fix(ci): clear the CodeQL highs (test and benchmark code only) - #5802
Conversation
…e benchmark's run identity is now derived from non-secret values only (base+project context hash replaces the API-key fingerprint; the record only needs to say which deployment context produced a run); the runner test asserts the fence shape with startsWith/endsWith instead of a regex CodeQL reads as HTML filtering; the web test parses rendered HTML with the test environment's DOM instead of regex tag-stripping, which is also more correct. No product code changes.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
dosubot
Bot
added
size:S
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Railway Preview Environment
|
fix(ci): clear the CodeQL highs (test and benchmark code only)
1 participant
All 7 new CodeQL high alerts on the release branch sit in test or benchmark code; none touch product code. This PR fixes each at the source instead of dismissing: the benchmark stores a context hash of non-secret values instead of an API-key fingerprint, the runner test drops the regex CodeQL reads as HTML filtering, and the web test parses rendered HTML with jsdom instead of regex tag-stripping. Part of the release CI cleanup Mahmoud requested.