container scans by Ngwerume · Pull Request #51 · codacy-acme/engine-helper

Ngwerume · 2026-04-22T09:13:11Z

No description provided.

codacy-staging · 2026-04-22T09:15:23Z

Up to standards ✅

🟢 Issues 1 high

Results:
1 new issue

Category Results

Security 1 high

View in Codacy

🟢 Metrics 0 duplication

Metric Results

Duplication 0

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes. Give us feedback}

codacy-production

Pull Request Overview

This PR implements container security scanning but contains multiple high-severity issues that prevent a successful and secure deployment. The implementation is currently broken due to a variable interpolation bug in the shell script and a dependency conflict in the Dockerfile (Numpy 1.26.4 requires Python 3.9+).

Furthermore, the Docker image is insecure by default, running as root and failing to update a vulnerable lxml dependency. There is also a configuration mismatch between the provided documentation and the GitHub Actions workflow concerning the expected secret names, which will likely cause setup failures for users.

About this PR

Inconsistent secret naming: The implementation (workflow/scripts) uses 'CODACY_API_TOKEN', while the documentation refers to 'CODACY_CLI_TOKEN'. This should be standardized to 'CODACY_API_TOKEN' across all files.
The PR description is empty and no Jira ticket is linked. Providing context is essential for verifying requirements and ensuring the scanning setup aligns with project goals.

Test suggestions

Docker image builds successfully using the provided Dockerfile
.codacy-cli.sh correctly downloads and executes the Codacy CLI binary
test-container-scan-local.sh successfully triggers a local scan with and without an API token
GitHub Action workflow correctly initializes the CLI and uploads the SBOM
Verify Docker container runs as a non-root user
Verify that all dependencies in requirements.txt are installed during the build

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Docker image builds successfully using the provided Dockerfile
2. .codacy-cli.sh correctly downloads and executes the Codacy CLI binary
3. test-container-scan-local.sh successfully triggers a local scan with and without an API token
4. GitHub Action workflow correctly initializes the CLI and uploads the SBOM
5. Verify Docker container runs as a non-root user
6. Verify that all dependencies in requirements.txt are installed during the build

🗒️ Improve review quality by adding custom instructions

codacy-production · 2026-04-22T09:18:02Z

CVE-2026-41066

@@ -13,7 +13,7 @@ idna==3.2
 kiwisolver==1.3.2
 lxml==4.7.1


_{🔴 HIGH RISK}

Update lxml to version 6.1.0 to address CVE-2026-41066.

This might be a simple fix:

Suggested change

lxml==4.7.1

lxml==6.1.0

codacy-production · 2026-04-22T09:18:03Z

+
+COPY main.py .
+
+CMD ["python", "main.py"]


_{🔴 HIGH RISK}

Running as 'root' is a security hazard. Specify a non-root USER in the Dockerfile to limit privileges.

This might be a simple fix:

Suggested change

CMD ["python", "main.py"]

RUN useradd --create-home appuser

USER appuser

CMD ["python", "main.py"]

codacy-production · 2026-04-22T09:18:03Z

+
+WORKDIR /app
+
+COPY main.py .


_{🔴 HIGH RISK}

Dependencies from requirements.txt are not being installed. Add the necessary COPY and RUN pip install commands to build a functional image.

Suggested change

COPY main.py .

COPY requirements.txt .

RUN pip install --no-cache-dir -r requirements.txt

COPY main.py .

codacy-production · 2026-04-22T09:18:03Z

@@ -0,0 +1,7 @@
+FROM python:3.8


_{🔴 HIGH RISK}

Numpy 1.26.4 requires Python 3.9 or higher. Update the base image to python:3.9 to ensure compatibility with the specified dependencies.

Suggested change

FROM python:3.8

FROM python:3.9

codacy-production · 2026-04-22T09:18:03Z

+        remote_file="codacy-cli-v2_${version}_${suffix}_${arch}.tar.gz"
+        url="https://github.com/codacy/codacy-cli-v2/releases/download/${version}/${remote_file}"
+
+        download "$url" "$bin_folder"


_{🔴 HIGH RISK}

The variable version is missing the $ prefix for interpolation, which will cause the download to fail.

Suggested change

download "$url" "$bin_folder"

url="https:[REDACTED:HIGH_ENTROPY]${version}/${remote_file}"

codacy-production · 2026-04-22T09:18:03Z

+if [ "$#" -eq 1 ] && [ "$1" = "download" ]; then
+    echo "Codacy cli v2 download succeeded"
+else
+    eval "$run_command $*"


_{🔴 HIGH RISK}

Avoid using eval for command execution to prevent shell injection vulnerabilities. Execute the binary directly while passing all arguments safely using "$@".

Suggested change

eval "$run_command $*"

"$run_command" "$@"

codacy-production · 2026-04-22T09:18:03Z

+            -o codacy-acme \
+            -r engine-helper


_{⚪ LOW RISK}

Suggestion: Hardcoded organization ('codacy-acme') and repository ('engine-helper'). Consider using GitHub Actions context variables like '${{ github.repository_owner }}' and '${{ github.event.repository.name }}' for better portability.

codacy-production

Pull Request Overview

While the project is technically 'up to standards' according to automated checks, several high-risk issues must be addressed before merging.

