mirror of
https://github.com/Sea-Haven-Industries/seahaven-door-unlock-api.git
synced 2026-09-30 07:03:12 +00:00
211a00a013
Some checks failed
Deploy / deploy (push) Has been cancelled
* ci: add least-privilege permissions blocks to workflow callers Resolves code scanning alerts #3 and #4 (actions/missing-workflow-permissions). Both callable workflows only need contents: read; the dependency-review callable already declares it internally, this caps the caller token to match. Signed-off-by: Adam Moussa <adam@seahavenind.com> * build(deps): bump aws-cdk-lib to 2.262.0 to patch brace-expansion aws-cdk-lib 2.261.0 bundles brace-expansion 5.0.6, which is vulnerable to CVE-2026-13149 (GHSA-3jxr-9vmj-r5cp), an exponential-time DoS in expand(). This was the only path pulling the vulnerable package into the tree. 2.262.0 vendors the patched 5.0.7, resolving Dependabot alert 7. Because brace-expansion arrives bundled inside the aws-cdk-lib tarball rather than resolved by npm, the aws-cdk-lib bump is the only way to move it. Signed-off-by: Adam Moussa <adam@seahavenind.com> * refactor(cdk): drop unreferenced ssm value parameters fromStringParameterName injects an AWS::SSM::Parameter::Value CloudFormation parameter to carry the parameter's value, but DoorId and PhoneIps are only used for grantRead, which builds the ARN from the name string — so DoorIdParameter and PhoneIpsParameter sat unreferenced in the template (flagged W2001 by the CloudFormation validator newly bundled in aws-cdk-lib 2.262.0). Switching to fromStringParameterAttributes with forceDynamicReference resolves the value lazily via an SSM dynamic reference, emitting nothing when unused. Verified the synthesized template is identical apart from the removed Parameters entries and the CDKMetadata analytics hash — no IAM or resource changes. Also re-points the four line-keyed semgrep detect-child-process suppressions (adjudicated FPs, INFRA-105) to the shifted line numbers; the findings themselves are unchanged. Signed-off-by: Adam Moussa <adam@seahavenind.com> --------- Signed-off-by: Adam Moussa <adam@seahavenind.com>
36 lines
3.1 KiB
JSON
36 lines
3.1 KiB
JSON
{
|
|
"suppressions": [
|
|
{
|
|
"id": "semgrep-detect-child-process-61",
|
|
"justification": "False positive. CDK local-bundling tryBundle(outputDir) in lib/door-unlock-stack.ts. execSync runs esbuild at cdk-synth time; outputDir is supplied by the CDK framework (staging temp dir) and the other path segments are repo-relative constants. No untrusted input, build-time only on a trusted host, never runs at request time. Verified proof-or-kill 2026-07-13. INFRA-105. Re-pointed from line 55 on 2026-07-23: fromStringParameterName cleanup shifted lines in lib/door-unlock-stack.ts; finding unchanged."
|
|
},
|
|
{
|
|
"id": "semgrep-detect-child-process-90",
|
|
"justification": "False positive. Same as semgrep-detect-child-process-55: CDK local-bundling esbuild execSync with framework-supplied synth-time outputDir. Build-time only. INFRA-105. Re-pointed from line 84 on 2026-07-23: fromStringParameterName cleanup shifted lines in lib/door-unlock-stack.ts; finding unchanged."
|
|
},
|
|
{
|
|
"id": "semgrep-detect-child-process-128",
|
|
"justification": "False positive. Same as semgrep-detect-child-process-55: CDK local-bundling esbuild execSync with framework-supplied synth-time outputDir. Build-time only. INFRA-105. Re-pointed from line 122 on 2026-07-23: fromStringParameterName cleanup shifted lines in lib/door-unlock-stack.ts; finding unchanged."
|
|
},
|
|
{
|
|
"id": "semgrep-detect-child-process-210",
|
|
"justification": "False positive. Same as semgrep-detect-child-process-55: CDK local-bundling esbuild execSync with framework-supplied synth-time outputDir. Build-time only. INFRA-105. Re-pointed from line 202 on 2026-07-23: fromStringParameterName cleanup shifted lines in lib/door-unlock-stack.ts; finding unchanged."
|
|
},
|
|
{
|
|
"id": "checkov-CKV_AWS_111-234",
|
|
"justification": "False positive. CDK-generated LogRetention custom-resource role (cdk.out synth output). logs:PutRetentionPolicy/DeleteRetentionPolicy on Resource:* is inherent to the aws-cdk LogRetention singleton construct (log-group names are not known at synth time). Accepted CDK boilerplate, not hand-written IAM. INFRA-105."
|
|
},
|
|
{
|
|
"id": "gitleaks-generic-api-key-5193",
|
|
"justification": "False positive. A provisioning-template token placeholder (the literal __DOOR_UNLOCK_TOKEN__) in Yealink T54W templates \u2014 not a secret. The real token was rotated in SSM (INFRA-105, param v3 2026-07-06) and the historical live token was removed by the git-filter-repo history scrub; only the placeholder remains."
|
|
},
|
|
{
|
|
"id": "gitleaks-generic-api-key-900",
|
|
"justification": "False positive. Historical blob of a Yealink provisioning template. After the INFRA-105 history scrub this line holds the __DOOR_UNLOCK_TOKEN__ placeholder only; the pre-scrub live token was rotated in SSM 2026-07-06 and is invalid."
|
|
},
|
|
{
|
|
"id": "gitleaks-generic-api-key-3097",
|
|
"justification": "False positive. A __DOOR_UNLOCK_TOKEN__ placeholder in a Yealink provisioning template (unlock linekey) \u2014 not a secret. Live token rotated in SSM 2026-07-06; history scrubbed via git-filter-repo (INFRA-105)."
|
|
}
|
|
]
|
|
}
|