fix(security): suppress bandit FPs to unblock security-scan CI on PR #93 - #112
Open
github-actions[bot] wants to merge 1 commit into
Conversation
… — port to PR #93 Cherry-port of commit 77eb667 (from the sec-83-bandit fix branch) onto the chore/a2a-prod-rollout-prep PR branch, with resolved database.py conflict and the @pytest.mark.asyncio decorator added for the new allowlist test class. Root cause of security-scan failure: bandit -r . --skip B101 exits 1 whenever it finds any issue. The test_residual_authz.py file (and several others) had unannotated false-positives that triggered B105/B404/B603/B607/B104/B108/B110. Changes applied: - B105: add # nosec B105 to JWT_SECRET test fixtures in test_residual_authz.py, test_auth_authz.py, and test_hierarchy_ws_authz.py - B404/B603/B607: annotate subprocess imports + calls (shell=False, static argv) in claude_code_wrapper.py, claude_sdk_manager.py, git_workflow_manager.py - B104: env-gate uvicorn host in simple_main.py + main_with_hierarchy.py; annotate Docker port-map string in container_manager.py - B108: replace hard-coded /tmp in model_configuration.py with tempfile.gettempdir() + FUZEAGENT_KEY_DIR env; annotate sandbox tmpfs mount + test path - B110: replace bare except/pass with narrowed excepts + debug logging in container_manager.py and main.py websocket broadcast paths - database.py: move column allowlist validation before DB connection (fail-fast) - Add tests/test_database_update_allowlist.py with @pytest.mark.asyncio decorator Fixes security-scan CI failure on PR #93. Refs #93 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Root cause
The
security-scanCI job runsbandit -r . --skip B101 -f txt(no|| true), which exits code 1 whenever any issue is found. PR #93 (chore/a2a-prod-rollout-prep) had 53 unannotated Bandit findings across the orchestrator service — the last one visible in the truncated CI log was B105 (hardcoded password string) intests/test_residual_authz.py:34.Fix
Cherry-port of commit
77eb667(fix(security): harden subprocess/bind/try-pass/tmp + justify test FPs — part 3) from thesec-83-banditfix branch, with:database.pymerge conflict (our branch has a newer schema)@pytest.mark.asynciotoTestUpdateColumnAllowlist(needed fortest-backendnot to regress)Changes by Bandit rule
test_residual_authz.py,test_auth_authz.py,test_hierarchy_ws_authz.py# nosec B105— test-only JWT fixtureclaude_code_wrapper.py,claude_sdk_manager.py,git_workflow_manager.py# nosec— shell=False, static argvsimple_main.py,main_with_hierarchy.py,container_manager.py# nosec B104model_configuration.pytempfile.gettempdir()+FUZEAGENT_KEY_DIRenvsandbox_manager.py,test_claude_code_wrapper.py# nosec B108— container mount point / test literalcontainer_manager.py,main.pyexcept Exception+ debug loggingdatabase.pyCloses the
security-scanfailure on PR #93.Refs #93
🤖 Generated with Claude Code