Skip to content

Commit 02d319c

Browse files
sbelhaiksbelhaik
authored
Merge branch 'main' into sbel/correct_jira_id_label
2 parents a80ba63 + 3974fe2 commit 02d319c

38 files changed

Lines changed: 1252 additions & 466 deletions

‎.github/copilot-instructions.md‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,32 @@ Skills are detected and loaded based on file type, task keywords, and context si
5555
- Avoid duplicating policy/checklist text across this file and skills.
5656
- If overlap is found, retain one canonical source and replace duplicates with a short pointer.
5757

58+
## Security Defaults (Always-On)
59+
60+
Apply secure-by-default behavior across all code generation, changes, and reviews, regardless of language or component.
61+
62+
- Prefer least privilege across code, services, identities, file permissions, APIs, containers, and workflows; avoid insecure defaults.
63+
- Treat all external input as untrusted and validate format, type, range, and length at trust boundaries.
64+
- Never hard-code or introduce secrets, credentials, keys, tokens, or passwords in source, tests, configs, or templates; use environment variables or approved secret-management mechanisms.
65+
- Avoid exposing sensitive data in logs, traces, errors, metrics, or test artifacts.
66+
- Prevent injection vulnerabilities by avoiding unsafe string construction and using safe, context-appropriate APIs.
67+
- Prefer trusted, actively maintained dependencies and images; verify sources and pin versions where feasible.
68+
- Avoid deprecated, unmaintained, or ambiguous packages.
69+
- Do not suggest bypassing or weakening existing security checks or validations.
70+
- Keep authorization checks server-side and close to protected resources.
71+
- Avoid unsafe dynamic execution patterns (`eval`, `exec`, untrusted command construction).
72+
- Do not assume trusted inputs, networks, or environments.
73+
- Be explicit about assumptions and limitations.
74+
- Fail safely and visibly.
75+
76+
## AI Output Trust Model
77+
78+
Treat AI-generated output as **untrusted draft code** until reviewed and tested.
79+
Reject suggestions that bypass security controls for convenience or introduce unsafe defaults.
80+
81+
For detailed security review guidance, follow:
82+
`.github/skills/security.md`.
83+
5884
## Architecture Overview
5985

