cleveragents/cleveragents-core

Fork 3

[AUTO-INF-8] Bandit severity gate inconsistency: pre-commit blocks on MEDIUM but CI security job only blocks on HIGH #9945

New issue

Open

opened 2026-04-16 06:31:07 +00:00 by HAL9000 · 1 comment

HAL9000 commented

2026-04-16 06:31:07 +00:00

Owner

Metadata

Commit message: fix(ci): align bandit severity gate in nox security_scan session with pre-commit threshold
Branch name: fix/bandit-severity-gate-inconsistency

Background and Context

The bandit security scanner is configured with different severity thresholds in pre-commit hooks versus the CI security job: pre-commit blocks commits on MEDIUM-severity findings, but the CI security_scan nox session only hard-fails on HIGH-severity findings. This inconsistency means MEDIUM-severity security issues can pass CI and be merged to master, even though they would be caught locally by pre-commit.

.pre-commit-config.yaml (pre-commit hook — runs locally before each commit):

- repo: https://github.com/PyCQA/bandit
  rev: 1.8.3
  hooks:
    - id: bandit
      name: Bandit security scan
      args: ["-c", "pyproject.toml", "-r", "--severity-level", "medium"]
      additional_dependencies: ["bandit[toml]"]
      files: "^src/"

→ Blocks on MEDIUM severity findings.

noxfile.py security_scan session (runs in CI via .forgejo/workflows/ci.yml):

# Step 1: Bandit - medium-severity report (non-blocking, mirrors CI JSON export)
session.run("bandit", ..., "--severity-level", "medium", "--format", "json", "--output", "build/bandit-report.json", success_codes=[0, 1])

# Step 2: Bandit - high-severity gate (blocks on findings)
session.run("bandit", ..., "--severity-level", "high")

→ MEDIUM findings are report-only (non-blocking); only HIGH findings block CI.

pyproject.toml [tool.bandit] section:

[tool.bandit]
severity = "MEDIUM"
confidence = "MEDIUM"

→ The bandit config specifies MEDIUM as the threshold, but the nox session overrides this with --severity-level high for the blocking gate.

Expected Behavior

CI and pre-commit enforce the same bandit severity threshold. MEDIUM-severity security findings are blocked in CI before they can be merged to master, consistent with the pyproject.toml bandit configuration (severity = "MEDIUM").

Acceptance Criteria

The security_scan nox session blocks on MEDIUM-severity bandit findings (not just HIGH)
The blocking gate in noxfile.py uses --severity-level medium (matching pre-commit)
The pyproject.toml bandit config (severity = "MEDIUM") is consistent with actual CI enforcement
No existing MEDIUM-severity bandit findings are present in the codebase (nox -s security_scan passes locally)
CI pipeline (security_scan job) passes with the updated severity gate
The security_scan session docstring accurately reflects the corrected severity gates

Subtasks

Update noxfile.py security_scan session: change the blocking gate from --severity-level high to --severity-level medium
Remove the separate Step 1 medium-severity report-only run (Step 2 will now cover both reporting and blocking at MEDIUM severity), or consolidate into a single blocking run
Update the security_scan session docstring to reflect the corrected severity gates
Run nox -s security_scan locally to verify no existing MEDIUM-severity findings are present
Verify CI pipeline passes with the updated configuration

Definition of Done

This issue should be closed when:

The security_scan nox session blocks on MEDIUM-severity bandit findings, matching the pre-commit hook threshold
The pyproject.toml bandit configuration is consistent with the actual CI enforcement behavior
CI passes with the updated severity gate
No regression is introduced (no new MEDIUM-severity findings exist in the codebase)

Summary

Risk Assessment

Severity: Medium

This inconsistency creates a security gap in the CI pipeline:

A developer who runs pre-commit locally will have MEDIUM-severity findings blocked before commit.
However, if pre-commit is bypassed (e.g., git commit --no-verify, or a CI-only change), MEDIUM-severity findings will pass the CI security gate and can be merged to master.
MEDIUM-severity bandit findings include issues such as: use of subprocess with shell=True, use of assert in non-test code, use of pickle, use of yaml.load without SafeLoader, use of hashlib.md5 for security purposes, and other meaningful security concerns.
The pyproject.toml bandit config explicitly sets severity = "MEDIUM", indicating the project's intent is to block on MEDIUM findings — but the nox session contradicts this intent.

Proposed Improvement

Align the CI security_scan nox session with the pre-commit hook severity threshold:

Change the blocking gate in noxfile.py from --severity-level high to --severity-level medium in Step 2 of the security_scan session:

# Step 2: Bandit - medium-severity gate (blocks on findings, matches pre-commit)
session.run("bandit", "-c", "pyproject.toml", "-r", "src/cleveragents", "--severity-level", "medium")

Remove the separate Step 1 (medium-severity report-only run) since Step 2 will now cover both reporting and blocking at MEDIUM severity.
Update the docstring in security_scan to reflect the corrected severity gates.
Verify that no existing MEDIUM-severity findings are present in the codebase (run nox -s security_scan locally to confirm).

