From f453f5549e300695f8442e1b4a5e0b42a5878c4a Mon Sep 17 00:00:00 2001 From: Ilya Skornyakov Date: Mon, 22 Jun 2026 15:41:33 +0300 Subject: [PATCH 1/2] NO-ISSUE: Reduce false positives --- .coderabbit.yaml | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/.coderabbit.yaml b/.coderabbit.yaml index b5c83a0..e659986 100644 --- a/.coderabbit.yaml +++ b/.coderabbit.yaml @@ -26,6 +26,9 @@ reviews: # package-lock.json, Cargo.lock) are deliberately kept so the supply-chain # path_instructions block fires on them. - "!yarn.lock" + # Keycloak realm exports: config data with dev client secrets and + # RFC 6238 TOTP defaults, not reviewable code. + - "!**/realm.json" auto_review: enabled: true @@ -342,13 +345,23 @@ reviews: keys, credentials. Also flag base64 strings >32 chars in config, URLs with embedded credentials, variables named api_key/secret/ token/password assigned string literals. + + EXCEPTION: Do NOT flag default admin/admin credentials in + developer setup or maintenance scripts (e.g., Keycloak token + requests with username=admin, password=admin). These are + standard defaults for local development environments. mode: "error" - name: "no-weak-crypto" instructions: | Flag MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB mode usage. Flag custom crypto implementations. Flag non-constant-time - comparison of secrets or tokens. Do NOT flag RSA 2048. + comparison of secrets or tokens. + + EXCEPTION: Do NOT flag RSA 2048. Do NOT flag md5sum or + sha1sum when used for non-cryptographic purposes (file change + detection, checksums, cache keys). Do NOT flag HmacSHA1 for + TOTP/OTP configuration (RFC 6238 default algorithm). mode: "error" - name: "no-injection-vectors" @@ -357,6 +370,10 @@ reviews: eval/exec on untrusted data, pickle.loads on untrusted input, yaml.load without SafeLoader, os.system with variables, dangerouslySetInnerHTML with user data. + + EXCEPTION: Do NOT flag jq filter string interpolation when + the variable originates from a prior jq extraction on the + same local file, not from user input. mode: "error" - name: "container-privileges" From 184d84f08ed8febac9b070dd26cf34830ee0c8c6 Mon Sep 17 00:00:00 2001 From: Ilya Skornyakov Date: Mon, 22 Jun 2026 15:42:37 +0300 Subject: [PATCH 2/2] NO-ISSUE: Add yamllint config and GitHub Actions workflow Assisted-by: Claude --- .github/workflows/yamllint.yml | 30 ++++++++++++++++++++++++++++++ .yamllint.yml | 26 ++++++++++++++++++++++++++ 2 files changed, 56 insertions(+) create mode 100644 .github/workflows/yamllint.yml create mode 100644 .yamllint.yml diff --git a/.github/workflows/yamllint.yml b/.github/workflows/yamllint.yml new file mode 100644 index 0000000..689f4f7 --- /dev/null +++ b/.github/workflows/yamllint.yml @@ -0,0 +1,30 @@ +--- +name: Lint YAML + +on: + push: + branches: + - main + pull_request: + branches: + - main + +permissions: + contents: read + +jobs: + yamllint: + name: yamllint + runs-on: ubuntu-latest + + steps: + - name: Checkout repository + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false + + - name: Install yamllint + run: pip install --user yamllint + + - name: Run yamllint + run: yamllint --strict . diff --git a/.yamllint.yml b/.yamllint.yml new file mode 100644 index 0000000..ef7714c --- /dev/null +++ b/.yamllint.yml @@ -0,0 +1,26 @@ +--- +extends: default + +rules: + line-length: disable + document-start: disable + indentation: + spaces: 2 + indent-sequences: true + check-multi-line-strings: false + comments: + require-starting-space: true + ignore-shebangs: true + min-spaces-from-content: 1 + truthy: + allowed-values: ["true", "false"] + check-keys: false + trailing-spaces: enable + braces: + min-spaces-inside: 0 + max-spaces-inside: 0 + brackets: + min-spaces-inside: 0 + max-spaces-inside: 0 + empty-lines: + max: 1