Create codeql-analysis.yml #5234
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Antonio Gámez, PhD <agamez@vmware.com>
✅ Deploy Preview for kubeapps-dev canceled.
|
|
There are two issues with this PR:
|
Signed-off-by: Antonio Gamez Diaz <agamez@vmware.com>
Signed-off-by: Antonio Gamez Diaz <agamez@vmware.com>
Signed-off-by: Antonio Gamez Diaz <agamez@vmware.com>
Signed-off-by: Antonio Gamez Diaz <agamez@vmware.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
cmd/kubeapps-apis/plugins/helm/packages/v1alpha1/utils/postgresql_utils.go
Fixed
Show fixed
Hide fixed
cmd/kubeapps-apis/plugins/helm/packages/v1alpha1/utils/postgresql_utils.go
Fixed
Show fixed
Hide fixed
Signed-off-by: Antonio Gamez Diaz <agamez@vmware.com>
Signed-off-by: Antonio Gamez Diaz <agamez@vmware.com>
Signed-off-by: Antonio Gamez Diaz <agamez@vmware.com> Conflicts: cmd/kubeops/Dockerfile
Signed-off-by: Antonio Gamez Diaz <agamez@vmware.com>
Signed-off-by: Antonio Gamez Diaz <agamez@vmware.com> Conflicts: cmd/apprepository-controller/Dockerfile cmd/asset-syncer/Dockerfile cmd/kubeapps-apis/Dockerfile
| log.Infof("+helm AddPackageRepository '%s' pointing to '%s'", request.GetName(), request.GetUrl()) | ||
| repoName := request.GetName() | ||
| repoUrl := request.GetUrl() | ||
| log.Infof("+helm AddPackageRepository '%s' pointing to '%s'", repoName, repoUrl) |
Check failure
Code scanning / CodeQL
Clear-text logging of sensitive information
| log.Infof("+helm AddPackageRepository '%s' pointing to '%s'", request.GetName(), request.GetUrl()) | ||
| repoName := request.GetName() | ||
| repoUrl := request.GetUrl() | ||
| log.Infof("+helm AddPackageRepository '%s' pointing to '%s'", repoName, repoUrl) |
Check failure
Code scanning / CodeQL
Clear-text logging of sensitive information
Signed-off-by: Antonio Gamez Diaz <agamez@vmware.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description of the change
While having a look at the repo settings, I noticed we didn't enable the CodeQL built-in support that GitHub offers for analyzing the code quality. This PR is the result of clicking on "enable" and adding a couple of copyright lines + customizing the cron, but otherwise it's the default config.
See an example of an alert below:
Benefits
Periodic report of the code quality status directly in Github
Possible drawbacks
More noise, but we can always allowlist any alert if think so
Applicable issues
Additional information
The results are stored in the "security" section of the github repo.