Harden CI workflows and document stores against SAST findings by FahimaGold · Pull Request #3539 · deepset-ai/haystack-core-integrations

FahimaGold · 2026-07-02T17:05:41Z

Address high-severity Bastion SAST findings:

gha-workflow-env-secret: move secrets out of workflow-level env: in 48 integration test workflows, scoping each to the step(s) that actually run integration tests. e2b uses job-level scoping so the secret stays available to the "Run integration tests" step's if: condition.
run-shell-injection (CI_pypi_release.yml): pass github.ref_name through an intermediate env var instead of interpolating it directly into run: scripts.
SQL/AQL injection (arangodb document_store.py): validate collection_name against an allowlist before interpolating it into AQL, mirroring the Oracle integration's identifier validation.
dependabot-missing-cooldown: raise cooldown default-days from 1 to 7.
uv-missing-dependency-cooldown: raise exclude-newer from 24 hours to 7 days.

Related Issues

fixes #issue-number

Proposed Changes:

How did you test it?

Notes for the reviewer

Checklist

I have read the contributors guidelines and the code of conduct
I have updated the related issue with new insights and changes
I added unit tests and updated the docstrings
I've used one of the conventional commit types for my PR title: fix:, feat:, build:, chore:, ci:, docs:, style:, refactor:, perf:, test:.

Address high-severity Bastion SAST findings: - gha-workflow-env-secret: move secrets out of workflow-level `env:` in 48 integration test workflows, scoping each to the step(s) that actually run integration tests. e2b uses job-level scoping so the secret stays available to the "Run integration tests" step's `if:` condition. - run-shell-injection (CI_pypi_release.yml): pass `github.ref_name` through an intermediate env var instead of interpolating it directly into `run:` scripts. - SQL/AQL injection (arangodb document_store.py): validate `collection_name` against an allowlist before interpolating it into AQL, mirroring the Oracle integration's identifier validation. - dependabot-missing-cooldown: raise cooldown `default-days` from 1 to 7. - uv-missing-dependency-cooldown: raise `exclude-newer` from 24 hours to 7 days. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CLAassistant · 2026-07-02T17:05:51Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
0 out of 2 committers have signed the CLA.

❌ Fahima Mokhtari
❌ FahimaGold

Fahima Mokhtari seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

github-actions · 2026-07-02T17:08:43Z

Coverage report (huggingface_api)

Click to see where and how coverage changed

File	Statements	Missing	Coverage	Coverage (new stmts)	Lines missing
integrations/huggingface_api/src/haystack_integrations/components/rankers/huggingface_api
ranker.py
Project Total

_{This report was generated by python-coverage-comment-action}

github-actions · 2026-07-02T17:08:46Z