The most critical findings are security-related: the use of a vulnerable lxml version (CVE-2026-41066), the lack of a non-root user in the Dockerfile, and the use of eval on user-supplied arguments in the CLI wrapper. Additionally, the .codacy-cli.sh script contains broken variable syntax and calls an undefined fatal function, which will cause runtime failures. Finally, there is a naming mismatch for the Codacy authentication token that will prevent the CI/CD pipeline and local testing from working if users follow the provided documentation.

About this PR

Systemic inconsistency in secret naming: The documentation refers to 'CODACY_CLI_TOKEN', while the workflow and local scripts look for 'CODACY_API_TOKEN'. This will lead to configuration errors.
The PR description is empty. Please provide a brief summary of the changes and why they are being made to aid future maintenance.

Test suggestions

Verify GitHub Actions workflow triggers correctly on specified branches and schedules
Verify Docker image builds successfully using the added Dockerfile
Verify Codacy CLI v2 downloads and initializes correctly via the helper script
Verify SBOM generation and upload logic in the CI pipeline
Verify local execution of 'test-container-scan-local.sh' script

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify local execution of 'test-container-scan-local.sh' script

_{TIP Improve review quality by adding custom instructions}
_{TIP How was this review? Give us feedback}

codacy-production · 2026-05-28T16:27:17Z

CVE-2026-41066

@@ -13,7 +13,7 @@ idna==3.2
 kiwisolver==1.3.2
 lxml==4.7.1


_{🔴 HIGH RISK}

The lxml library version 4.7.1 is vulnerable to CVE-2026-41066 (Information Disclosure). Upgrade to version 6.1.0 to resolve this security flaw.

See Issue in Codacy

codacy-production · 2026-05-28T16:27:18Z

+
+COPY main.py .
+
+CMD ["python", "main.py"]


_{🔴 HIGH RISK}

The Dockerfile lacks a USER instruction. Running as root is a security risk; please create a non-privileged user (e.g., 'appuser') and switch to it before the CMD instruction.

See Issue in Codacy

codacy-production · 2026-05-28T16:27:18Z

+
+        remote_file="codacy-cli-v2_${version}_${suffix}_${arch}.tar.gz"
+        url="https://github.com/codacy/codacy-cli-v2/releases/download/${version}/${remote_file}"
+


_{🔴 HIGH RISK}

Missing '$' for variable expansion. Change '{version}' to '${version}' so the download URL is constructed correctly.

codacy-production · 2026-05-28T16:27:18Z

+handle_rate_limit() {
+    local response="$1"
+    if echo "$response" | grep -q "API rate limit exceeded"; then
+          fatal "Error: GitHub API rate limit exceeded. Please try again later"


_{🔴 HIGH RISK}

The 'fatal' function is called (lines 65, 79, 143) but not defined. Add a definition at the top of the script to ensure errors are handled gracefully: fatal() { echo "$1" >&2; exit 1; }.

codacy-production · 2026-05-28T16:27:18Z

+
+      - name: Initialize Codacy CLI v2
+        env:
+          CODACY_API_TOKEN: ${{ secrets.CODACY_API_TOKEN }}


_{🟡 MEDIUM RISK}

The secret name 'CODACY_API_TOKEN' used here contradicts the 'CODACY_CLI_TOKEN' name specified in 'CODACY_CONTAINER_SCANNING.md'.

codacy-production · 2026-05-28T16:27:18Z

+### Step 1: Set Your Codacy Token
+
+```bash
+export CODACY_CLI_TOKEN=your_token_here


_{🟡 MEDIUM RISK}

Documentation mismatch: The guide suggests 'CODACY_CLI_TOKEN', but the code expects 'CODACY_API_TOKEN'. Please align the documentation with the implementation.

codacy-production · 2026-05-28T16:27:18Z

+if [ "$#" -eq 1 ] && [ "$1" = "download" ]; then
+    echo "Codacy cli v2 download succeeded"
+else
+    eval "$run_command $*"


_{🟡 MEDIUM RISK}

Using 'eval' with user-supplied arguments is a security risk. Execute the command directly using '"$run_command" "$@"' to safely preserve argument boundaries.

container scans

89f0a00

Ngwerume added 2 commits April 22, 2026 11:15

Add init

580a09b

resolved -a

3120e8d

codacy-production Bot reviewed Apr 22, 2026

View reviewed changes

codacy-production Bot reviewed May 28, 2026

View reviewed changes

	download "$url" "$bin_folder"
	url="https:[REDACTED:HIGH_ENTROPY]${version}/${remote_file}"


		remote_file="codacy-cli-v2_${version}_${suffix}_${arch}.tar.gz"
		url="https://github.com/codacy/codacy-cli-v2/releases/download/${version}/${remote_file}"

Uh oh!

Conversation

Ngwerume commented Apr 22, 2026

Uh oh!

codacy-staging Bot commented Apr 22, 2026 • edited by codacy-production Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Up to standards ✅

Uh oh!

codacy-production Bot left a comment

Choose a reason for hiding this comment

Pull Request Overview

About this PR

Test suggestions

Uh oh!

codacy-production Bot Apr 22, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production Bot Apr 22, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production Bot Apr 22, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production Bot Apr 22, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production Bot Apr 22, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production Bot Apr 22, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production Bot Apr 22, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production Bot left a comment

Choose a reason for hiding this comment

Pull Request Overview

About this PR

Test suggestions

Uh oh!

codacy-production Bot May 28, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production Bot May 28, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production Bot May 28, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production Bot May 28, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production Bot May 28, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production Bot May 28, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production Bot May 28, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

codacy-staging Bot commented Apr 22, 2026 •

edited by codacy-production Bot

Loading