[SEC] OCV-249 contain prototype Qodana source credential #5

Open

moeardent wants to merge 1 commit from moeardent/OCV-249-qodana-secret-containment into dev AGit

moeardent commented

2026-10-14 08:58:46 +00:00

Owner

Security source fix for OCV-249, targeting dev for review only. Replaces the active literal with an owner-provisioned protected TeamCity password reference; records unavailable bindings and keeps Qodana failures advisory. Five local containment and mocked-scanner tests, bash syntax and whitespace checks passed; details in specs/ocv-249-qodana-secret-containment. Owner revoke/rotate is urgent: historical source and one accidental tool-output exposure remain. Protected binding, trusted-branch secret delivery, native CI and incident/document disposition remain owner follow-ups. No merge, deployment, rotation or history rewrite. Reviewer focus: secure parameter resolution and withholding secrets from untrusted branch scripts. Human sponsor Cristian Cotosman (cristianlorand); executor Moe Ardent. Recovery must preserve credential removal; do not restore the literal.

Security source fix for [OCV-249](https://moebiusol.youtrack.cloud/issue/OCV-249), targeting dev for review only. Replaces the active literal with an owner-provisioned protected TeamCity password reference; records unavailable bindings and keeps Qodana failures advisory. Five local containment and mocked-scanner tests, bash syntax and whitespace checks passed; details in specs/ocv-249-qodana-secret-containment. Owner revoke/rotate is urgent: historical source and one accidental tool-output exposure remain. Protected binding, trusted-branch secret delivery, native CI and incident/document disposition remain owner follow-ups. No merge, deployment, rotation or history rewrite. Reviewer focus: secure parameter resolution and withholding secrets from untrusted branch scripts. Human sponsor Cristian Cotosman (cristianlorand); executor Moe Ardent. Recovery must preserve credential removal; do not restore the literal.

moeardent added 1 commit

2026-10-14 08:58:46 +00:00

[SEC] OCV-249 contain prototype Qodana source credential 238ed24775

- Replace source credential with owner-provisioned protected CI reference.
- Preserve advisory scan failures and verify unavailable-binding skips.

Human-Sponsor-Display-Name: Cristian Cotosman
Human-Sponsor-Login: cristianlorand
Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>
Agent-Role: worker
Trace-Ref: OCV-249 [https://moebiusol.youtrack.cloud/issue/OCV-249]

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin +refs/pull/5/head:moeardent/OCV-249-qodana-secret-containment

git switch moeardent/OCV-249-qodana-secret-containment

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch dev

git merge --no-ff moeardent/OCV-249-qodana-secret-containment

git switch moeardent/OCV-249-qodana-secret-containment

git rebase dev

git switch dev

git merge --ff-only moeardent/OCV-249-qodana-secret-containment

git switch moeardent/OCV-249-qodana-secret-containment

git rebase dev

git switch dev

git merge --no-ff moeardent/OCV-249-qodana-secret-containment

git switch dev

git merge --squash moeardent/OCV-249-qodana-secret-containment