From 32327d606f421b940a756a1a2ad948077e2713b4 Mon Sep 17 00:00:00 2001 From: Bassam Sayed Date: Thu, 22 Oct 2026 11:35:03 -0400 Subject: [PATCH] ci: leave scripts/ out of the Veracode scan scripts/ is maintainer tooling (docs archiving, release checks). It is in the sdist's source tree but never installed or run by a build or by eqty_sdk. With veracode-severity now enforced, its two Very High CWE-78 findings in scripts/archive_version.py fail the main scan; both are subprocess.run calls with argument lists and no shell. --- .github/workflows/code-scan.yaml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/workflows/code-scan.yaml b/.github/workflows/code-scan.yaml index f605f19..dd0d128 100644 --- a/.github/workflows/code-scan.yaml +++ b/.github/workflows/code-scan.yaml @@ -66,7 +66,9 @@ jobs: veracode-api-key: ${{ secrets.VERACODE_API_KEY }} rl-scanner: false # vendor/openssl-src/openssl/external is build-only Perl bundled by OpenSSL (GPL-1.0), not shipped in any built artifact - exclude-dirs: .vbuild-actions vendor/openssl-src/openssl/external + # scripts/ is maintainer tooling (docs archiving, release checks): it is in the sdist's source tree + # but never installed or run by a build or by eqty_sdk + exclude-dirs: .vbuild-actions vendor/openssl-src/openssl/external scripts # Main branch scans: Full attestation in TEE security-scan-main: @@ -127,4 +129,6 @@ jobs: veracode-api-key: ${{ secrets.VERACODE_API_KEY }} rl-scanner: false # vendor/openssl-src/openssl/external is build-only Perl bundled by OpenSSL (GPL-1.0), not shipped in any built artifact - exclude-dirs: .vbuild-actions vendor/openssl-src/openssl/external + # scripts/ is maintainer tooling (docs archiving, release checks): it is in the sdist's source tree + # but never installed or run by a build or by eqty_sdk + exclude-dirs: .vbuild-actions vendor/openssl-src/openssl/external scripts