Remove skipped bandit checks #4415
Draft
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
erikamov
requested review from
charlie-costanzo,
evansiroky,
fsalemi,
mjumbewu,
ohrite,
raebot,
tiffanychu90 and
vevetron
as code owners
|
Terraform plan in iac/cal-itp-data-infra/airflow/us Plan: 0 to add, 4 to change, 0 to destroy.Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
!~ update in-place
Terraform will perform the following actions:
# google_storage_bucket_object.calitp-composer["dags/dags.py"] will be updated in-place
!~ resource "google_storage_bucket_object" "calitp-composer" {
!~ crc32c = "tQl0DA==" -> (known after apply)
!~ detect_md5hash = "B95K3uhC41c6uMX4cvS/GA==" -> "different hash"
!~ generation = 1757464207493746 -> (known after apply)
id = "calitp-composer-dags/dags.py"
!~ md5hash = "B95K3uhC41c6uMX4cvS/GA==" -> (known after apply)
name = "dags/dags.py"
# (17 unchanged attributes hidden)
}
# google_storage_bucket_object.calitp-composer["dags/unzip_and_validate_gtfs_schedule_hourly/unzip_gtfs_schedule.py"] will be updated in-place
!~ resource "google_storage_bucket_object" "calitp-composer" {
!~ crc32c = "R18QEw==" -> (known after apply)
!~ detect_md5hash = "40VBMc+J9jwdSNkwhctVSw==" -> "different hash"
!~ generation = 1756150987250440 -> (known after apply)
id = "calitp-composer-dags/unzip_and_validate_gtfs_schedule_hourly/unzip_gtfs_schedule.py"
!~ md5hash = "40VBMc+J9jwdSNkwhctVSw==" -> (known after apply)
name = "dags/unzip_and_validate_gtfs_schedule_hourly/unzip_gtfs_schedule.py"
# (17 unchanged attributes hidden)
}
# google_storage_bucket_object.calitp-composer["plugins/operators/scrape_state_geoportal.py"] will be updated in-place
!~ resource "google_storage_bucket_object" "calitp-composer" {
!~ crc32c = "3pMECQ==" -> (known after apply)
!~ detect_md5hash = "qwOK0bYTQ/9mzvdFyKCNGQ==" -> "different hash"
!~ generation = 1751416675477427 -> (known after apply)
id = "calitp-composer-plugins/operators/scrape_state_geoportal.py"
!~ md5hash = "qwOK0bYTQ/9mzvdFyKCNGQ==" -> (known after apply)
name = "plugins/operators/scrape_state_geoportal.py"
# (17 unchanged attributes hidden)
}
# google_storage_bucket_object.calitp-composer["plugins/scripts/gtfs_rt_parser.py"] will be updated in-place
!~ resource "google_storage_bucket_object" "calitp-composer" {
!~ crc32c = "qYETHA==" -> (known after apply)
!~ detect_md5hash = "1sRWG9gMSF57EIUYXiLLHw==" -> "different hash"
!~ generation = 1759360707524627 -> (known after apply)
id = "calitp-composer-plugins/scripts/gtfs_rt_parser.py"
!~ md5hash = "1sRWG9gMSF57EIUYXiLLHw==" -> (known after apply)
name = "plugins/scripts/gtfs_rt_parser.py"
# (17 unchanged attributes hidden)
}
Plan: 0 to add, 4 to change, 0 to destroy.📝 Plan generated in Plan Terraform for Warehouse and DAG changes #826 |
|
Terraform plan in iac/cal-itp-data-infra-staging/airflow/us Plan: 0 to add, 11 to change, 0 to destroy.Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
!~ update in-place
Terraform will perform the following actions:
# google_storage_bucket_object.calitp-staging-composer["dags/dags.py"] will be updated in-place
!~ resource "google_storage_bucket_object" "calitp-staging-composer" {
!~ crc32c = "tQl0DA==" -> (known after apply)
!~ detect_md5hash = "B95K3uhC41c6uMX4cvS/GA==" -> "different hash"
!~ generation = 1757464205425677 -> (known after apply)
id = "calitp-staging-composer-dags/dags.py"
