Development: Scope Codacy security scanners to production code#13202
Open
krusche wants to merge 2 commits into
Open
Development: Scope Codacy security scanners to production code#13202krusche wants to merge 2 commits into
Development: Scope Codacy security scanners to production code#13202krusche wants to merge 2 commits into
Conversation
Add .codacy.yaml excluding test code from the Semgrep (opengrep) and Bandit security engines. Hardcoded test credentials, non-literal fs/regexp usage in test helpers, and similar findings in test code are intentional fixtures, not vulnerabilities — 121 of 310 Codacy Cloud security findings were in test paths. Other tools (ESLint, Stylelint, PMD) continue to analyze test code via their own configuration files. Codacy Cloud reads .codacy.yaml from the default branch, so this must land on develop to take effect. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
krusche
temporarily deployed
to
playwright-e2e-tests
GitHub Actions
Inactive
End-to-End Test Results
Test Strategy: Two-phase execution
Overall: ✅ E2E tests passed 🔗 Workflow Run · 📊 Test Report Phase 1 · 📊 Test Report Phase 2 |
krusche
temporarily deployed
to
playwright-e2e-tests
GitHub Actions
Inactive
…-security-to-prod
krusche
temporarily deployed
to
playwright-e2e-tests
GitHub Actions
Inactive
krusche
temporarily deployed
to
playwright-e2e-tests
GitHub Actions
Inactive
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a
.codacy.yamlthat scopes the Codacy security scanners (Semgrep/opengrep and Bandit) to production code, excluding test code. Configuration-only change; no application code is modified.Checklist
General
Motivation and Context
Codacy previously had Semgrep security scanning disabled entirely. After enabling it, 121 of 310 Codacy Cloud security findings landed in test code (
src/test/**,**/*.spec.ts) — intentional fixtures such as hardcoded test credentials,new RegExp(dynamic)andfscalls in test helpers, and test HTTP/socket setup. These are not vulnerabilities and drowned out the 189 production findings.Description
Adds
.codacy.yamlat the repository root with per-engineexclude_pathsforopengrep(Semgrep) andbandit, excludingsrc/test/**and**/*.spec.ts. Codacy Cloud reads.codacy.yamlfrom the default branch, so this must be on develop to take effect. Other tools (ESLint, Stylelint, PMD) continue to analyze test code via their own configuration files.Steps for Testing
src/test/**and**/*.spec.tsno longer appear.src/main,docker,.github) are unaffected.Testserver States
Not applicable — configuration-only change, no deployment needed.
Review Progress
Code Review
Test Coverage
No code changes detected - test coverage not required for this PR.
Last updated: 2026-07-12 14:43:21 UTC
Screenshots
Not applicable — no UI changes.