-
Notifications
You must be signed in to change notification settings - Fork 274
DOC-5804 experimental TCE binderhub links #2228
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
❌ Jit has detected 2 important findings in this PR that you should review.
The findings are detailed below as separate comments.
It’s highly recommended that you fix these security issues before merge.
Repository Risks:
- Database Integration: Connects to a database, often involving sensitive data that must be securely managed.
- High Severity Findings: Indicates that the resource has high severity security findings that need attention.
- Production: Critical as it operates in a live production environment, directly impacting users and business operations.
Repository Context:
graph LR
GitHub$Repository_U23_redis/docs["GitHub Repository<br/>redis/docs"]:::GitHub$Repository
Team_U23_docs_U2D_reviewers["Team<br/>docs-reviewers"]:::Team
Team_U23_client_U2D_docs["Team<br/>client-docs"]:::Team
Team_U23_core_U2D_team["Team<br/>core-team"]:::Team
Team_U23_docs["Team<br/>docs"]:::Team
DBIntegration_U23_redis["DBIntegration<br/>redis"]:::DBIntegration
GitHub$Actions_U23_test_gcs_access_U2E_yml["GitHub Actions<br/>test_gcs_access.yml"]:::GitHub$Actions
Team_U23_docs_U2D_reviewers -- "Owns" --> GitHub$Repository_U23_redis/docs
Team_U23_client_U2D_docs -- "Owns" --> GitHub$Repository_U23_redis/docs
Team_U23_core_U2D_team -- "Owns" --> GitHub$Repository_U23_redis/docs
Team_U23_docs -- "Owns" --> GitHub$Repository_U23_redis/docs
GitHub$Repository_U23_redis/docs -- "Is accessible to" --> DBIntegration_U23_redis
GitHub$Repository_U23_redis/docs -- "Has" --> GitHub$Actions_U23_test_gcs_access_U2E_yml
| │ │ Remote Examples │ │ Local Examples │ │ | ||
| │ │ (GitHub Repos) │ │ (local_examples/)│ │ | ||
| │ └────────┬─────────┘ └────────┬─────────┘ │ | ||
| │ │ │ │ |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Security control: Secret Detection Trufflehog
Github
Github (Unverified)
Severity: HIGH
Why should you fix this issue?
This code introduces a hard-coded secrets issue. In a production environment, storing secrets like passwords or API keys directly in the code can lead to serious security risks. If these secrets are compromised, it could result in unauthorized access or manipulation of critical systems.
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_ignore_type_in_fileIgnore any finding of type "Github" in build/tcedocs/SPECIFICATION.md; future occurrences will also be ignored.#jit_undo_ignoreUndo ignore command
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
#jit_ignore_accept
| - **Code hiding/highlighting**: Support for hiding boilerplate code and highlighting relevant sections | ||
| - **Named steps**: Break examples into logical steps that can be referenced individually | ||
| - **Remote and local examples**: Pull examples from client library repositories or use local examples | ||
| - **Syntax highlighting**: Automatic syntax highlighting based on language |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Security control: Secret Detection Trufflehog
Github
Github (Unverified)
Severity: HIGH
Why should you fix this issue?
This code introduces a hard-coded secrets issue. In a production environment, storing secrets like passwords or API keys directly in the code can lead to serious security risks. If these secrets are compromised, it could result in unauthorized access or manipulation of critical systems.
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_ignore_type_in_fileIgnore any finding of type "Github" in build/tcedocs/SPECIFICATION.md; future occurrences will also be ignored.#jit_undo_ignoreUndo ignore command
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The "hard-coded secret" in question just seems to be the Github commit ID used by the BinderHub examples (we would have this in the doc files or source files anyway, so it's not really "secret"). Is everyone OK if I mark this as ignored for this particular file?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Definitely
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This is great.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
❌ Jit has detected 1 important finding in this PR that you should review.
The finding is detailed as a comment.
It’s highly recommended that you fix this security issue before merge.
Until now, you ignored/fixed 1 finding.
|
Thanks @paoloredis ! |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
❌ Jit has detected 2 important findings in this PR that you should review.
The findings are detailed as separate comments.
It’s highly recommended that you fix these security issues before merge.
Until now, you ignored/fixed 2 findings.
| - Handle language-specific client name mapping (e.g., Java-Sync vs Java-Async) | ||
|
|
||
| **Key Functions**: | ||
| - `process_local_examples()`: Main processing function |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Security control: Secret Detection Trufflehog
Github
Github (Unverified)
Severity: HIGH
Why should you fix this issue?
This code introduces a hard-coded secrets issue. In a production environment, storing secrets like passwords or API keys directly in the code can lead to serious security risks. If these secrets are compromised, it could result in unauthorized access or manipulation of critical systems.
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_ignore_type_in_fileIgnore any finding of type "Github" in build/tcedocs/SPECIFICATION.md; future occurrences will also be ignored.#jit_undo_ignoreUndo ignore command
| - Understand the system → [System Overview](#system-overview), [Architecture](#architecture) | ||
| - Add a new example → [Working with Examples](#working-with-examples) | ||
| - Add a new language → [Extension Points](#extension-points), [Appendix: Adding a Language](#adding-a-language) | ||
| - Fix a build issue → [Troubleshooting](#troubleshooting) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Security control: Secret Detection Trufflehog
Github
Github (Unverified)
Severity: HIGH
Why should you fix this issue?
This code introduces a hard-coded secrets issue. In a production environment, storing secrets like passwords or API keys directly in the code can lead to serious security risks. If these secrets are compromised, it could result in unauthorized access or manipulation of critical systems.
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_ignore_type_in_fileIgnore any finding of type "Github" in build/tcedocs/SPECIFICATION.md; future occurrences will also be ignored.#jit_undo_ignoreUndo ignore command
|
#jit_ignore_type_in_file |
This PR is about two things:
BINDER_IDspecial comment in the source file. The layout code picks this up and adds the appropriate link to BinderHub for the example.SPECIFICATION.mdfile with implementation/maintenance details. I then used that in steps to add the new code, prompting Augment to update the spec based on its "experience" with the implementation.The Markdown programming experiment seems to have worked quite well (results-wise, at least). However, I realise we might not be ready to just go ahead and adopt this technique for the build scripts (we can easily remove the spec and new README file if we don't want to continue using them). Anyway, all feedback about this would be welcome :-)
As regards the BinderHub link, I think the "Run in browser" link might look better positioned next to the menu. Or, maybe we want a new icon on the right (just a Play button, say) that is similar to the existing icons? You get a tooltip when you hover on the link, but maybe it's best if we make it as conspicuous as possible since it's such a cool new feature. Again, all feedback welcome :-)