Skip to content

Deploy: 2026-06-26 #458

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lkacenja merged 3 commits into from
Jun 26, 2026
Merged

Deploy: 2026-06-26 #458

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
22a4a86
Dependencies: 2026-06-26 (#457)
lkacenja Jun 26, 2026
7a68963
Merge branch 'main' into dev
lkacenja Jun 26, 2026
d8abb0c
Local dev + Dependabot + SES infra fixes (#459)
lkacenja Jun 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,3 +21,16 @@ updates:
open-pull-requests-limit: 10
cooldown:
default-days: 7
- package-ecosystem: pip

@aikido-pr-checks aikido-pr-checks Bot Jun 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added pip package-ecosystem monitoring without enforcing lockfiles or hashed requirements; ensure each python_components directory includes pinned, hash-verified requirements (e.g., requirements.txt with hashes or a pipfile.lock) so Dependabot updates use checksum-verified lockfiles.

Details

✨ AI Reasoning
​Dependabot configuration for the pip ecosystem was added. The intent is to monitor Python package updates. The added block (package-ecosystem: pip and directories list) does not include any reference to pinned hashes, constraints files with hashes, or an explicit requirement that lockfiles or hashed requirements are used in those directories. This can permit Dependabot PRs that update requirements without ensuring checksum verification or pinned versions are present in the repo/build process, violating the rule that package lockfiles and checksum verification must be enforced. The terraform source pin change improved pinning and does not violate the rule. The docker-compose addition is unrelated to dependency manifests.

🔧 How do I fix it?
Include lockfiles in your repo and CI. Pin exact versions or SHAs in manifests. Enable checksum verification. Set ignore-scripts in npm or equivalent. Enforce a 72hr minimum package age policy to avoid newly published malicious packages.

Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info

directories:
- "/python_components/accessibility_scan"
- "/python_components/ci"
- "/python_components/classifier"
- "/python_components/crawler"
- "/python_components/document_inference"
- "/python_components/evaluation"
schedule:
interval: daily
open-pull-requests-limit: 10
cooldown:
default-days: 7
4 changes: 2 additions & 2 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,10 +22,10 @@ jobs:
--health-retries 5

steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7

- name: Set up Ruby
uses: ruby/setup-ruby@v1
uses: ruby/setup-ruby@v1.313.0
with:
bundler-cache: true

Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/deploy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,7 @@ jobs:
run: echo "Deploying to ${{ needs.determine_environment.outputs.env_name }}"

- name: Checkout
uses: actions/checkout@v6
uses: actions/checkout@v7

- name: Debug OIDC claims
run: |
Expand All @@ -72,7 +72,7 @@ jobs:
echo "Repository ref: repo:${{ github.repository }}:ref:${{ github.ref }}"

- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v6
uses: aws-actions/configure-aws-credentials@v6.1.3
with:
role-to-assume: ${{ vars.AWS_ROLE_ARN }}
aws-region: ${{ vars.AWS_REGION }}
Expand All @@ -83,7 +83,7 @@ jobs:

- name: Login to Amazon ECR
id: login-ecr
uses: aws-actions/amazon-ecr-login@v2
uses: aws-actions/amazon-ecr-login@v2.1.5

- name: Build, tag, and push Document Inference Lambda image to ECR
id: build-document-inference-image
Expand Down Expand Up @@ -145,7 +145,7 @@ jobs:

- name: Debug deployment failure
if: failure() && steps.deploy.outcome == 'failure'
uses: aws-actions/configure-aws-credentials@v6
uses: aws-actions/configure-aws-credentials@v6.1.3
with:
role-to-assume: ${{ vars.AWS_ROLE_ARN }}
aws-region: ${{ vars.AWS_REGION }}
Expand Down
12 changes: 6 additions & 6 deletions .github/workflows/eval.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,7 @@ jobs:
matrix: ${{ steps.set-matrix.outputs.matrix }}
runs: ${{ steps.set-runs.outputs.runs }}
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7
- name: Debug OIDC claims
run: |
echo "GitHub repository: ${{ github.repository }}"
Expand All @@ -73,7 +73,7 @@ jobs:

- name: Configure AWS credentials
if: ${{ github.event.inputs.should_rebuild_images == 'true' }}
uses: aws-actions/configure-aws-credentials@v6
uses: aws-actions/configure-aws-credentials@v6.1.3
with:
role-to-assume: ${{ vars.AWS_ROLE_ARN }}
aws-region: ${{ vars.AWS_REGION }}
Expand All @@ -85,7 +85,7 @@ jobs:
- name: Login to Amazon ECR
id: login-ecr
if: ${{ github.event.inputs.should_rebuild_images == 'true' }}
uses: aws-actions/amazon-ecr-login@v2
uses: aws-actions/amazon-ecr-login@v2.1.5

- name: Build, tag, and push Evaluation Lambda image to ECR
id: build-evaluation-image
Expand Down Expand Up @@ -188,9 +188,9 @@ jobs:
run: ${{ fromJson(needs.build.outputs.runs) }}
max-parallel: 10
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v6
uses: aws-actions/configure-aws-credentials@v6.1.3
with:
role-to-assume: ${{ vars.AWS_ROLE_ARN }}
aws-region: ${{ vars.AWS_REGION }}
Expand All @@ -201,7 +201,7 @@ jobs:

- name: Login to Amazon ECR
id: login-ecr
uses: aws-actions/amazon-ecr-login@v2
uses: aws-actions/amazon-ecr-login@v2.1.5

- name: Invoke Evaluation Lambda
id: invoke-evaluation-lambda
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/plan.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,10 +27,10 @@ jobs:
run: echo "Tofu config directory ./terraform/config/${{ github.event.inputs.environment }}"

- name: Checkout
uses: actions/checkout@v6
uses: actions/checkout@v7

- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v6
uses: aws-actions/configure-aws-credentials@v6.1.3
with:
role-to-assume: ${{ vars.AWS_ROLE_ARN }}
aws-region: ${{ vars.AWS_REGION }}
Expand All @@ -41,7 +41,7 @@ jobs:

- name: Login to Amazon ECR
id: login-ecr
uses: aws-actions/amazon-ecr-login@v2
uses: aws-actions/amazon-ecr-login@v2.1.5

- name: Setup OpenTofu
uses: opentofu/setup-opentofu@v2
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/python_components.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,11 +14,11 @@ jobs:
build:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7
with:
fetch-depth: 0
- name: Set up Python 3.12
uses: actions/setup-python@v6
uses: actions/setup-python@v6.2.0
with:
python-version: "3.12"
- name: Install dependencies
Expand Down
6 changes: 3 additions & 3 deletions Gemfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,14 +26,14 @@ gem "devise", "~> 5.0"
gem "activerecord-session_store"

group :development, :test do
gem "brakeman", "~> 7.1", require: false
gem "brakeman", "~> 8.0", require: false
gem "debug", platforms: %i[mri windows], require: "debug/prelude"
gem "dotenv-rails", "~> 3.1"
gem "standard"
end

group :development do
gem "overcommit", "~> 0.68.0"
gem "overcommit", "~> 0.69.0"
gem "better_errors", "~> 2.10"
gem "ruby-lsp", "~> 0.26"
gem "web-console"
Expand Down Expand Up @@ -61,7 +61,7 @@ gem "aws-sdk-lambda"
gem "aws-sigv4"

# API and Documentation
gem "grape", "~> 2.4"
gem "grape", "~> 3.2"
gem "grape-swagger"

gem "paper_trail", "~> 17.0"
Loading