quality/os-autoinst-distri-fedora
4
0
Fork 2
Code Issues 40 Pull requests 7 Projects Releases Packages Activity Actions 1

Add a section to AI context file to discourage 'security' issues

Browse source 
ai-code-review likes to complain about 'security' issues in
shell commands in the tests and stuff like that. It's almost
always bogus because all the inputs are usually trusted, and the
test execution environment is not really a target anyway. Add
a paragraph explaining this to the project.md file.

Signed-off-by: Adam Williamson <awilliam@redhat.com>
This commit is contained in:
Adam Williamson 2026-03-13 16:05:53 -07:00
commit 6eb68c4ac9
1 changed files with 4 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
.ai_review/project.md
View file

@ -142,3 +142,7 @@ schemas/ # JSON schemas for FIF and openQA template formats
- **`CANNED` image type**: Refers to pre-built installer images (like Silverblue/Kinoite) that have a smaller Anaconda hub without repository spokes. Handled similarly to `LIVE` for hub needle selection.
- **CoreOS**: Has its own entirely separate install flow (`_coreos_install.pm`) that bypasses the normal Anaconda-based installation.
- **Multi-instance symlinks**: Files like `_console_wait_login_2.pm` are symlinks to `_console_wait_login.pm`, allowing `main.pm` to load the same test logic twice in one job (openQA limitation).
## Security Concerns
- **Security not usually an issue**: These tests run on ephemeral VMs that have no private information and limited internal network access. Most variables in test code are derived from test settings defined in `templates.fif.json` or `templates-updates.fif.json`. Things like unquoted variables in shell commands are not usually a concern and should not usually be flagged. The only source of untrusted input to the tests is things accessed from the public internet during test execution.