From f8976adb11863a7feffa7f4a42cc94109dfa9915 Mon Sep 17 00:00:00 2001 From: Patrick Wozniak Date: Tue, 25 Aug 2026 16:40:45 +0200 Subject: [PATCH] ci(security): allow documented Command Code env vars --- .semgrep/pi-extension-audit.yaml | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/.semgrep/pi-extension-audit.yaml b/.semgrep/pi-extension-audit.yaml index b56c540..750ebf6 100644 --- a/.semgrep/pi-extension-audit.yaml +++ b/.semgrep/pi-extension-audit.yaml @@ -89,8 +89,6 @@ rules: - "**/*.ts" - "**/index.ts" - - # ──────────────────────────────────────────────────────────────────────── # Supply chain: dependency injection # ──────────────────────────────────────────────────────────────────────── @@ -209,8 +207,8 @@ rules: - id: pi-extension-unusual-import patterns: - pattern-either: - - pattern: "import $X from \"...\"" - - pattern: "const $X = require(\"...\")" + - pattern: 'import $X from "..."' + - pattern: 'const $X = require("...")' - metavariable-regex: metavariable: $X regex: "(compression|pako|zlib|tar|stream|archiver|request|axios|needle|got|superagent|node-fetch|undici)" @@ -256,10 +254,10 @@ rules: - pattern: process.env.$VAR - metavariable-regex: metavariable: $VAR - regex: "(?!COMMANDCODE_|NODE_|PATH|HOME|SHELL|USER|LANG|LC_|TERM|TMPDIR|NIX_).*" + regex: "(?!COMMANDCODE_|COMMAND_CODE_|CMD_ZDR|NODE_|PATH|HOME|SHELL|USER|LANG|LC_|TERM|TMPDIR|NIX_).*" message: > Reading unexpected environment variable $VAR. Provider should only - read COMMANDCODE_* variables. + read documented Command Code or standard runtime variables. severity: WARNING languages: [javascript, typescript] paths: @@ -270,4 +268,3 @@ rules: # ──────────────────────────────────────────────────────────────────────── # OAuth flow manipulation # ──────────────────────────────────────────────────────────────────────── -