!~ md5hash = "B95K3uhC41c6uMX4cvS/GA==" -> (known after apply)
name = "dags/dags.py"
# (17 unchanged attributes hidden)
}
# google_storage_bucket_object.calitp-staging-composer["dags/publish_gtfs.py"] will be updated in-place
!~ resource "google_storage_bucket_object" "calitp-staging-composer" {
!~ crc32c = "xNl1wQ==" -> (known after apply)
!~ detect_md5hash = "Tj3MIbzAD1/RkVb6FAVnmw==" -> "different hash"
!~ generation = 1760994532319565 -> (known after apply)
id = "calitp-staging-composer-dags/publish_gtfs.py"
!~ md5hash = "Tj3MIbzAD1/RkVb6FAVnmw==" -> (known after apply)
name = "dags/publish_gtfs.py"
# (17 unchanged attributes hidden)
}
# google_storage_bucket_object.calitp-staging-composer["dags/sync_elavon/elavon_to_gcs_raw.py"] will be updated in-place
!~ resource "google_storage_bucket_object" "calitp-staging-composer" {
!~ crc32c = "tTUd1w==" -> (known after apply)
!~ detect_md5hash = "FXiCPeCjZHE3J9mWyszr0w==" -> "different hash"
!~ generation = 1760994532361685 -> (known after apply)
id = "calitp-staging-composer-dags/sync_elavon/elavon_to_gcs_raw.py"
!~ md5hash = "FXiCPeCjZHE3J9mWyszr0w==" -> (known after apply)
name = "dags/sync_elavon/elavon_to_gcs_raw.py"
# (17 unchanged attributes hidden)
}
# google_storage_bucket_object.calitp-staging-composer["dags/unzip_and_validate_gtfs_schedule_hourly/unzip_gtfs_schedule.py"] will be updated in-place
!~ resource "google_storage_bucket_object" "calitp-staging-composer" {
!~ crc32c = "R18QEw==" -> (known after apply)
!~ detect_md5hash = "40VBMc+J9jwdSNkwhctVSw==" -> "different hash"
!~ generation = 1756150992903051 -> (known after apply)
id = "calitp-staging-composer-dags/unzip_and_validate_gtfs_schedule_hourly/unzip_gtfs_schedule.py"
!~ md5hash = "40VBMc+J9jwdSNkwhctVSw==" -> (known after apply)
name = "dags/unzip_and_validate_gtfs_schedule_hourly/unzip_gtfs_schedule.py"
# (17 unchanged attributes hidden)
}
# google_storage_bucket_object.calitp-staging-composer["plugins/hooks/ckan_hook.py"] will be updated in-place
!~ resource "google_storage_bucket_object" "calitp-staging-composer" {
!~ crc32c = "YSR+bw==" -> (known after apply)
!~ detect_md5hash = "M4UpDcybCS1BOsyu/bHXpw==" -> "different hash"
!~ generation = 1760994532361746 -> (known after apply)
id = "calitp-staging-composer-plugins/hooks/ckan_hook.py"
!~ md5hash = "M4UpDcybCS1BOsyu/bHXpw==" -> (known after apply)
name = "plugins/hooks/ckan_hook.py"
# (17 unchanged attributes hidden)
}
# google_storage_bucket_object.calitp-staging-composer["plugins/operators/dbt_bigquery_to_gcs_operator.py"] will be updated in-place
!~ resource "google_storage_bucket_object" "calitp-staging-composer" {
!~ crc32c = "P1uAmA==" -> (known after apply)
!~ detect_md5hash = "AIcFPMmXnq7Y4YhFM/azmg==" -> "different hash"
!~ generation = 1760994532355950 -> (known after apply)
id = "calitp-staging-composer-plugins/operators/dbt_bigquery_to_gcs_operator.py"
!~ md5hash = "AIcFPMmXnq7Y4YhFM/azmg==" -> (known after apply)
name = "plugins/operators/dbt_bigquery_to_gcs_operator.py"
# (17 unchanged attributes hidden)
}
# google_storage_bucket_object.calitp-staging-composer["plugins/operators/gcs_to_ckan_operator.py"] will be updated in-place
!~ resource "google_storage_bucket_object" "calitp-staging-composer" {
!~ crc32c = "NiTmmA==" -> (known after apply)
!~ detect_md5hash = "OUthi8/nuad4CH/kP8JDVQ==" -> "different hash"
!~ generation = 1761007607116931 -> (known after apply)
id = "calitp-staging-composer-plugins/operators/gcs_to_ckan_operator.py"
!~ md5hash = "OUthi8/nuad4CH/kP8JDVQ==" -> (known after apply)
name = "plugins/operators/gcs_to_ckan_operator.py"
# (17 unchanged attributes hidden)
}
# google_storage_bucket_object.calitp-staging-composer["plugins/operators/scrape_state_geoportal.py"] will be updated in-place
!~ resource "google_storage_bucket_object" "calitp-staging-composer" {
!~ crc32c = "3pMECQ==" -> (known after apply)
!~ detect_md5hash = "qwOK0bYTQ/9mzvdFyKCNGQ==" -> "different hash"
!~ generation = 1749661098094424 -> (known after apply)
id = "calitp-staging-composer-plugins/operators/scrape_state_geoportal.py"
!~ md5hash = "qwOK0bYTQ/9mzvdFyKCNGQ==" -> (known after apply)
name = "plugins/operators/scrape_state_geoportal.py"
# (17 unchanged attributes hidden)
}
# google_storage_bucket_object.calitp-staging-composer["plugins/scripts/gtfs_rt_parser.py"] will be updated in-place
!~ resource "google_storage_bucket_object" "calitp-staging-composer" {
!~ crc32c = "qYETHA==" -> (known after apply)
!~ detect_md5hash = "1sRWG9gMSF57EIUYXiLLHw==" -> "different hash"
!~ generation = 1759360739479217 -> (known after apply)
id = "calitp-staging-composer-plugins/scripts/gtfs_rt_parser.py"
!~ md5hash = "1sRWG9gMSF57EIUYXiLLHw==" -> (known after apply)
name = "plugins/scripts/gtfs_rt_parser.py"
# (17 unchanged attributes hidden)
}
# google_storage_bucket_object.calitp-staging-composer-catalog will be updated in-place
!~ resource "google_storage_bucket_object" "calitp-staging-composer-catalog" {
!~ content = (sensitive value)
!~ crc32c = "Gk1VqA==" -> (known after apply)
!~ detect_md5hash = "eUKd1ciP+MoKDsabNB5MKA==" -> "different hash"
!~ generation = 1760990172721783 -> (known after apply)
id = "calitp-staging-composer-data/warehouse/target/catalog.json"
!~ md5hash = "eUKd1ciP+MoKDsabNB5MKA==" -> (known after apply)
name = "data/warehouse/target/catalog.json"
# (16 unchanged attributes hidden)
}
# google_storage_bucket_object.calitp-staging-composer-manifest will be updated in-place
!~ resource "google_storage_bucket_object" "calitp-staging-composer-manifest" {
!~ content = (sensitive value)
!~ crc32c = "+xEdnA==" -> (known after apply)
!~ detect_md5hash = "23NWIx9Qyru9vv7kVQJGeA==" -> "different hash"
!~ generation = 1760990174532266 -> (known after apply)
id = "calitp-staging-composer-data/warehouse/target/manifest.json"
!~ md5hash = "23NWIx9Qyru9vv7kVQJGeA==" -> (known after apply)
name = "data/warehouse/target/manifest.json"
# (16 unchanged attributes hidden)
}
Plan: 0 to add, 11 to change, 0 to destroy.📝 Plan generated in Plan Terraform for Warehouse and DAG changes #826 |
…or it "[B324:hashlib] Use of weak MD5 hash for security. Consider usedforsecurity=False Severity: High Confidence: High"
…without_timeout] Call to requests without timeout Severity: Medium Confidence: Low"
erikamov
force-pushed
the
mov/4408-remove-skipped-checks
branch
from
67d639f to
ef80699
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This PR removes skipped bandit checks so they can be validated in new commits to avoid problems instead of always skipped.
Checks removed:
This issue were found when fixing #4408.
Type of change
How has this been tested?
Tested locally running:
pre-commit installpre-commit run --show-diff-on-failure --color=always --all-filesChanges on code to fix issues tested on Staging:
TESTING....
Post-merge follow-ups