Skip to content

chore: PySafeguard repo hygiene - #34

Merged
petrsnd merged 1 commit into
OneIdentity:mainfrom
petrsnd:security/hygiene-20260522-py
May 27, 2026
Merged

chore: PySafeguard repo hygiene#34
petrsnd merged 1 commit into
OneIdentity:mainfrom
petrsnd:security/hygiene-20260522-py

Conversation

@petrsnd

@petrsnd petrsnd commented May 26, 2026

Copy link
Copy Markdown
Member

Summary

  • Adds Dependabot configuration for GitHub Actions and Python package ecosystems.
  • Adds CodeQL workflow coverage for the repository.

Validation

  • Metadata-only repo hygiene change; no runtime code changes.

@petrsnd
ci: add dependabot config and CodeQL workflow
2d28537 
Phase 1 W9 repo-hygiene task: enable continuous dependency scanning and

static analysis.

- .github/dependabot.yml: daily scans for pip (pyproject.toml) and

  github-actions ecosystems, grouped patch+minor updates, majors ignored

  for human review.

- .github/workflows/codeql.yml: weekly + on-push/PR CodeQL analysis for

  python and actions languages with security-and-quality query suite.

Private Vulnerability Disclosure repo setting is a GitHub UI toggle and

is tracked as a manual checklist item in the implementation log.
@petrsnd
petrsnd requested a review from a team as a code owner May 26, 2026 22:31
@petrsnd

petrsnd commented May 26, 2026

Copy link
Copy Markdown
Member Author

Live verified against 192.168.117.15 admin smoke 2026-05-26. Selected GET-only pytest integration subset passed: 11 passed, 0 failed; mutating suites skipped. Full log: .security-review-impl-logs/live-sweep/py-live.log

@petrsnd

petrsnd commented May 27, 2026

Copy link
Copy Markdown
Member Author

Full live appliance sweep re-run (mutation allowed) completed against 192.168.117.15.

Results:

  • SafeguardDotNet (security/review-20260522-dotnet): 15 suites, 71 passed / 0 failed / 2 skipped. SpsIntegration excluded because no SPS appliance was in the lease. Cleanup audit: no SgDnTest objects remained.
  • PySafeguard (security/review-20260522-py): after installing the optional SignalR extra required by event tests, full pytest passed: 453 passed / 0 failed / 0 skipped. Cleanup audit found one leaked PySg_ event-test user; it was deleted and re-audit showed 0 remaining.
  • safeguard.js (security/review-20260522-js): integration suite passed: 11 files, 55 passed / 0 failed / 0 skipped. Cleanup audit: no SgJs_ objects remained.
  • safeguard-bash (security/review-20260522-bash): full suite executed with SAFEGUARD_ALLOW_LOCALHOST=1 after the stock runner PKCE preflight failed against the private appliance address. Result: 14 suites, 323 passed / 10 failed / 0 skipped. Failures are confined to A2A and A2A Access Request Broker retrieval/broker negative-path checks. Cleanup audit: no SgBashTest objects remained.
  • SafeguardJava (security/review-20260522-java): PowerShell integration runner passed: 9 suites, 59 passed / 0 failed / 0 skipped; SpsIntegration excluded because no SPS appliance was in the lease. FP-004 cap regression unit test also passed: 6 passed / 0 failed / 0 skipped. Cleanup audit: no SgJTest objects remained.

Lease released in SECURITY-REVIEW.md. Follow-up needed: investigate safeguard-bash A2A failures and the PySafeguard event-test cleanup leak.

@petrsnd
petrsnd merged commit def06ca into OneIdentity:main May 27, 2026
2 checks passed
@petrsnd
petrsnd deleted the security/hygiene-20260522-py branch May 27, 2026 02:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@petrsnd