6086
**Core Components:**

‎.github/skills/security.md‎

Lines changed: 149 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,149 @@
1+
# Security Review Skill (On-Demand)
2+
3+
## Purpose
4+
5+
This document defines on-demand security review guidance for code and configuration changes.
6+
It complements the always-on secure-by-default rules defined in `.github/copilot-instructions.md`.
7+
8+
This skill applies only at development and authoring time.
9+
Runtime, host, cluster, or organizational security controls are explicitly out of scope.
10+
11+
---
12+
13+
## Security Review Trigger Points
14+
15+
Load this security review skill when changes involve:
16+
17+
- Authentication, session, or token logic
18+
- Authorization or resource ownership checks
19+
- Input parsing, validation, normalization, or canonicalization
20+
- File handling, deserialization, template rendering, or process execution
21+
- Logging, telemetry, secrets handling, or sensitive data paths
22+
- Dependency upgrades, lockfile changes, or CVE-related updates
23+
- Dockerfile or container base image changes
24+
- Docker Compose, Helm charts, or Kubernetes-related configuration
25+
- CI/CD workflow changes affecting build, test, release, or scanning
26+
- Privilege elevation, root execution, host mounts, or new Linux capabilities
27+
28+
---
29+
30+
## AI-Generated Code Guardrails
31+
32+
When reviewing AI-generated changes:
33+
34+
- Treat AI output as untrusted draft code until reviewed and tested
35+
- Verify package names, APIs, images, and tools exist and originate from trusted sources
36+
- Reject suggestions that bypass or disable security controls for convenience
37+
- Require pinned versions and lockfiles for generated dependencies; prefer integrity-verified installs when supported
38+
- Never accept generated code or configs that inject secrets via source files, Dockerfile `ARG`/`ENV`, or committed templates
39+
- Reject generated install scripts that use unchecked remote execution patterns (e.g., `curl | sh`) without checksum or signature verification
40+
- Reject generated build commands that disable TLS, certificate verification, or security checks to make builds pass
41+
- Apply RCI pattern: ask the AI to review its own output for security issues, then improve; repeat 1-2 iterations
42+
43+
---
44+
45+
## Secure Code Review (OSS Context)
46+
47+
Apply when reviewing application logic, services, APIs, or libraries.
48+
49+
### Input handling
50+
51+
- Validate input at trust boundaries (format, type, range, length)
52+
- Avoid unsafe deserialization
53+
- Do not propagate unvalidated input across trust boundaries
54+
- Avoid command, query, or expression construction via string concatenation
55+
- Use parameterized queries for all database access
56+
57+
### Authorization
58+
59+
- **Keep authorization checks server-side and close to protected actions or resources**
60+
- Do not rely on client-side enforcement for access control
61+
62+
### Error handling
63+
64+
- Errors must not expose sensitive internal details
65+
- Avoid ignored return values or silent failures
66+
67+
### Memory & resource safety (where applicable)
68+
69+
- Avoid unchecked allocations and unbounded resource use
70+
- Ensure files, sockets, and handles are closed deterministically
71+
72+
### Logging & telemetry
73+
74+
- Do not log credentials, tokens, secrets, or PII
75+
- Logs should be actionable without exposing sensitive data
76+
77+
### Dynamic execution
78+
79+
- **Avoid unsafe dynamic execution patterns (`eval`, `exec`, reflection, or untrusted code execution).**
80+
81+
### Dependency usage
82+
83+
- Avoid shelling out when native APIs or libraries exist
84+
- Flag outdated, unmaintained, or suspicious dependencies
85+
- Prefer latest stable versions; specify exact or range-locked versions
86+
87+
### OSS-specific review checks
88+
89+
- Is externally observable **security-relevant behavior** documented?
90+
- Are assumptions and limitations stated explicitly for users?
91+
92+
If uncertainty exists, flag it clearly rather than guessing or assuming safety.
93+
94+
---
95+
96+
## Container Artifact Review (Development-Time)
97+
98+
Apply when generating or reviewing:
99+
100+
- Dockerfiles / Containerfiles
101+
- docker-compose.yml
102+
- Helm charts (templates and values)
103+
104+
### Dockerfile
105+
106+
- Avoid `latest` or floating tags; pin versions or digests
107+
- Prefer minimal base images
108+
- Ensure containers do not run as root
109+
- Avoid setuid or setgid binaries
110+
- Use multi-stage builds and remove build tools, package caches, and temp files from final image
111+
- Prefer `COPY` over `ADD`
112+
- Never embed secrets in `ARG`, `ENV`, or filesystem layers
113+
114+
### Docker Compose
115+
116+
- Avoid `privileged: true` and host networking unless explicitly justified
117+
- Do not mount the Docker socket
118+
- Restrict host filesystem mounts
119+
- Limit exposed ports and networks; prefer internal networks
120+
121+
Concerns that depend on deployment or runtime policy should be flagged as:
122+
**"Deployment-time responsibility."**
123+
124+
---
125+
126+
## Helm / Kubernetes Review (Development-Time)
127+
128+
- Default to `runAsNonRoot: true`
129+
- Set `allowPrivilegeEscalation: false`
130+
- Prefer read-only root filesystem where feasible
131+
- Drop unnecessary Linux capabilities
132+
- Do not template secrets directly into charts
133+
- Document required runtime security assumptions
134+
135+
Do not enforce cluster-wide, node-level, or runtime security controls.
136+
137+
---
138+
139+
## Review Output Expectations
140+
141+
- Identify which section applies (Code / Container / Helm)
142+
- Classify findings as:
143+
- Fix in artifact
144+
- Deployment/runtime responsibility
145+
- Explicitly state assumptions or uncertainty
146+
- Use severity levels: Critical / High / Medium / Low with confidence: High / Medium / Low
147+
- Include specific file/function references and recommended fixes
148+
149+
Security review is advisory; final decisions belong to maintainers.

