Skip to content

Fix GitHub code-scanning alerts (SEC-1) - #338

Merged
jothimani-rajendran merged 3 commits into
mainfrom
sec-1-alerts
Oct 28, 2026
Merged

jothimani-rajendran merged 3 commits into
mainfrom
sec-1-alerts

Conversation

@jothimani-rajendran

Copy link
Copy Markdown
Collaborator

What

  • 19 zizmor/ref-version-mismatch: comments corrected to the tag each pinned SHA is (git ls-remote); no SHA changed.
  • CodeQL notes: unused-global x2 (incident DATA, _DETERMINISTIC_HEURISTIC_PATTERNS), cyclic-import, import-and-import-from, unreachable-statement.
  • Catalog gate.py:978 unused global = _LOG_MAX_BYTES; removed from runner constants (duplicate of journal.LOG_DEFAULT_MAX_BYTES).

Kept

  • except BaseException in runtime_loader.py.tmpl:39: deliberate, a SystemExit while loading the shared runtime must refuse.
  • gate/sessionstart.py _INSTRUCTION: used only by the runtime template; an in-module use would change frozen goldens.
  • output.py clear-text-logging x2: false positives, owner dismisses.

Owner follow-up: chock sync to refresh this repo's .chock/bin/gate.py.


Generated by Claude Code

…otes

Correct 19 ref-version-mismatch comments to the tag each pinned SHA is
(measured with git ls-remote; no SHA changes). Fix unused-global,
cyclic-import, import-and-import-from and unreachable-statement notes, and
drop the unused _LOG_MAX_BYTES duplicate from the gate runner constants.

Signed-off-by: Jothi Mani Rajendran <250249270+jothimani-rajendran@users.noreply.github.com>
…otes

Correct 19 ref-version-mismatch comments to the tag each pinned SHA is
(measured with git ls-remote; no SHA changes). Fix unused-global,
cyclic-import, import-and-import-from and unreachable-statement notes, and
drop the unused _LOG_MAX_BYTES duplicate from the gate runner constants.

Signed-off-by: Jothi Mani Rajendran <250249270+jothimani-rajendran@users.noreply.github.com>
CodeQL counts a TYPE_CHECKING import as a cycle edge, so incident_render
no longer imports incident; the timeline parameter is typed Any.

Signed-off-by: Jothi Mani Rajendran <250249270+jothimani-rajendran@users.noreply.github.com>
@jothimani-rajendran
jothimani-rajendran marked this pull request as ready for review October 28, 2026 14:08
@jothimani-rajendran
jothimani-rajendran merged commit f4c2bfa into main Oct 28, 2026
27 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant