Review security across the pipeline, and make the AquaSec scan run

Aperta
  • Qualcosa non va?
#134 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
25/100
Tipo di issue
Funzionalità
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
github-actions, markdown
Ambito
ci-cd, security

Direzione di ricerca

Start with the "Aquasec Night Scan" workflow in each living-doc repository, where the run fails at configuration validation because AQUA_GROUP_ID and AQUA_REPOSITORY_ID are missing. Run gh run list -R AbsaOSS/<repository> --workflow "Aquasec Night Scan" --limit 1 to confirm the failure. Done means the secrets are set, or the workflow is removed where no values will come, and a per-stage threat model exists with hostile-content tests modelled on living-doc-generator-markdown's tests.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

type:tech-debt
Description of Technical Debt

No security review covers the pipeline. That means untrusted authored content through every stage (issue bodies,
headers, HTML converted from Azure DevOps), the token scopes each collector needs, the composite actions' supply chain,
and dependency scanning beyond AquaSec.

AquaSec itself does not run. Every repository of the ecosystem has an "Aquasec Night Scan" workflow, and every one
failed its last run (2026-11-12) at configuration validation: AQUA_GROUP_ID and AQUA_REPOSITORY_ID are not provided,
so the scan exits before it scans. No scan result has ever existed.

Impact of Technical Debt
  • Unknown exposure in a public pipeline that renders authored content.
  • The nightly red runs look like coverage and train readers to ignore failures.
Category

Security

Priority

Medium - Should be addressed soon

Proposed Solution
  1. The owner gets the two organisation values and sets them as secrets in each repository, or removes the workflow
    where no values will come.
  2. A threat model per stage (inputs, outputs, tokens, third-party actions), with tests in the style of
    living-doc-generator-markdown's hostile-content tests.
  3. living-doc-generator-markdown's nested-list rendering of unindented lines (its own issue) is reviewed in it.
Effort Estimate

Secrets: 1 hour. Review: 3-5 days.

Dependencies / Related

No response

Additional Context

Measured 2026-11-12 at living-doc 2df73dc. Re-check:

gh run list -R AbsaOSS/<repository> --workflow "Aquasec Night Scan" --limit 1 for each living-doc* repository.

Lingua principale
Python
Stelle
0
Fork
0
Merge medio
6h 14m
PR unite (30g)
27

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di AbsaOSS/living-doc

Tutte le issue di AbsaOSS/living-doc

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.