chore: miscellaneous cleanup and security hardening #2363
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- Remove 6th cubic.yaml custom rule to stay within 5-rule limit - Remove stale TODO comment for GCP subnet cleanup (tracked in #381) - Rename misleading test_cleanup_not_scoped_to_project to test_vpc_cleanup_scoped_to_project - Add EC2Instance to CIS 5.1/5.2 SSH/RDP rule attack paths so findings traverse the instance→security-group→rule chain - Harden GitHub Actions workflows (zizmor): fix template injection in publish and sphinx workflows, add persist-credentials: false to all checkout steps Signed-off-by: jchapeau Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Jeremy Chapeau <jeremy@subimage.io>
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
kunaals
approved these changes
Feb 6, 2026
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Type of change
Summary
Collection of small maintenance tasks:
# TODO scope the cleanup to the current projectcomment insync_gcp_subnets— already tracked by GCP cleanup jobs should be scoped to the current project #381.test_cleanup_not_scoped_to_project→test_vpc_cleanup_scoped_to_projectto match actual test behavior (cleanup IS scoped, test verifies other projects' VPCs are preserved).EC2Instanceto the MATCH path incis_aws_5_1_unrestricted_sshandcis_aws_5_2_unrestricted_rdpso findings traverseEC2Instance→EC2SecurityGroup→IpPermissionInbound→IpRange.Related issues or links
license = "Apache-2.0"andinclude = ["cartography*"]excludes docs/tests from wheel)Breaking changes
None.
How was this tested?
No functional changes
Checklist
General
make lint).Proof of functionality
Notes for reviewers
use-trusted-publishingsuggestion for PyPI — switching to trusted publishing requires PyPI project configuration and is out of scope for this PR.EC2Instanceto the MATCH path; output models, field names, andasset_id_fieldare unchanged.