[PM-28029] Address SonarCloud and zizmor errors #2124
Conversation
|
Claude finished @vvolkgang's task —— View job Code Review CompleteThis PR addresses security and code quality findings from SonarCloud and zizmor by removing unused code and fixing workflow security issues. SummaryThe changes improve workflow security and remove dead code. The default value fix for FindingsFinding 1 💭 ( The Contextdistinct_id:
description: "Unique ID for this dispatch, used by dispatch-and-download.yml"The action file has been removed, but these descriptions remain. Finding 2 The PR removes
If the security concern identified by zizmor applies to workflow calls that don't need secrets, these additional instances should also be reviewed and potentially removed if those jobs don't require inherited secrets. Action Items
|
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
| latest_tag_version=$(git tag -l --sort=-creatordate | grep "$APP_CODENAME" | head -n 1) | ||
| if [[ -z "$latest_tag_version" ]]; then | ||
| version_name="${current_year}.${current_month}.${_PATCH_VERSION}" | ||
| version_name="${current_year}.${current_month}.${_PATCH_VERSION:-0}" |
There was a problem hiding this comment.
💭 Note: The distinct_id parameter descriptions at lines 20 and 43 still reference "dispatch-and-download.yml" which was deleted. Consider updating those descriptions in a follow-up to avoid confusion.
| base_version_number: 30 | ||
| version_name: ${{ inputs.version-name }} | ||
| version_number: ${{ inputs.version-number }} | ||
| patch_version: ${{ inputs.patch_version && '999' || '' }} |
There was a problem hiding this comment.
version job. However, secrets: inherit still exists in other jobs in this file (lines 76 and 98). If the zizmor finding indicates that secrets shouldn't be inherited when not needed, those may also warrant review.
| base_version_number: 2300 | ||
| version_name: ${{ inputs.version-name }} | ||
| version_number: ${{ inputs.version-number }} | ||
| patch_version: ${{ inputs.patch_version && '999' || '' }} |
There was a problem hiding this comment.
version job. However, secrets: inherit still exists in other jobs in this file (lines 79 and 106). If the zizmor finding indicates that secrets shouldn't be inherited when not needed, those may also warrant review.
|
Great job! No new security vulnerabilities introduced in this pull request |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #2124 +/- ##
==========================================
- Coverage 85.22% 83.77% -1.45%
==========================================
Files 1708 1971 +263
Lines 145420 160924 +15504
==========================================
+ Hits 123940 134822 +10882
- Misses 21480 26102 +4622 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
🎟️ Tracking
PM-28029
📔 Objective
Address SonarCube and zizmor findings, following similar work in bitwarden/android#6151
dispatch-and-downloadaction.secrets: inheritfrom_version.ymljobs.⏰ Reminders before review
🦮 Reviewer guidelines
:+1:) or similar for great changes:memo:) or ℹ️ (:information_source:) for notes or general info:question:) for questions:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion:art:) for suggestions / improvements:x:) or:warning:) for more significant problems or concerns needing attention:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt:pick:) for minor or nitpick changes