Skip to content

Local dev + Dependabot + SES infra fixes #459

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lkacenja merged 3 commits into from
Jun 26, 2026
Merged

Local dev + Dependabot + SES infra fixes #459

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
1a2f065
Require LOCALSTACK_AUTH_TOKEN for local LocalStack
lkacenja Jun 26, 2026
b701221
Dependabot: monitor Python components (pip)
lkacenja Jun 26, 2026
04c9666
SES: pin module to v0.25.2 to stop key rotation
lkacenja Jun 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,3 +21,16 @@ updates:
open-pull-requests-limit: 10
cooldown:
default-days: 7
- package-ecosystem: pip

@aikido-pr-checks aikido-pr-checks Bot Jun 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Dependabot pip entries added without requiring or referencing lockfiles or hashed requirements; add/verify lockfiles (with hashes) for '/python_components/*' to prevent silent upgrades.

Details

✨ AI Reasoning
​The added pip update block enables Dependabot for multiple python_components directories but does not enforce or reference lockfile usage or checksum verification (e.g., requirements.txt with hashes or Pipfile.lock). Enabling automated updates without ensuring lockfile/hash-based installs can allow silent upgrades that the rule aims to prevent. The change is confined to the new pip configuration lines in the dependabot.yml diff.

🔧 How do I fix it?
Include lockfiles in your repo and CI. Pin exact versions or SHAs in manifests. Enable checksum verification. Set ignore-scripts in npm or equivalent. Enforce a 72hr minimum package age policy to avoid newly published malicious packages.

Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info

directories:
- "/python_components/accessibility_scan"
- "/python_components/ci"
- "/python_components/classifier"
- "/python_components/crawler"
- "/python_components/document_inference"
- "/python_components/evaluation"
schedule:
interval: daily
open-pull-requests-limit: 10
cooldown:
default-days: 7
1 change: 1 addition & 0 deletions docker-compose.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@ services:
ports:
- "4566:4566" # LocalStack edge port
environment:
- LOCALSTACK_AUTH_TOKEN=${LOCALSTACK_AUTH_TOKEN:?LocalStack now requires an auth token. Get one at https://app.localstack.cloud and set LOCALSTACK_AUTH_TOKEN in your shell or a gitignored .env file.}
- SERVICES=s3,lambda,logs,secretsmanager
- AWS_DEFAULT_REGION=us-east-1
- DOCKER_HOST=unix:///var/run/docker.sock
Expand Down
2 changes: 1 addition & 1 deletion terraform/modules/ses/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ data "aws_route53_zone" "domain" {

module "ses" {
name = "${var.project_name}-${var.environment}-ses"
source = "github.com/cloudposse/terraform-aws-ses"
source = "github.com/cloudposse/terraform-aws-ses?ref=v0.25.2"

@aikido-pr-checks aikido-pr-checks Bot Jun 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

module source pinned to tag '?ref=v0.25.2' but not to an immutable commit SHA or checksum; prefer a commit SHA (or checksum) for stronger immutability.

Details

✨ AI Reasoning
​The change sets module source to a GitHub ref query using a tag (v0.25.2) rather than an immutable commit SHA or including checksum verification. This aims to improve determinism over floating HEAD, but still allows the tag to be repointed or replaced in some workflows and lacks checksum validation. The edit occurs on the module source line and is the only change to the module's dependency declaration in this diff.

🔧 How do I fix it?
Include lockfiles in your repo and CI. Pin exact versions or SHAs in manifests. Enable checksum verification. Set ignore-scripts in npm or equivalent. Enforce a 72hr minimum package age policy to avoid newly published malicious packages.

Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info

domain = var.domain_name
zone_id = data.aws_route53_zone.domain.id
verify_domain = true
Expand Down