SonarCloud: S7635 secrets-inherit caller stubs

2 open SonarCloud finding(s) in petry-projects/TalkTerm, worst severity MAJOR. Generated by the org SonarCloud Audit.

View in SonarCloud →

Findings

Rule	Count	Representative message
githubactions:S7635	2	Only pass required secrets to this workflow.

Affected files

.github/workflows/dependabot-automerge.yml (1)
.github/workflows/pr-review-mention.yml (1)

Priority

Labeled priority:major — mapped from this bucket's worst SonarCloud severity (MAJOR).

Acceptance

All findings in this workstream resolved to zero in SonarCloud
No behavior change; CI green
Real fixes (no blanket NOSONAR unless a confirmed false positive, noted inline)

Idempotent issue — updated automatically each audit run; auto-closed when the finding count reaches zero.

Dev-Lead Implementation Plan

Issue: #348 — SonarCloud: S7635 secrets-inherit caller stubs

Scope

Resolve githubactions:S7635 ("Only pass required secrets to this workflow") in the two caller stubs by replacing secrets: inherit with an explicit mapping of only the secrets each reusable actually declares — behavior-preserving.

Findings analysis

Verified the two central reusables' workflow_call.secrets declarations:

dependabot-automerge-reusable.yml requires: APP_ID, APP_PRIVATE_KEY (both required: true)
pr-review-mention-reusable.yml requires: GH_PAT_WORKFLOWS, DON_PETRY_BOT_GH_PAT (both required: true)

Note: the pr-review caller header only documented GH_PAT_WORKFLOWS; the reusable requires two secrets. secrets: inherit silently forwarded both, so the explicit mapping must pass both to preserve behavior.

Implementation Checklist

.github/workflows/dependabot-automerge.yml — replace secrets: inherit with explicit APP_ID + APP_PRIVATE_KEY mapping; update header contract (remove the "MUST NOT change secrets: inherit" clause, keep the permissions/uses guidance).
.github/workflows/pr-review-mention.yml — replace secrets: inherit with explicit GH_PAT_WORKFLOWS + DON_PETRY_BOT_GH_PAT mapping; update header contract and the "Requires:" line to list both secrets.

Tests to Write

N/A — behavior-preserving CI/config change (Phase 2 TDD exception). Validation is YAML parse + .dev-lead/scripts/dev-lead-lint.sh.

Test Command

bash .dev-lead/scripts/dev-lead-lint.sh + YAML syntax validation via python yaml.safe_load.

Note on central source of truth

These stubs are declared verbatim copies of central petry-projects/.github standards. This edit resolves the audit locally but drifts from the central stub; a follow-up should propagate the explicit-secrets change to the central source of truth so a future fanout does not revert it.

Dev-Lead: Implementation Complete

Plan Execution

.github/workflows/dependabot-automerge.yml — secrets: inherit → explicit APP_ID + APP_PRIVATE_KEY; header contract updated.
.github/workflows/pr-review-mention.yml — secrets: inherit → explicit GH_PAT_WORKFLOWS + DON_PETRY_BOT_GH_PAT; header contract + "Requires:" list updated.
Verified secret names against each central reusable's workflow_call.secrets declaration.
YAML parse validation + .dev-lead/scripts/dev-lead-lint.sh (green).

Test Results

$ python3 -c "yaml.safe_load(...)"
.github/workflows/dependabot-automerge.yml -> secrets: {'APP_ID': '${{ secrets.APP_ID }}', 'APP_PRIVATE_KEY': '${{ secrets.APP_PRIVATE_KEY }}'}
.github/workflows/pr-review-mention.yml -> secrets: {'GH_PAT_WORKFLOWS': '${{ secrets.GH_PAT_WORKFLOWS }}', 'DON_PETRY_BOT_GH_PAT': '${{ secrets.DON_PETRY_BOT_GH_PAT }}'}
YAML_OK

$ bash .dev-lead/scripts/dev-lead-lint.sh
[lint] shellcheck on 3 file(s)...
  [lint] validating CODEOWNERS...
OK: CODEOWNERS
  [lint] all checks passed
EXIT=0

(No JS unit suite applies — this is a behavior-preserving CI/config change, Phase 2 TDD exception.)

Files Changed

.github/workflows/dependabot-automerge.yml: replaced secrets: inherit with an explicit mapping of the two secrets the reusable declares (APP_ID, APP_PRIVATE_KEY); reworded the "MUST NOT change" contract accordingly.
.github/workflows/pr-review-mention.yml: replaced secrets: inherit with an explicit mapping of the two secrets the reusable declares (GH_PAT_WORKFLOWS, DON_PETRY_BOT_GH_PAT); updated the "Requires:" documentation, which previously listed only one of the two required secrets.

Notes

Behavior preserved: each explicit mapping passes exactly the secrets the corresponding reusable declares as required: true, which is the same set secrets: inherit was forwarding. The pr-review reusable requires two secrets; the caller header had only documented one, so enumerating solely GH_PAT_WORKFLOWS would have broken it — both are now passed and documented.
Unrelated finding untouched: the # NOSONAR(githubactions:S7637) on the uses: line is a separate rule and was left as-is.
Central source-of-truth drift (follow-up): these files are verbatim caller stubs mirrored from petry-projects/.github standards. This fix is local; the same explicit-secrets change should be propagated to the central stub templates so a future fanout does not re-introduce secrets: inherit. Recommend opening a follow-up against the central repo.

SonarCloud Audit (2026-07-14): still open — 2 finding(s), worst severity MAJOR.

Navigation Menu

Repository navigation

SonarCloud: S7635 secrets-inherit caller stubs #348