* feat(ci): add security check to block .claude/ and .vscode/ directories
Add workflow that calls the security_check_directories action from
cloud-content-ci-automation to fail PRs containing files under .claude/
or .vscode/ directories.
Integrates with all_green_check.yaml as a required job for PRs.
Ref: ACA-6411
* fix(ci): suppress SonarCloud S7637 for reusable actions using @main
Internal reusable actions from ansible-network/github_actions and
ansible-collections/cloud-content-ci-automation use @main refs for
simpler maintenance. Suppress the 'use full commit SHA' rule for
workflow files.
* fix(ci): use correct org and pin action to commit SHA
Address review feedback:
- Change org from ansible-collections to ansible
- Pin to commit SHA 74b5fe87 instead of @main
* docs: add changelog fragment for security check workflow
* Update changelogs/fragments/1173-security-check-workflow.yml
---------
(cherry picked from commit 6bb9cce51b)
Co-authored-by: GomathiselviS <gomathiselvi@gmail.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: Bianca Henderson <beeankha@gmail.com>
Unit tests pass hardcoded '/tmp/...' strings as fake module arguments (for
example chart_ref) into fully mocked helm commands, so no file is ever
created and there is no real exposure. SonarCloud's python:S5443 still
raises a security hotspot on each literal and, because it only scores new
code, drops a PR's security rating even though the same pattern already
pervades the existing test suite.
Scope the suppression to tests/** only. Production code creates temporary
files via tempfile.mkstemp / NamedTemporaryFile and remains covered by the
rule, where it carries real value.
AI-assisted commit with Claude Opus
(cherry picked from commit 0836e96c2d)
Co-authored-by: Yuriy Novostavskiy <yuriy@novostavskiy.kyiv.ua>
Ansible module argument_spec is conventionally defined with the dict(...)
constructor rather than {...} literals, for readability and consistency
across the collection. SonarCloud's python:S7498 ("Literal syntax should
be preferred...") flags this as a false positive and re-fires on every
new module argument. Ignore the rule project-wide via sonar-project.properties.
Fixes#1151
(cherry picked from commit 1c20b53bdc)
Co-authored-by: Yuriy Novostavskiy <yuriy@novostavskiy.kyiv.ua>
