✨ QD-13415 Exchange organization API token for a project token - #1052
Theodor Port (taport) wants to merge 2 commits into
Conversation
Users can supply QODANA_ORG_TOKEN plus a project slug (team-slug:project-slug) from QODANA_PROJECT_SLUG or 'projectSlug:' in qodana.yaml instead of QODANA_TOKEN. At startup the CLI exchanges them via the Qodana Public API (POST /public/organizations/projects) for a project token valid for 6 hours. - the linter/container only ever sees the project token via QODANA_TOKEN - QODANA_ORG_TOKEN is removed from the process env, container env and debug output - the exchanged token is never saved to the keyring - each slug part must be 3-64 chars of letters, digits, space, '-', '.', '_' Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: fb0074a386
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "Codex (@codex) review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "Codex (@codex) address that feedback".
| `, | ||
| Run: func(cmd *cobra.Command, args []string) { | ||
| qdenv.InitializeQodanaGlobalEnv(cliOptions) | ||
| tokenloader.InitializeQodanaGlobalEnv(cliOptions, cliOptions.ProjectDir, cliOptions.ConfigName) |
There was a problem hiding this comment.
When the token is supplied through the supported --env QODANA_ORG_TOKEN=... path, this call resolves it but only removes the OS-environment copy; the original value remains in cliOptions.Env_. CreateContext copies that slice into the scan context, and RunAnalysis passes every context field to platform.LogContext, so debug logging prints the organization-level secret before getDockerOptions filters it from the container environment. Remove or redact this entry before constructing/logging the context.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Fixed in 21bd12a: QODANA_ORG_TOKEN is now removed from cliOptions.Env_ right after the token is resolved, in scan.go and in the third-party run.go. It never reaches corescan.Context or LogContext. The container env and the debug docker run command were already filtered.
Qodana for Go139 new problems were found
@@ Code coverage @@
+ 64% total lines covered
11680 lines analyzed, 7546 lines covered
# Calculated according to the filters of your coverage tool☁️ View the detailed Qodana report Contact Qodana teamContact us at qodana-support@jetbrains.com
|
- rename OrgTokenDeclinedError to ErrOrgTokenDeclined (ST1012) - don't end the declined error format string with punctuation (ST1005) - drop QODANA_ORG_TOKEN from --env options after resolution so it never reaches the scan context and its debug output - move env filtering helpers to qdenv Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
1 participant
Users can supply QODANA_ORG_TOKEN plus a project slug (team-slug:project-slug) from QODANA_PROJECT_SLUG or 'projectSlug:' in qodana.yaml instead of QODANA_TOKEN. At startup the CLI exchanges them via the Qodana Public API (POST /public/organizations/projects) for a project token valid for 6 hours.
Checklist