supply-chain guards and generators #549

Wave 3 · 3 finding(s) in 3 fix package(s). Fix these whenever a pull request touches this module ("clean the module you touch").

Findings

• CR-A17b-001 (code, Medium) — Comment-led logical-line skip with a raw bracket counter blinds the HTTP-discipline and sys.modules-pop guards to code after any comment holding an unmatched bracket
  severity Medium · reachability default · intent contract-violation · confidence confirmed · independently confirmed · reproduced end to end
  Failure scenario. A contributor adds a direct requests.post (or import requests as rq; rq.post) under a comment with an open parenthesis. CI stays green, and the new call bypasses SSRF pinning, the https and redirect policy and secret masking.
  Where. tools/check_http_discipline.py:78-96 (confirmed), tools/check_http_discipline.py:99-110, tools/check_http_discipline.py:102-105 (confirmed), forgelm/judge.py:161 (confirmed)
  Recommended fix. Replace the regex/paren-counting scan with an ast-based visitor: resolve Import/ImportFrom aliases for requests, httpx, urllib.request, urllib3, http.client, aiohttp and socket, and flag any Call whose func resolves into those modules. Comments then disappear from the analysis naturally.

• CR-A17b-002 (code, Medium) — supply_chain_security.md and workflow comments misstate what the bandit/pip-audit gates do
  severity Medium · reachability default · intent contract-violation · confidence confirmed · independently confirmed · reproduced end to end
  Failure scenario. An auditor relies on the doc's claim that nosec suppressions are verified for justification. They are not, so an unexplained # nosec silently hides a HIGH finding.
  Where. docs/reference/supply_chain_security.md:192-194 (nosec justification claim; :191 is blank), docs/reference/supply_chain_security.md:181-194, tools/check_bandit.py:64-160, .github/workflows/ci.yml:517-524
  Recommended fix. Correct the doc. Have check_bandit fail (or warn) on a non-empty errors[], and implement or remove the nosec-justification claim.

• CR-A17b-003 (code, Medium) — Supply-chain severity wrappers (check_bandit, check_pip_audit) never check scan completeness, so reports that scanned or audited nothing pass behind '|| true'
  severity Medium · reachability default · intent contract-violation · confidence confirmed · independently confirmed · reproduced end to end
  Failure scenario. pip-audit changes its JSON shape or emits a partial report, or bandit fails to parse a module. The nightly or CI gate stays green while nothing, or not everything, was scanned.
  Where. tools/check_pip_audit.py:170-181 (confirmed), tools/check_bandit.py:98-119 (confirmed), .github/workflows/nightly.yml:333-334, .github/workflows/ci.yml:523-524 (confirmed)
  Recommended fix. Require 'dependencies' to be a present list (as check_bandit does for 'results'), surface skip_reason entries (warn or fail), pass --strict in the nightly, and fail check_bandit on a non-empty 'errors' list.

Done when

• Every finding above is fixed or closed with a reason (tick it here).
• Code fixes carry a test; doc fixes update the Turkish mirror in the same PR.

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}