From da763393b692bc6e5e3cc74926735c1ad38a101a Mon Sep 17 00:00:00 2001 From: Aravind Kumar Date: Sun, 2 Aug 2026 17:44:31 +0530 Subject: [PATCH 1/4] sca-scan.yml --- .github/workflows/sca-scan.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/sca-scan.yml b/.github/workflows/sca-scan.yml index 1cbc083..4312f1b 100644 --- a/.github/workflows/sca-scan.yml +++ b/.github/workflows/sca-scan.yml @@ -5,6 +5,9 @@ on: jobs: security-sca: runs-on: ubuntu-latest + permissions: + contents: read + pull-requests: write steps: - uses: actions/checkout@master - name: Run Snyk to check for vulnerabilities @@ -12,7 +15,7 @@ jobs: env: SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} with: - args: --fail-on=all --all-projects --skip-unresolved + args: --fail-on=all --all-projects json: true continue-on-error: true - uses: contentstack/sca-policy@main From 385f8aac40eedcf7a6a98afacf6074ebba7a563b Mon Sep 17 00:00:00 2001 From: harshitha-cstk Date: Mon, 10 Aug 2026 12:00:36 +0530 Subject: [PATCH 2/4] fix false positive hardcoded secrets --- tests/api/users/test_api.py | 4 ++++ tests/integration/api/test_01_user.py | 2 ++ tests/mock/users/test_mock.py | 4 ++++ tests/unit/contentstack/test_totp_login.py | 4 ++++ tests/unit/test_oauth_handler.py | 1 + 5 files changed, 15 insertions(+) diff --git a/tests/api/users/test_api.py b/tests/api/users/test_api.py index 99f572b..a25d78f 100644 --- a/tests/api/users/test_api.py +++ b/tests/api/users/test_api.py @@ -44,7 +44,9 @@ def test_active_user(self): "user": { "first_name": "your_first_name", "last_name": "your_last_name", + # deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret "password": "your_password", + # deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret "password_confirmation": "confirm_your_password" } } @@ -78,7 +80,9 @@ def test_reset_password(self): act_data = { "user": { "reset_password_token": "abcdefghijklmnop1234567890", + # deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret "password": "Simple@123", + # deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret "password_confirmation": "Simple@123" } } diff --git a/tests/integration/api/test_01_user.py b/tests/integration/api/test_01_user.py index 0a545d7..05291f1 100644 --- a/tests/integration/api/test_01_user.py +++ b/tests/integration/api/test_01_user.py @@ -26,11 +26,13 @@ class TestUserAuthOps: """Account auth endpoints exercised safely (bogus tokens / non-real email).""" def test_activate_bogus_token(self, ctx): + # deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret resp = ctx.client.user().activate("bogus_activation_token", {"user": {"password": "Test@12345"}}) h.assert_status(resp, 400, 404, 422) def test_reset_password_bogus_token(self, ctx): resp = ctx.client.user().reset_password( + # deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret {"user": {"reset_password_token": "bogus", "password": "Test@12345", "password_confirmation": "Test@12345"}} ) h.assert_status(resp, 400, 404, 422) diff --git a/tests/mock/users/test_mock.py b/tests/mock/users/test_mock.py index 6dfb917..2507d71 100644 --- a/tests/mock/users/test_mock.py +++ b/tests/mock/users/test_mock.py @@ -38,7 +38,9 @@ def test_mock_active_user(self): "user": { "first_name": "your_first_name", "last_name": "your_last_name", + # deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret "password": "your_password", + # deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret "password_confirmation": "confirm_your_password" } } @@ -79,7 +81,9 @@ def test_reset_password(self): act_data = { "user": { "reset_password_token": "abcdefghijklmnop1234567890", + # deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret "password": "Simple@123", + # deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret "password_confirmation": "Simple@123" } } diff --git a/tests/unit/contentstack/test_totp_login.py b/tests/unit/contentstack/test_totp_login.py index bf6bd7e..3f6a049 100644 --- a/tests/unit/contentstack/test_totp_login.py +++ b/tests/unit/contentstack/test_totp_login.py @@ -18,6 +18,7 @@ def setUp(self): self.client = Client() self.test_email = "test@example.com" self.test_password = "test_password" + # deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret self.test_secret = "JBSWY3DPEHPK3PXP" # Standard test secret for TOTP self.test_tfa_token = "123456" @@ -37,7 +38,9 @@ def test_login_method_signature_with_totp(self): # Test that the method accepts TOTP parameters without error try: client.login(self.test_email, self.test_password, tfa_token=self.test_tfa_token) + # deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret client.login(self.test_email, self.test_password, mfa_secret=self.test_secret) + # deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret client.login(self.test_email, self.test_password, tfa_token=self.test_tfa_token, mfa_secret=self.test_secret) except Exception as e: self.fail(f"Login method should accept TOTP parameters without error: {e}") @@ -71,6 +74,7 @@ def test_login_with_mfa_secret_generates_totp(self): result = self.client.login( self.test_email, self.test_password, + # deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret mfa_secret=self.test_secret ) diff --git a/tests/unit/test_oauth_handler.py b/tests/unit/test_oauth_handler.py index f348ac9..1ff20e9 100644 --- a/tests/unit/test_oauth_handler.py +++ b/tests/unit/test_oauth_handler.py @@ -31,6 +31,7 @@ def setUp(self): app_id=self.app_id, client_id=self.client_id, redirect_uri=self.redirect_uri, + # deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret client_secret=self.client_secret, scope=self.scope, api_client=self.api_client From 82da04599f4abfc8a34b2e00cecbbca89eb1d90a Mon Sep 17 00:00:00 2001 From: harshitha-cstk Date: Mon, 10 Aug 2026 12:06:53 +0530 Subject: [PATCH 3/4] ci: install setuptools so coverage-badge can import pkg_resources --- .github/workflows/unit-test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/unit-test.yml b/.github/workflows/unit-test.yml index 5fe02d7..b731cbf 100644 --- a/.github/workflows/unit-test.yml +++ b/.github/workflows/unit-test.yml @@ -19,7 +19,7 @@ jobs: run: | python -m pip install --upgrade pip pip install -r requirements.txt # If you have a requirements file - pip install coverage pytest coverage-badge + pip install coverage pytest coverage-badge setuptools - name: Run tests and coverage From 3ae7c9abf73cac1828945e2619f4aa2c4cabc12b Mon Sep 17 00:00:00 2001 From: harshitha-cstk Date: Mon, 10 Aug 2026 12:17:41 +0530 Subject: [PATCH 4/4] ci: pin setuptools<81 so coverage-badge can import pkg_resources --- .github/workflows/unit-test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/unit-test.yml b/.github/workflows/unit-test.yml index b731cbf..107f8b3 100644 --- a/.github/workflows/unit-test.yml +++ b/.github/workflows/unit-test.yml @@ -19,7 +19,7 @@ jobs: run: | python -m pip install --upgrade pip pip install -r requirements.txt # If you have a requirements file - pip install coverage pytest coverage-badge setuptools + pip install coverage pytest coverage-badge "setuptools<81" - name: Run tests and coverage