Repository navigation
bug(ci): the hardcoded-value detector never scans shell scripts, which is where hardcoded accounts and paths actually live #14316
Description
Found while tracing why a hardcoded username survived four cleanup passes (#14036).
Problem
pipeline-scripts/detect-hardcoded-values.sh scans only three file types:
grep -rn --include="*.py" --include="*.ts" --include="*.vue" ...
No shell script is ever scanned. Both of its rules — the IP-address pattern and the
/home/kali|/home/autobot path pattern — are applied exclusively to Python, TypeScript and Vue
sources.
That is how User=kali, Group=kali and chown kali:kali sat in
autobot-infrastructure/shared/scripts/utilities/fix-vnc-desktop.sh and fix-vnc-wsl.sh from
2026-02-18 (#926) until now, through three separate migrations that each replaced the paths
around them with variables and left the user literal untouched (#1939/#1940, #3226, and the path
normalisation that followed). The detector reported clean the whole time, because it never opened
the files.
Shell scripts are where hardcoded values are most likely: they are the layer that touches hosts,
paths and accounts directly, and they have no type system or linter enforcing indirection.
Second, narrower gap
Even within the file types it does scan, the account rule matches only /home/kali — a path.
A bare account literal such as User=kali, chown kali:kali, or a sudoers line naming the user
is not matched. So the same value is invisible in two different ways.
Evidence
Bare (non-path) kali literals in shell files on Dev_new_gui today:
setup/system/setup_passwordless_sudo.sh:11-14 (4 sudoers lines — see the companion issue)
utilities/fix-vnc-desktop.sh:37,44,81,82
utilities/fix-vnc-wsl.sh:22,23,...
None of these is reported by the detector.
Fix
- Add
--include="*.sh"(and the ansible*.yml, which has the same exposure) to both scans. - Broaden the account rule from
/home/<user>to the account name in the positions that matter —
User=,Group=,chown, and sudoers entries. - Expect a backlog on first run. It should be triaged the way bug(ci): 16 repo lint hooks have never run — tracked non-executable, and the CI step that would surface it swallows the failure #14181's dormant hooks were: enable,
measure, and record what is already there rather than fixing everything at once.
Activity
mrveiss commentedon Aug 16, 2026
Follow-up filed for a discovered-but-out-of-scope finding while fixing this: #14371 (three independent hardcoded-value detectors in this repo, only one of which is actually wired as an enforcing hook). Not fixed here — different scope, would risk the actually-enforced pre-commit hook. Fix for this issue is in #14370.
fix(docs): use a documentation-range address in the bootstrap example (…
fix(ci): scan shell/ansible for hardcoded values and fail the SLM mig…
mrveiss commentedon Aug 16, 2026
Closed — landed in
Dev_new_gui.Evidence
943e64060detect-hardcoded-values.shnow carries--include="*.sh"on both scansThe negative control is the evidence that matters. The unmodified base-branch script, run against the identical tree, reported
{"total_violations": 0}— the defect reproduced, not merely the fix demonstrated. The fixed script flags all foursetup_passwordless_sudo.sh:11-14sudoers lines.What changed
--include="*.sh" --include="*.yml" --include="*.yaml"added to both the IP scan and the account scan.autobot-infrastructureadded toSCAN_DIRS. This was not called out in the issue but is required: without it the shell-script include would still have reached nothing, because the deployment scripts that actually touch hosts, paths and accounts were never in the list./home/kali|/home/autobotpaths to also match account identity where it really appears in shell/systemd/sudoers text —User=/Group=,chown owner:group, and bare sudoers rules. That is exactly the shape that letUser=kaliandchown kali:kalisurvive three migrations which rewrote the paths around them and left the user literal untouched.ssot-coverage.yml's trigger widened to**/*.sh/**/*.yml/**/*.yaml, confirmed not to be one of the 10 required contexts.One review finding was fixed rather than shipped. The first revision added
# noqato silence a real fleet IP in an ansible doc comment. That suppressed where a fix was available, and the annotation was appended after a shell line-continuation\, silently breaking the documented command for anyone copy-pasting it. Replaced with192.0.2.10(RFC 5737 documentation range): the value is gone from the tree rather than exempted, the backslash is terminal again, and the diff adds nonoqa.Follow-up filed, not absorbed: #14371 — three separate hardcoded-value detectors have drifted, including a dormant duplicate whose body is a literal table of every SSOT value.
mrveiss commentedon Aug 16, 2026
Verified against
Dev_new_guiand closing — this is fixed.Commit
943e64060(#14370) added the missing file types to both scan loops:The state I filed against was
--include="*.py" --include="*.ts" --include="*.vue"and nothing else — confirmed by reading the file at the pre-#14370 revision, so the original report was accurate at the time.It also addresses the second half of what I filed: the account rule is now
ACCOUNT_PATTERNrather than a/home/<user>path match, so a bare literal likeUser=kaliis in scope where it previously was not.Closing as fixed by #14370.
refactor(ci): one hardcoded-value detector carrying all three rule se…
refactor(ci): consolidate duplicated, drifted and never-run CI guards (…