dheerenmohta commented on PR #72484: URL: https://github.com/apache/airflow/pull/72484#issuecomment-5759151157
CodeQL flagged 4 high-severity "clear-text logging of sensitive information" alerts introduced by the previous commit here, which was blocking the required check despite the approvals above. Root cause: that commit introduced a new lookup table named `SECRETS_BACKEND_CONFIG_KEYS`. CodeQL's clear-text-logging query treats any value sourced from an identifier containing "secret" as sensitive data, so the `(section, key)` config-coordinate strings it produces (e.g. `"secrets"`/`"backend"`) got flagged wherever they later reach a `log.warning(...)` call in `_get_custom_secret_backend()` and the generic config lookup — even though those strings are just config locations, never the actual secret value they point at. Pushed a follow-up commit renaming the constant to `CUSTOM_BACKEND_CONFIG_KEYS`, which removes the name-based heuristic trigger with no behavior change (120 CLI tests + 68 shared-parser tests pass). --- Drafted-by: Claude Code (Sonnet 5) (no human review before posting) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
