Fix Aquasec uses issues by miroslavpojer · Pull Request #137 · AbsaOSS/living-doc-generator-mdoc

miroslavpojer · 2026-01-19T13:17:28Z

Overview

Aquasec reports 3 issue related to integration tests. AVD-PIPELINE-0008

Release Notes

Fixes 3 AVD-PIPELINE-0008 "uses" issues reported by Aquasec.

Summary by CodeRabbit

Chores
- Pinned CI tooling to a specific, stable reference and removed reliance on older generic versions for more predictable runs.
Tests
- Standardized integration test execution to use environment-driven inputs, unified token handling, and consistent output reporting and verification.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

…t variables

coderabbitai · 2026-01-19T13:17:47Z

Warning

Rate limit exceeded

@miroslavpojer has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 2 minutes and 48 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

📥 Commits

Reviewing files that changed from the base of the PR and between 27dc9ac and 6c7796c.

📒 Files selected for processing (1)

.github/workflows/integration_tests.yml

Note

Other AI code review bot(s) detected

CodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review.

Walkthrough

Removed a duplicate setup-python step in check_pr_release_notes.yml and refactored integration_tests.yml to replace uses: ./ invocations with inline run blocks driven by INPUT_* environment variables, while consolidating GITHUB token handling and preserving output/listing and pytest verification steps.

Changes

Cohort / File(s)	Summary
Python setup pinning `.github/workflows/check_pr_release_notes.yml`	Removed an `actions/setup-python@v6` step and retained the pinned commit `actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548` with `python-version: '3.13'`.
Integration tests — inline execution `.github/workflows/integration_tests.yml`	Replaced `uses: ./` action invocations with inline `run` blocks that set `INPUT_SOURCE`, `INPUT_RELEASE`, `INPUT_STRUCTURED_OUTPUT`, `INPUT_REPORT_PAGE`, `INPUT_VERBOSE_LOGGING` via env and run `python main.py`; export `output-path` to `GITHUB_OUTPUT` and list outputs.
Integration tests — token handling `.github/workflows/integration_tests.yml`	Moved token handling into `with: GITHUB-TOKEN` for collector steps and added `GITHUB-TOKEN` under `with` for all collector steps; note one env instance uses `GITHUB_TOKEN` (underscore) while others use `GITHUB-TOKEN` (dash).

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

#121 - Fix Aquasec Issues - commit sha vs tags #122: Pins actions/setup-python to a commit SHA in workflow file — strongly related change.
Update release-notes-presence-check action to specific commit SHA #129: Replaces tagged setup-python reference with a commit SHA in check_pr_release_notes.yml.

Suggested labels

infrastructure

Suggested reviewers

tmikula-dev
Zejnilovic

Poem

🐇 I nibbled on YAML by lantern light,
Pinned a step, made runners run just right.
Env-vars whisper, outputs come to play,
CI carrots gleam at the break of day. 🥕

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'Fix Aquasec uses issues' is specific and relates to the main change in the changeset, which involves fixing issues reported by Aquasec security scanning.
Description check	✅ Passed	The description includes Overview and Release Notes sections matching the template, though the Related section with issue number is missing.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Copilot

Pull request overview

This PR addresses security issues flagged by Aquasec scanner (AVD-PIPELINE-0008) related to unpinned action versions and improves the stability of integration tests.

Changes:

Pins the actions/setup-python action to a specific commit SHA for security
Converts integration test steps from using composite actions (uses: ./) to direct Python script execution via run: commands
Standardizes environment variable naming convention (INPUT_* prefix) for test configuration

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 5 comments.

File	Description
`.github/workflows/check_pr_release_notes.yml`	Removes duplicate unpinned action reference, keeping only the pinned version
`.github/workflows/integration_tests.yml`	Converts three integration test steps to use direct script execution instead of composite actions, and adds GITHUB-TOKEN to env/with blocks

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-01-19T13:32:25Z

      env:
        GITHUB-TOKEN: ${{ secrets.REPOSITORIES_TOKEN }}
      with:
+        GITHUB-TOKEN: ${{ secrets.REPOSITORIES_TOKEN }}


The GITHUB-TOKEN is now duplicated in both the env block (line 33) and the with block (line 35). This duplication is unnecessary and could cause confusion. Remove the duplicate entry from the with block.

Suggested change

GITHUB-TOKEN: ${{ secrets.REPOSITORIES_TOKEN }}

Fixed in 27dc9ac.

Copilot · 2026-01-19T13:32:25Z

        env:
          GITHUB-TOKEN: ${{ secrets.REPOSITORIES_TOKEN }}
        with:
+          GITHUB-TOKEN: ${{ secrets.REPOSITORIES_TOKEN }}


The GITHUB-TOKEN is now duplicated in both the env block (line 90) and the with block (line 92). This duplication is unnecessary and could cause confusion. Remove the duplicate entry from the with block.