Expected Impact

CI and pre-commit will enforce the same bandit severity threshold, eliminating the security gap.
MEDIUM-severity security findings will be caught and blocked in CI before they can be merged to master.
The pyproject.toml bandit configuration (severity = "MEDIUM") will be consistent with the actual enforcement behavior.
Aligns with the project's stated intent in pyproject.toml where severity = "MEDIUM" is configured.

Duplicate Check

Searched open issues for keywords: bandit severity, bandit inconsistency, pre-commit CI bandit, severity gate
Searched closed issues for keywords: bandit severity inconsistency, severity gate
Searched for AUTO-INF worker issues: Found #9889 (broad dependency security hardening — covers pip-audit/osv-scanner/Docker pinning, not bandit severity), #9772 (pip-audit CI addition), #9688 (cryptography CVE) — none cover the bandit severity gate inconsistency
Searched issue titles for bandit + severity: no matches found
Result: No duplicates found — no existing issue addresses the bandit severity gate inconsistency between pre-commit and CI

Automated by CleverAgents Bot
Agent: new-issue-creator

## Metadata - **Commit message:** `fix(ci): align bandit severity gate in nox security_scan session with pre-commit threshold` - **Branch name:** `fix/bandit-severity-gate-inconsistency` ## Background and Context The `bandit` security scanner is configured with different severity thresholds in pre-commit hooks versus the CI security job: pre-commit blocks commits on MEDIUM-severity findings, but the CI `security_scan` nox session only hard-fails on HIGH-severity findings. This inconsistency means MEDIUM-severity security issues can pass CI and be merged to master, even though they would be caught locally by pre-commit. **`.pre-commit-config.yaml`** (pre-commit hook — runs locally before each commit): ```yaml - repo: https://github.com/PyCQA/bandit rev: 1.8.3 hooks: - id: bandit name: Bandit security scan args: ["-c", "pyproject.toml", "-r", "--severity-level", "medium"] additional_dependencies: ["bandit[toml]"] files: "^src/" ``` → Blocks on **MEDIUM** severity findings. **`noxfile.py`** `security_scan` session (runs in CI via `.forgejo/workflows/ci.yml`): ```python # Step 1: Bandit - medium-severity report (non-blocking, mirrors CI JSON export) session.run("bandit", ..., "--severity-level", "medium", "--format", "json", "--output", "build/bandit-report.json", success_codes=[0, 1]) # Step 2: Bandit - high-severity gate (blocks on findings) session.run("bandit", ..., "--severity-level", "high") ``` → MEDIUM findings are **report-only** (non-blocking); only **HIGH** findings block CI. **`pyproject.toml`** `[tool.bandit]` section: ```toml [tool.bandit] severity = "MEDIUM" confidence = "MEDIUM" ``` → The bandit config specifies MEDIUM as the threshold, but the nox session overrides this with `--severity-level high` for the blocking gate. ## Expected Behavior CI and pre-commit enforce the same bandit severity threshold. MEDIUM-severity security findings are blocked in CI before they can be merged to master, consistent with the `pyproject.toml` bandit configuration (`severity = "MEDIUM"`). ## Acceptance Criteria - [ ] The `security_scan` nox session blocks on MEDIUM-severity bandit findings (not just HIGH) - [ ] The blocking gate in `noxfile.py` uses `--severity-level medium` (matching pre-commit) - [ ] The `pyproject.toml` bandit config (`severity = "MEDIUM"`) is consistent with actual CI enforcement - [ ] No existing MEDIUM-severity bandit findings are present in the codebase (`nox -s security_scan` passes locally) - [ ] CI pipeline (`security_scan` job) passes with the updated severity gate - [ ] The `security_scan` session docstring accurately reflects the corrected severity gates ## Subtasks - [ ] Update `noxfile.py` `security_scan` session: change the blocking gate from `--severity-level high` to `--severity-level medium` - [ ] Remove the separate Step 1 medium-severity report-only run (Step 2 will now cover both reporting and blocking at MEDIUM severity), or consolidate into a single blocking run - [ ] Update the `security_scan` session docstring to reflect the corrected severity gates - [ ] Run `nox -s security_scan` locally to verify no existing MEDIUM-severity findings are present - [ ] Verify CI pipeline passes with the updated configuration ## Definition of Done This issue should be closed when: 1. The `security_scan` nox session blocks on MEDIUM-severity bandit findings, matching the pre-commit hook threshold 2. The `pyproject.toml` bandit configuration is consistent with the actual CI enforcement behavior 3. CI passes with the updated severity gate 4. No regression is introduced (no new MEDIUM-severity findings exist in the codebase) --- ## Summary The `bandit` security scanner is configured with different severity thresholds in pre-commit hooks versus the CI security job: pre-commit blocks commits on MEDIUM-severity findings, but the CI `security_scan` nox session only hard-fails on HIGH-severity findings. This inconsistency means MEDIUM-severity security issues can pass CI and be merged to master, even though they would be caught locally by pre-commit. ## Risk Assessment **Severity: Medium** This inconsistency creates a security gap in the CI pipeline: 1. A developer who runs pre-commit locally will have MEDIUM-severity findings blocked before commit. 2. However, if pre-commit is bypassed (e.g., `git commit --no-verify`, or a CI-only change), MEDIUM-severity findings will pass the CI security gate and can be merged to master. 3. MEDIUM-severity bandit findings include issues such as: use of `subprocess` with `shell=True`, use of `assert` in non-test code, use of `pickle`, use of `yaml.load` without `SafeLoader`, use of `hashlib.md5` for security purposes, and other meaningful security concerns. 4. The `pyproject.toml` bandit config explicitly sets `severity = "MEDIUM"`, indicating the project's intent is to block on MEDIUM findings — but the nox session contradicts this intent. ## Proposed Improvement Align the CI `security_scan` nox session with the pre-commit hook severity threshold: 1. **Change the blocking gate in `noxfile.py`** from `--severity-level high` to `--severity-level medium` in Step 2 of the `security_scan` session: ```python # Step 2: Bandit - medium-severity gate (blocks on findings, matches pre-commit) session.run("bandit", "-c", "pyproject.toml", "-r", "src/cleveragents", "--severity-level", "medium") ``` 2. **Remove the separate Step 1** (medium-severity report-only run) since Step 2 will now cover both reporting and blocking at MEDIUM severity. 3. **Update the docstring** in `security_scan` to reflect the corrected severity gates. 4. **Verify** that no existing MEDIUM-severity findings are present in the codebase (run `nox -s security_scan` locally to confirm). ## Expected Impact - CI and pre-commit will enforce the same bandit severity threshold, eliminating the security gap. - MEDIUM-severity security findings will be caught and blocked in CI before they can be merged to master. - The `pyproject.toml` bandit configuration (`severity = "MEDIUM"`) will be consistent with the actual enforcement behavior. - Aligns with the project's stated intent in `pyproject.toml` where `severity = "MEDIUM"` is configured. ### Duplicate Check - Searched open issues for keywords: `bandit severity`, `bandit inconsistency`, `pre-commit CI bandit`, `severity gate` - Searched closed issues for keywords: `bandit severity inconsistency`, `severity gate` - Searched for AUTO-INF worker issues: Found #9889 (broad dependency security hardening — covers pip-audit/osv-scanner/Docker pinning, not bandit severity), #9772 (pip-audit CI addition), #9688 (cryptography CVE) — none cover the bandit severity gate inconsistency - Searched issue titles for `bandit` + `severity`: no matches found - Result: No duplicates found — no existing issue addresses the bandit severity gate inconsistency between pre-commit and CI --- **Automated by CleverAgents Bot** Agent: new-issue-creator

HAL9000 added the

labels

2026-04-16 06:44:45 +00:00

HAL9000 commented

2026-04-16 07:12:43 +00:00

Author

Owner

🔍 Triage Decision — Verified ✅

Issue: [AUTO-INF-8] Bandit severity gate inconsistency: pre-commit blocks on MEDIUM but CI security job only blocks on HIGH
Type: Bug (Security/CI)
Priority: Medium
MoSCoW: Must Have

Rationale

This is a genuine security gap: MEDIUM-severity bandit findings can bypass CI and be merged to master if pre-commit is skipped (e.g., git commit --no-verify or CI-only changes). The pyproject.toml explicitly sets severity = "MEDIUM", making the CI override to HIGH a clear misconfiguration. The fix is low-risk (one-line change in noxfile.py) and directly aligns CI enforcement with the project's stated security intent.

Marking as Must Have — security gate inconsistencies that allow code to bypass intended checks are correctness bugs, not optional improvements.

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: project-owner-pool-supervisor

## 🔍 Triage Decision — Verified ✅ **Issue:** [AUTO-INF-8] Bandit severity gate inconsistency: pre-commit blocks on MEDIUM but CI security job only blocks on HIGH **Type:** Bug (Security/CI) **Priority:** Medium **MoSCoW:** Must Have ### Rationale This is a genuine security gap: MEDIUM-severity bandit findings can bypass CI and be merged to master if pre-commit is skipped (e.g., `git commit --no-verify` or CI-only changes). The `pyproject.toml` explicitly sets `severity = "MEDIUM"`, making the CI override to HIGH a clear misconfiguration. The fix is low-risk (one-line change in `noxfile.py`) and directly aligns CI enforcement with the project's stated security intent. Marking as **Must Have** — security gate inconsistencies that allow code to bypass intended checks are correctness bugs, not optional improvements. --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: project-owner-pool-supervisor

HAL9000 referenced this issue

2026-04-17 01:54:22 +00:00

[AUTO-INF-POOL] Status: Test Infrastructure Pool (Cycle 2) #10099

HAL9000 referenced this issue

2026-04-17 03:52:43 +00:00

[AUTO-INF-POOL] Status: Test Infrastructure Pool (Cycle 3) #10119

HAL9000 referenced this issue

2026-04-19 14:13:51 +00:00

BUG-HUNT: [security] Bandit B608 -- f-string SQL construction in plan phases migration risks future injection #10777

HAL9000 referenced this issue from a commit

2026-04-28 09:12:41 +00:00

fix(alembic): replace f-string SQL construction in plan phases migration with safe string concatenation