Skip to content

Resolve existing CodeQL alerts#27

Merged
cbusillo merged 2 commits intomainfrom
code/resolve-codeql-alerts-26
May 3, 2026
Merged

Resolve existing CodeQL alerts#27
cbusillo merged 2 commits intomainfrom
code/resolve-codeql-alerts-26

Conversation

@cbusillo
Copy link
Copy Markdown
Owner

@cbusillo cbusillo commented May 3, 2026

Summary

  • grant CI the explicit least-privilege contents: read permission
  • stop the admin hardening log from interpolating password/email update state
  • document and suppress the intentional PyCharm Odoo config password write, while restricting the generated file to mode 0600

Refs #26

Verification

  • uv run ruff check docker/scripts/run_odoo_data_workflows.py odoo_devkit/ide_support.py tests/test_ide_support.py
  • uv run ruff format --check docker/scripts/run_odoo_data_workflows.py odoo_devkit/ide_support.py tests/test_ide_support.py
  • uv run python -m unittest tests.test_ide_support
  • uv run python -m unittest discover -s tests
  • uv run ruff check .

Notes

The full repo format check still reports pre-existing formatting drift in unrelated files: odoo_devkit/artifact_inputs.py, odoo_devkit/dokploy_config.py, odoo_devkit/workspace_cockpit.py, odoo_devkit/workspace_surface.py, and tests/test_scaffold.py. Those were left untouched to keep this PR focused.

@cbusillo cbusillo force-pushed the code/resolve-codeql-alerts-26 branch from 2fe1d90 to 0cb6658 Compare May 3, 2026 18:27
@cbusillo cbusillo merged commit a10d523 into main May 3, 2026
4 checks passed
@cbusillo cbusillo deleted the code/resolve-codeql-alerts-26 branch May 3, 2026 18:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant