Repository navigation
Repo hygiene: 21 ruff errors and open CodeQL findings outside the capture engines #77
Description
Activity
I'd like to take this, starting with the stack-trace exposure fix as its own PR per the suggested split, then the pinning work as a follow-up.
Plan for the first PR: keep the existing server-side logging (
print(..., traceback.format_exc())where it's already there, add it where it isn't) and replace what reaches the caller in all five spots with a generic message, so the exception detail stays in server logs rather than the HTTP response.Flagging before I start in case anyone is already on this.
@kingztech2019 yes, go ahead, and your plan is the one I would have written. Confirming the split so scope does not drift mid-review.
PR 1: the stack-trace exposures. Five instances of
py/stack-trace-exposureinintegrations/sentinel/sentinel/server.py, at lines 128, 131, 299, 311 and 347. Your approach is right: keep the server-side logging withtraceback.format_exc()and add it where it is missing, then replace what reaches the caller with a generic message. The thing I care about is that the fix does not trade an information leak for an unobservable service. A caller learning nothing and an operator learning nothing are different failures, and only the first one is the bug.This is the one worth doing first because it is a real leak in a running service rather than a lint preference.
PR 2: pinning.
PinnedDependenciesIDacrossramen-ai-cmcp-conformance.yml,scheduled-agents-tests.yml,agentrust-codex-tests.yml,spendguard-conformance.yml,claude-code-tests.yml,codeql.yml,scorecard.yml, and theintegrations/sentinel/Dockerfile. Unpinnedpip install, unpinned actions, unpinned base image. The newer workflows already pin actions by SHA, so follow that convention rather than inventing one, and pin the Dockerfile base by digest.This matters more here than it would elsewhere: the repository publishes supply-chain integrity tooling, and an unpinned action in it is the kind of thing someone screenshots.
PR 3, or the tail of PR 2: the 21 ruff errors at
--target-version py39inintegrations/sentinel,integrations/comply54anddecisionassure. Capture engines, core andscripts/are already clean.Then repo-wide
ruff checkbecomes a required check, and not before, because a gate that is red on arrival gets ignored or bypassed. I will add it once the three are in rather than asking you to.Take them in that order and tag me on each. Thanks for #121, and for reproducing before offering both times.
- added 3 commits that reference this issue
on Aug 24, 2026 Rechecked all four findings. Three were already fixed; the fourth is now gated, and one number in the issue does not reproduce for a reason worth recording.
Finding Status py/stack-trace-exposure, 5 instances insentinel/server.pyFixed in #132. The response is a generic {"error": "Invalid input"}; onlyprint(traceback.format_exc())reaches stdout, which is a log rather than a caller-visible sink21 ruff errors in sentinel,comply54,decisionassureFixed in #137, and now gated. See below Unpinned GitHub actions Fixed. All 49 actions/checkout, 42actions/setup-python, and every third-party action are SHA-pinnedUnpinned container base image Fixed. sentinel/Dockerfileispython:3.11-slim@sha256:9c900dea…Unpinned pip installin workflowsOpen, and arguably intended. The conformance workflows install agentrust-trace-testsunpinned precisely so they test against the current release. Pinning them would defeat what they exist to checkThe gate you asked for
then make repo-wide
ruffa required check once it is cleanDone in #145. It runs on every PR, pins
ruff==0.16.3, and selects the default set (E4, E7, E9, F).That scope is deliberate. It catches defects rather than preferences, and several integrations here are contributed by their vendors under CONTRIBUTING rule 5. Failing somebody's pull request on import sorting is how a self-serve submission path stops being self-serve. A wider set, if wanted, should arrive with its own fix pass rather than being switched on for the next contributor to discover.
Nine findings had to be cleared first, and eight were introduced the same day by the WCM integrations: imports left unused when those modules moved to the SDK's
artifact_digest, plus typing leftovers. They were tested and never linted, because nothing linted this repository. Exactly the gap a gate closes and a review does not.Why the "21" will not reproduce
A bare
ruff checkon the three named directories reports 128 findings here, not 21:UP006,FA100,I001,DTZ005and friends. Ruff resolves configuration from outside the repository when the repository carries none, so the effective rule set depends on whose machine runs it. Against the default set, those same directories are clean.That is the real lesson from this issue, and it is now fixed: the gate states its version and its selection explicitly, so the number means the same thing on every machine.
Closing. The remaining
pip installquestion is a deliberate trade-off rather than debt; happy to open a narrow issue for it if you would rather it were tracked.
Found while working on the capture engines and deliberately not fixed there, to keep those pull requests reviewable. All pre-existing.
21 ruff errors at
--target-version py39, inintegrations/sentinel,integrations/comply54anddecisionassure. The capture engines, the core andscripts/are clean, so a repo-wideruff checkcannot currently be a gate.Open CodeQL findings:
py/stack-trace-exposure, medium, five instances inintegrations/sentinel/sentinel/server.py(lines 128, 131, 299, 311, 347). Stack traces reaching an external caller. This one is worth doing first: it is a real information leak in a service, not a lint preference.PinnedDependenciesID, medium, acrossramen-ai-cmcp-conformance.yml,scheduled-agents-tests.yml,agentrust-codex-tests.yml,spendguard-conformance.yml,claude-code-tests.yml,codeql.yml,scorecard.yml, andintegrations/sentinel/Dockerfile: unpinnedpip installcommands, unpinned GitHub actions, and an unpinned container base image.The pinning findings matter more than usual here, given this repository publishes supply-chain integrity tooling. The newer workflows pin actions by SHA; the older ones do not.
Suggest splitting: one pull request for the stack-trace exposures, one for pinning, then make repo-wide
ruffa required check once it is clean.