phongn opened a new pull request, #466:
URL: https://github.com/apache/trafficserver-ci/pull/466
`bin/cov-submit.sh` has carried a hardcoded Coverity Scan submission token
and submitter email in this public repository since it was first added in
e4814fd ("scripts for ci", Feb 2021) — under a header that reads `NOTE NOTE: Do
not commit this script into any source repository!!!`.
Nothing invokes it. The Coverity job that actually runs today,
`jenkins/branch/coverity.pipeline`, inlines its own submission step and takes
the token from Jenkins credentials rather than from a file in the tree. The
only other reference is `jenkins/bin/coverity.sh`, which is itself dead
(devtoolset-7, autotools-only, calls `/home/admin/bin/cov-submit.sh`) and is
removed in a separate PR.
**This PR does not make the token safe.** It remains in git history and in
every existing clone. It should be rotated in Coverity Scan independently of
merging this.
Split out from a broader CI cleanup so the secret removal isn't blocked on
review of unrelated deletions.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