‎.github/workflows/auto-update-labeled.yml‎

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
---
2+
# SPDX-FileCopyrightText: (C) 2025 - 2026 Intel Corporation
3+
# SPDX-License-Identifier: Apache-2.0
4+
5+
name: "[CI/CD] Auto-Update Pull Requests"
6+
run-name: "[CI/CD] Auto-Update PRs based on ${{ github.ref_name }}"
7+
8+
on: # yamllint disable-line rule:truthy
9+
push:
10+
pull_request:
11+
types:
12+
- auto_merge_enabled
13+
workflow_dispatch: {}
14+
15+
concurrency:
16+
group: ${{ github.workflow }}-${{ github.ref }}
17+
cancel-in-progress: true
18+
19+
permissions: {}
20+
21+
jobs:
22+
update-pull-requests:
23+
name: "Update pull requests targeting this branch"
24+
if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
25+
runs-on: ubuntu-latest
26+
permissions:
27+
contents: write
28+
pull-requests: write
29+
30+
env:
31+
# Only PRs carrying this label are updated (drafts included).
32+
UPDATE_LABEL: "auto-update"
33+
34+
steps:
35+
- name: "Find and update pull requests"
36+
env:
37+
GH_TOKEN: ${{ secrets.GH_PAT }}
38+
BASE_BRANCH: ${{ github.ref_name }}
39+
run: |
40+
echo "Searching for open PRs targeting '${BASE_BRANCH}'"
41+
42+
if ! pr_list_output=$(gh pr list \
43+
--repo "$GITHUB_REPOSITORY" \
44+
--base "$BASE_BRANCH" \
45+
--label "$UPDATE_LABEL" \
46+
--state open \
47+
--json number,isDraft,headRefName,title \
48+
--jq '.[] | @json'); then
49+
echo "ERROR: gh pr list failed — check API access and token permissions."
50+
exit 1
51+
fi
52+
53+
mapfile -t prs <<< "$pr_list_output"
54+
# When output is empty, mapfile produces one empty element — normalize it.
55+
if [[ ${#prs[@]} -eq 1 && -z "${prs[0]}" ]]; then
56+
prs=()
57+
fi
58+
59+
if [[ ${#prs[@]} -eq 0 ]]; then
60+
echo "No open PRs with label '${UPDATE_LABEL}' targeting '${BASE_BRANCH}' — nothing to do."
61+
exit 0
62+
fi
63+
64+
echo "Found ${#prs[@]} candidate PR(s)."
65+
66+
failed=0
67+
for pr_json in "${prs[@]}"; do
68+
pr_number=$(echo "$pr_json" | jq -r '.number')
69+
is_draft=$(echo "$pr_json" | jq -r '.isDraft')
70+
head_ref=$(echo "$pr_json" | jq -r '.headRefName')
71+
title=$(echo "$pr_json" | jq -r '.title')
72+
73+
echo "→ PR #${pr_number}: '${title}' (head: ${head_ref}, draft: ${is_draft})"
74+
75+
if gh pr update-branch "$pr_number" --repo "$GITHUB_REPOSITORY"; then
76+
echo " ✓ PR #${pr_number} updated successfully."
77+
else
78+
echo " ✗ PR #${pr_number} could not be updated (may already be up to date or have a merge conflict)."
79+
failed=$((failed + 1))
80+
fi
81+
done
82+
83+
echo "Done. Failed: ${failed}."
84+
if [[ $failed -gt 0 ]]; then
85+
echo "Warning: ${failed} PR(s) could not be updated — review the logs above."
86+
fi
87+
88+
remove-label-on-automerge:
89+
name: "Remove auto-update label when auto-merge is enabled"
90+
if: github.event_name == 'pull_request' && github.event.action == 'auto_merge_enabled'
91+
runs-on: ubuntu-latest
92+
permissions:
93+
pull-requests: write
94+
95+
env:
96+
UPDATE_LABEL: "auto-update"
97+
98+
steps:
99+
- name: "Remove '${{ env.UPDATE_LABEL }}' label from PR"
100+
env:
101+
GH_TOKEN: ${{ secrets.GH_PAT }}
102+
PR_NUMBER: ${{ github.event.pull_request.number }}
103+
run: |
104+
# Query labels first and fail explicitly if the GitHub CLI request fails.
105+
if ! pr_labels=$(gh pr view "$PR_NUMBER" \
106+
--repo "$GITHUB_REPOSITORY" \
107+
--json labels \
108+
--jq '.labels[].name'); then
109+
echo "Failed to read labels for PR #${PR_NUMBER}."
110+
exit 1
111+
fi
112+
113+
# Treat a missing label as a normal no-op, but do not mask query failures.
114+
if ! printf '%s\n' "$pr_labels" | grep -Fxq -- "$UPDATE_LABEL"; then
115+
echo "PR #${PR_NUMBER} does not have the '${UPDATE_LABEL}' label — nothing to do."
116+
exit 0
117+
fi
118+
119+
echo "Removing '${UPDATE_LABEL}' label from PR #${PR_NUMBER} (auto-merge enabled)."
120+
gh pr edit "$PR_NUMBER" \
121+
--repo "$GITHUB_REPOSITORY" \
122+
--remove-label "$UPDATE_LABEL"
123+
echo "Label removed."

‎controller/src/controller/detections_builder.py‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -88,17 +88,18 @@ def prepareObjDict(scene, obj, update_visibility, include_sensors=False,
8888
if key != 'reid':
8989
obj_dict['metadata'][key] = value
9090

91-
# Output reid in metadata structure
91+
# Output reid in metadata structure.
92+
# embedding_vector is always a (1, N) ndarray after decodeReIDEmbeddingVector.
9293
if aobj.reid and 'embedding_vector' in aobj.reid:
9394
reid_embedding = aobj.reid['embedding_vector']
9495
if reid_embedding is not None:
9596
if 'metadata' not in obj_dict:
9697
obj_dict['metadata'] = {}
97-
if isinstance(reid_embedding, np.ndarray):
98-
obj_dict['metadata']['reid'] = {'embedding_vector': reid_embedding.tolist()}
99-
else:
100-
obj_dict['metadata']['reid'] = {'embedding_vector': reid_embedding}
101-
# Add model_name if available
98+
reid_vec = np.asarray(reid_embedding, dtype=np.float32)
99+
obj_dict['metadata']['reid'] = {
100+
'embedding_vector': reid_vec.tolist(),
101+
'embedding_dimensions': int(reid_vec.reshape(-1).shape[0]),
102+
}
102103
if 'model_name' in aobj.reid:
103104
obj_dict['metadata']['reid']['model_name'] = aobj.reid['model_name']
104105

0 commit comments

Comments
 (0)