4 Commits

Author	SHA1	Message	Date
GomathiselviS	6bb9cce51b	feat(ci): add security check to block .claude/ and .vscode/ directories (#1173) ... * feat(ci): add security check to block .claude/ and .vscode/ directories Add workflow that calls the security_check_directories action from cloud-content-ci-automation to fail PRs containing files under .claude/ or .vscode/ directories. Integrates with all_green_check.yaml as a required job for PRs. Ref: ACA-6411 Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(ci): suppress SonarCloud S7637 for reusable actions using @main Internal reusable actions from ansible-network/github_actions and ansible-collections/cloud-content-ci-automation use @main refs for simpler maintenance. Suppress the 'use full commit SHA' rule for workflow files. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(ci): use correct org and pin action to commit SHA Address review feedback: - Change org from ansible-collections to ansible - Pin to commit SHA 74b5fe87 instead of @main Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * docs: add changelog fragment for security check workflow Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * Update changelogs/fragments/1173-security-check-workflow.yml --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> Co-authored-by: Bianca Henderson <beeankha@gmail.com>	2026-07-02 16:48:56 -04:00
Yuriy Novostavskiy	0836e96c2d	ci: suppress SonarCloud python:S5443 for test code (#1165) ... Unit tests pass hardcoded '/tmp/...' strings as fake module arguments (for example chart_ref) into fully mocked helm commands, so no file is ever created and there is no real exposure. SonarCloud's python:S5443 still raises a security hotspot on each literal and, because it only scores new code, drops a PR's security rating even though the same pattern already pervades the existing test suite. Scope the suppression to tests/** only. Production code creates temporary files via tempfile.mkstemp / NamedTemporaryFile and remains covered by the rule, where it carries real value. AI-assisted commit with Claude Opus	2026-06-29 15:43:10 -04:00
Yuriy Novostavskiy	1c20b53bdc	ci: suppress SonarCloud python:S7498 for argument_spec dict() convention (#1152) ... Ansible module argument_spec is conventionally defined with the dict(...) constructor rather than {...} literals, for readability and consistency across the collection. SonarCloud's python:S7498 ("Literal syntax should be preferred...") flags this as a false positive and re-fires on every new module argument. Ignore the rule project-wide via sonar-project.properties. Fixes #1151	2026-06-25 14:00:33 -04:00
Bianca Henderson	c2cfa51655	[ACA-5027] Configure SonarQube Cloud (#1116) ... * Configure SonarQube Cloud * Update workflow file and add info to README * Resolve sanity errors * Add pinned version details to sonarcloud.yml	2026-05-05 13:09:24 -04:00