Suggested change

GITHUB-TOKEN: ${{ secrets.REPOSITORIES_TOKEN }}

Fixed in 27dc9ac.

Copilot · 2026-01-19T13:32:26Z

        env:
          GITHUB-TOKEN: ${{ secrets.REPOSITORIES_TOKEN }}
        with:
+          GITHUB-TOKEN: ${{ secrets.REPOSITORIES_TOKEN }}


The GITHUB-TOKEN is now duplicated in both the env block (line 148) and the with block (line 150). This duplication is unnecessary and could cause confusion. Remove the duplicate entry from the with block.

Suggested change

GITHUB-TOKEN: ${{ secrets.REPOSITORIES_TOKEN }}

Fixed in 27dc9ac.

Copilot · 2026-01-19T13:32:26Z

-          source: "${{ steps.collect_data_with_project_1.outputs.output-path }}/doc-issues/doc-issues.json"
-          report-page: true
-          verbose-logging: true
+          GITHUB_TOKEN: ${{ secrets.REPOSITORIES_TOKEN }}


Inconsistent environment variable naming: this uses GITHUB_TOKEN while the previous test step uses GITHUB-TOKEN (with hyphen). Standardize to use the same naming convention across all integration test steps.

Suggested change

GITHUB_TOKEN: ${{ secrets.REPOSITORIES_TOKEN }}

GITHUB-TOKEN: ${{ secrets.REPOSITORIES_TOKEN }}

This is valid for this usage.

Copilot · 2026-01-19T13:32:26Z

-          source: "${{ steps.collect_data_with_project_2.outputs.output-path }}/doc-issues/doc-issues.json"
-          report-page: true
-          verbose-logging: true
+          GITHUB_TOKEN: ${{ secrets.REPOSITORIES_TOKEN }}


Inconsistent environment variable naming: this uses GITHUB_TOKEN while the first test step uses GITHUB-TOKEN (with hyphen). Standardize to use the same naming convention across all integration test steps.

Suggested change

GITHUB_TOKEN: ${{ secrets.REPOSITORIES_TOKEN }}

GITHUB-TOKEN: ${{ secrets.REPOSITORIES_TOKEN }}

This is valid for this usage.

…n integration tests

…OKEN and simplify input parameters

…variables for inputs and streamline execution

…ata collection steps

…g in integration tests

chore(workflows): update Python setup and integration test environmen…

56aba5a

…t variables

miroslavpojer requested a review from tmikula-dev as a code owner January 19, 2026 13:17

Debug of int test.

64458a1

miroslavpojer self-assigned this Jan 19, 2026

miroslavpojer requested a review from Copilot January 19, 2026 13:31

Copilot AI reviewed Jan 19, 2026

View reviewed changes

miroslavpojer added 5 commits January 19, 2026 14:36

chore(workflows): remove redundant env declaration for GITHUB-TOKEN i…

27dc9ac

…n integration tests

chore(workflows): update integration tests to use consistent GITHUB_T…

297d1ee

…OKEN and simplify input parameters

chore(workflows): refactor integration test steps to use environment …

d1a0790

…variables for inputs and streamline execution

chore(workflows): update living-doc-collector-gh action version for d…

55b0ced

…ata collection steps

chore(workflows): standardize GITHUB_TOKEN environment variable namin…

6c7796c

…g in integration tests

miroslavpojer merged commit d2b86fb into master Jan 19, 2026
10 checks passed

miroslavpojer deleted the infra/-fix-aquasec-uses-isses branch January 19, 2026 13:54

	GITHUB_TOKEN: ${{ secrets.REPOSITORIES_TOKEN }}
	GITHUB-TOKEN: ${{ secrets.REPOSITORIES_TOKEN }}

Conversation

miroslavpojer commented Jan 19, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Overview

Release Notes

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jan 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Rate limit exceeded

Other AI code review bot(s) detected

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested labels

Suggested reviewers

Poem

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Jan 19, 2026

Choose a reason for hiding this comment

Uh oh!

miroslavpojer Jan 19, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 19, 2026

Choose a reason for hiding this comment

Uh oh!

miroslavpojer Jan 19, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 19, 2026

Choose a reason for hiding this comment

Uh oh!

miroslavpojer Jan 19, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 19, 2026

Choose a reason for hiding this comment

Uh oh!

miroslavpojer Jan 19, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 19, 2026

Choose a reason for hiding this comment

Uh oh!

miroslavpojer Jan 19, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

miroslavpojer commented Jan 19, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jan 19, 2026 •

edited

Loading