Found while working on the capture engines and deliberately not fixed there, to keep those pull requests reviewable. All pre-existing.
21 ruff errors at --target-version py39, in integrations/sentinel, integrations/comply54 and decisionassure. The capture engines, the core and scripts/ are clean, so a repo-wide ruff check cannot currently be a gate.
Open CodeQL findings:
py/stack-trace-exposure, medium, five instances in integrations/sentinel/sentinel/server.py (lines 128, 131, 299, 311, 347). Stack traces reaching an external caller. This one is worth doing first: it is a real information leak in a service, not a lint preference.PinnedDependenciesID, medium, across ramen-ai-cmcp-conformance.yml, scheduled-agents-tests.yml, agentrust-codex-tests.yml, spendguard-conformance.yml, claude-code-tests.yml, codeql.yml, scorecard.yml, and integrations/sentinel/Dockerfile: unpinned pip install commands, unpinned GitHub actions, and an unpinned container base image.
The pinning findings matter more than usual here, given this repository publishes supply-chain integrity tooling. The newer workflows pin actions by SHA; the older ones do not.
Suggest splitting: one pull request for the stack-trace exposures, one for pinning, then make repo-wide ruff a required check once it is clean.
Found while working on the capture engines and deliberately not fixed there, to keep those pull requests reviewable. All pre-existing.
21 ruff errors at
--target-version py39, inintegrations/sentinel,integrations/comply54anddecisionassure. The capture engines, the core andscripts/are clean, so a repo-wideruff checkcannot currently be a gate.Open CodeQL findings:
py/stack-trace-exposure, medium, five instances inintegrations/sentinel/sentinel/server.py(lines 128, 131, 299, 311, 347). Stack traces reaching an external caller. This one is worth doing first: it is a real information leak in a service, not a lint preference.PinnedDependenciesID, medium, acrossramen-ai-cmcp-conformance.yml,scheduled-agents-tests.yml,agentrust-codex-tests.yml,spendguard-conformance.yml,claude-code-tests.yml,codeql.yml,scorecard.yml, andintegrations/sentinel/Dockerfile: unpinnedpip installcommands, unpinned GitHub actions, and an unpinned container base image.The pinning findings matter more than usual here, given this repository publishes supply-chain integrity tooling. The newer workflows pin actions by SHA; the older ones do not.
Suggest splitting: one pull request for the stack-trace exposures, one for pinning, then make repo-wide
ruffa required check once it is clean.