Repository navigation
[#3210] Fixed DCLint and Gitleaks scanning an empty directory in CI. - #3215
Merged
Merged
Conversation
…h migration enabled.
|
Warning Review limit reached
This review includes 6 billable files and costs up to $1.50.
Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing. Or wait 26 minutes for your next included review. View limit details
Comment |
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
|
Code coverage (threshold: 90%) Per-class coverage |
Member
Author
|
Code coverage (threshold: 90%) Per-class coverage |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #3215 +/- ##
==========================================
- Coverage 92.29% 92.09% -0.20%
==========================================
Files 113 105 -8
Lines 5099 4933 -166
Branches 49 3 -46
==========================================
- Hits 4706 4543 -163
+ Misses 393 390 -3 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
|
📖 Documentation preview for this pull request has been deployed to Netlify: https://6ad716656d56d62db3877cc1--vortex-docs.netlify.app This preview is rebuilt on every commit and is not the production documentation site. |
AlexSkrypnyk
added
the
Needs review
This was referenced Oct 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #3210
Summary
The DCLint step in the
lintjob of.circleci/config.ymland.github/workflows/build-test-deploy.yml, and the Gitleaks step in the CircleCIauditjob, now scan the checkout instead of an empty directory. On CircleCI, each step creates the scanner container withdocker create --rm, copies the checkout in withdocker cp ./.and runs it withdocker start --attach. On GitHub Actions, the DCLint step mounts the job container's volumes with--volumes-from "${HOSTNAME}" -w "${PWD}", the same way the Gitleaks step in.github/workflows/audit.ymlalready does.All 3 steps mounted the checkout with
docker run -v "${PWD}":..., and the Docker engine resolves that path on its own host, where it doesn't exist. The CircleCIlintandauditjobs talk to a remote engine throughsetup_remote_docker, and the GitHub Actionslintjob runs inside thedrevops/ci-runnercontainer, so${PWD}is a path inside the job container whiledocker rungoes to the runner host's daemon. In both cases the engine mounted an empty directory: Gitleaks loggedscanned ~0 bytes (0)andno leaks found, and DCLint printed nothing and passed.After merge, a committed secret or a DCLint error fails these steps on both providers, so a consumer project with existing findings will see them fail for the first time after updating.
VORTEX_CI_DCLINT_IGNORE_FAILUREandVORTEX_CI_GITLEAKS_IGNORE_FAILUREstill let findings through, but on CircleCI a scanner that can't start at all, such as a failed image pull, now fails the step even with the flag set. Hadolint is untouched, because it already reads each Dockerfile from stdin.Before / After
Changes
CI steps
.circleci/config.yml: the DCLint step inlintand the Gitleaks step inauditcreate the container, copy the checkout in and start it attached, so the container's exit code is the step's. A comment above each step records that the remote engine has no access to the checkout.--rmkeeps the old cleanup, and under CircleCI'sbash -eo pipefaila faileddocker createordocker cpfails the step; only the scan's own exit code reaches theVORTEX_CI_*_IGNORE_FAILUREcheck..github/workflows/build-test-deploy.yml: the DCLint step inlintuses--volumes-from "${HOSTNAME}" -w "${PWD}".drevops/ci-runnerthe way each provider runs it (the checkout only inside the job container for CircleCI, bind-mounted into the job container for GitHub Actions): the old steps pass with DCLint silent and Gitleaks atscanned ~0 bytes (0). The new steps report thedatabase2finding below when the exception is removed, and on CircleCI Gitleaks scans 2.35 MB, fails on a planted token, and passes withVORTEX_CI_GITLEAKS_IGNORE_FAILURE=1while still reportingleaks found: 1.The
database2exceptiondocker-compose.yml: once DCLint sees the file it fails withService "database2" is exporting port "3306" which is already used by service "database".(no-duplicate-exported-ports). DCLint 3.1.0, the latest release, reads the container-only port'3306'as a published host port, but Docker publishes each container-only port on its own random host port, so the 2 services don't clash.# dclint disable-line no-duplicate-exported-ports # container-only port, published on a random host port, on its own line directly above thedatabase2ports:key. DCLint reports this rule on theports:line, and an own-linedisable-lineapplies to the next line. A trailing comment onports:would not survive installation: when DCLint is deselected, the installer removes every line containingdclint(Tools.php) and would take theports:key with it. The trailing reason follows the# hadolint ignore=... # reasonconvention of.docker/*.dockerfile..dclintrcinstead would also hide real clashes, such as 2 services publishing the same fixed host port.docker-compose.ymlthat ships DCLint (28 of them, including all migration variants) passes DCLint after the CI processing step, and the installed baseline passes Gitleaks.Regression guard
.vortex/tests/lint.ci.sh, which runs invortex-test-common, fails when.circleci/config.yml,.github/workflows/build-test-deploy.ymlor.github/workflows/audit.ymlbind-mounts${PWD},$PWD,$(pwd)or${GITHUB_WORKSPACE}, and names each offending line. Every job in those files runs in a container or against a remote engine.vortex-test-common.ymlstays out because itsvortex-test-actionsjob runs on the host, where its-v "${GITHUB_WORKSPACE:-.}"mount is valid. A grep error, such as a renamed file, fails the check instead of passing it.main, the check names the 3 steps fixed here.Tests
ToolsHandlerProcessTest: the newtools_no_dclint_migrationscenario enables migration and deselects DCLint, then asserts that nodclintline survives and thatdatabase2keeps itsports:key. Moving the directive to a trailing comment onports:makes the scenario fail.Documentation
.vortex/docs/content/development/code-quality/dclint.mdx: thedatabase2exception, and that deselecting DCLint also removes thedclintdirectives indocker-compose.yml.