mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-08 11:46:35 +00:00
kevinveenbirkenbachandClaude Opus 4.8
fc77d9d265
Resolve the 80 open CodeQL/code-scanning alerts on this branch. Security-sensitive fixes: - cli/administration/deploy/development: break the unsafe import cycle by extracting the env/arg helpers into a leaf module `env.py`, giving the load-time DAG compose -> common -> deps -> env. - web-app-bluesky login-broker server.js: prototype-pollution guard on cookie parsing, CR/LF + control-char log sanitisation, HTML-escaped exception text, and a ReDoS-bounded handle regex. - web-app-baserow SSO: harden the open-redirect `next` handling. - network diagnose probes: require TLS >= 1.2. - actionlint installer: validate tar members against path traversal. - decidim/apt-purge lint regexes: rewrite to avoid catastrophic backtracking. - 6x Playwright URL regexes anchored; crs-k/stale-branches pinned to a commit SHA. Mechanical cleanups: unused imports/globals/locals, empty-except comments, import-and-import-from, implicit-string-concat, multiple-definition, unreachable/useless-assignment. False positives are intentionally left in place (Django settings patches, Odoo __manifest__, side-effect imports, cross-module symbols). Recurrence guards: - import-linter contract (pyproject + tests/lint) locks the dev-deploy package acyclic; a new cycle now fails CI instead of only CodeQL. - new lint test requires every bandit (S###) `noqa` to carry a justification. - BLE001 (blind-except) added to ruff as a ratchet (tests/roles exempt, current production offenders grandfathered). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Network 🌐
Contributor-side network tooling: probe the live container network stack, suggest free per-role subnets, and suggest free host-bound ports.
Subcommands 🧭
| Path | Purpose |
|---|---|
| diagnose/ | Run python -m cli.contributing.network.diagnose to print a structured DNS / TCP / TLS / PMTU report (IPv4 + IPv6) plus interface MTU, /etc/resolv.conf, /etc/hosts, proxy env vars, and CA bundle summaries from inside the running infinito container. Exposed as make diagnose-network. |
| address/ | cli contributing network address suggest: propose the next free per-role IPv4 subnet(s) gap-first within the established umbrella blocks. |
| ports/ | cli contributing network ports suggest: propose free host-bound ports inside PORT_BANDS.<scope>.<category>. |
Related Documentation 📚
- docs/contributing/actions/debugging/network.md explains how to read the diagnose output and how to fix MTU / IPv6 / connectivity issues.
- docs/contributing/tools/network/ covers the contract of the
addressandportssuggesters.