Repository navigation
Integration - #20
Merged
Merged
Integration#20
Conversation
Public: read, clone and fork only. Issues, wiki, discussions and projects off; pull requests from collaborators only; outside fork workflows need approval; read-only default workflow token; ruleset against deleting or force-pushing main and integration; secret scanning, push protection, Dependabot alerts and private vulnerability reporting on. Notes that the security scan needs AWS_ROLE on (or shared with) this public repository. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Same shared security-scan workflow and inputs; picks up the FIPS Trivy build and GOPATH tmpfs fixes. The run still needs secrets.AWS_ROLE on this public repository (the org secret is limited to private repositories). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…the runner The shared Trivy job now frees the hosted runner's unused toolchains before an image scan and works on the disk with the most room (/mnt), so a large image no longer fails with "no space left on device". The same pin in every MicroHealth repository. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… sast.sh safe in a hook * The shared SAST, Trivy and ZAP jobs take a fresh AWS session just before their S3 upload: a long scan outlived the first one (ExpiredToken). * scripts/sast.sh (copied from sast-rules/local/sast.sh): run from a git hook, the hook's GIT_DIR made it fetch the rules into THIS repository and move its HEAD onto the rules commit. It now clears the hook's git environment first, and refetches a cache left empty by the old version. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
sast-rules' main is its release branch and its workflows resolve their own rules from the commit they run at, so security-scan.yml calls it @main instead of a commit pin: every run takes the newest release with nothing to merge. The supply-chain guard gets one named exception (SAST_RULES_AT_MAIN: exactly sast-rules' workflows at exactly main), tested both ways; everything else stays SHA-pinned. scripts/sast.sh is sast-rules' current local/sast.sh, which resolves @main the same way. AI_RULES.md and SECURITY.md say so. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Trivy reports nothing for this repository (repository scan: 0 vulnerabilities, secrets or misconfigurations); the alerts in code scanning are Opengrep's. Each was reviewed: - Fixed (14): backup header counts parsed with strtol and range-checked instead of sscanf %d (overflow on a crafted SD file; host test added); strncpy -> snprintf for the WiFi config; atoi -> strtol for menu numbers; strnlen bounded by the field for a Set-Cookie header and an SD file name; sizeof / snprintf's return instead of strlen on constants; README no longer quotes two PEM armour lines (read as a private key). - Suppressed inline (23), full rule id and reason: memcpy between fixed-size buffers, strlen on strings the firmware builds, fopen on the SD card (FAT, single user: no TOCTOU), and check_outdated.py's urlopen, which now refuses anything but its two https:// API prefixes. Opengrep 1.30.2 with sast-rules' internal bundle: 37 findings before, 0 after. No RAM change expected; firmware build and idf.py size run in CI (no ESP-IDF locally). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
button 4.2.2 (published 2026-10-14) made the component manager's first install pass take a newer version than dependencies.lock, failing the Tests install job. Pin it in main/idf_component.yml (T-Deck only; pulled in by esp_bsp_generic, not used directly), as was done for led_strip, so the install matches the lock. Locked versions are unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.