From 6eb68c4ac99df57d4c1db0d280b5791decef08ee Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Fri, 13 Mar 2026 16:05:53 -0700 Subject: [PATCH] Add a section to AI context file to discourage 'security' issues ai-code-review likes to complain about 'security' issues in shell commands in the tests and stuff like that. It's almost always bogus because all the inputs are usually trusted, and the test execution environment is not really a target anyway. Add a paragraph explaining this to the project.md file. Signed-off-by: Adam Williamson --- .ai_review/project.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.ai_review/project.md b/.ai_review/project.md index e573628e..c0852ef2 100644 --- a/.ai_review/project.md +++ b/.ai_review/project.md @@ -142,3 +142,7 @@ schemas/ # JSON schemas for FIF and openQA template formats - **`CANNED` image type**: Refers to pre-built installer images (like Silverblue/Kinoite) that have a smaller Anaconda hub without repository spokes. Handled similarly to `LIVE` for hub needle selection. - **CoreOS**: Has its own entirely separate install flow (`_coreos_install.pm`) that bypasses the normal Anaconda-based installation. - **Multi-instance symlinks**: Files like `_console_wait_login_2.pm` are symlinks to `_console_wait_login.pm`, allowing `main.pm` to load the same test logic twice in one job (openQA limitation). + +## Security Concerns + +- **Security not usually an issue**: These tests run on ephemeral VMs that have no private information and limited internal network access. Most variables in test code are derived from test settings defined in `templates.fif.json` or `templates-updates.fif.json`. Things like unquoted variables in shell commands are not usually a concern and should not usually be flagged. The only source of untrusted input to the tests is things accessed from the public internet during test execution.