Repository navigation
skills/qcom-boot-validate: run --power-cycle-cmd without a shell - #36
Conversation
boot-validate.py ran the --power-cycle-cmd string through a shell (subprocess.run(..., shell=True)), which the Semgrep rule subprocess-shell-true flags as an error. Since qcom-reusable-workflows v2.0.11 the preflight Semgrep job fails on any error-severity result, so every push to main has failed the QC Preflight Checks. Pull requests stay green only because their scans are limited to the diff. Dismissing the alert, or adding a nosemgrep comment, does not help: the gate reads the local SARIF file and ignores its suppressions. Split the command with shlex and run it without a shell. Commands made of plain words and quoting behave as before; ones that need shell syntax (pipes, redirection, variable or ~ expansion) or are scripts without a #! line must now be wrapped in sh -c '...', as the script's docstring and help text and SKILL.md now say. If the command cannot be started (empty, missing binary, unbalanced quotes), log a warning and keep watching the console, as already done for a non-zero exit. Bump the skill version to 0.2 in SKILL.md and skills.json. Assisted-by: Claude Code:claude-opus-5-5 Signed-off-by: Ricardo Salveti <ricardo.salveti@oss.qualcomm.com>
There was a problem hiding this comment.
🟢 Approval recommended
The focused execution change, error handling, documentation, and version metadata are consistent, with no blocking defects identified.
No open issues 🎉
What changed in this PR
Updates boot validation to run power-cycle commands without an implicit shell, addressing the Semgrep failure blocking preflight checks.
Changes:
- Parses command arguments with
shlexand handles startup failures without stopping console monitoring. - Documents explicit shell wrapping for commands requiring shell behavior.
- Bumps the skill version to 0.2.
| File | Description |
|---|---|
| skills/qcom-boot-validate/SKILL.md | Documents command behavior and updates the version. |
| skills/qcom-boot-validate/scripts/boot-validate.py | Removes implicit shell execution and handles launch errors. |
| skills.json | Synchronizes the catalog version to 0.2. |
Review effort: Balanced
Qualcomm AI ReviewClick to expand Deep Code ReviewSummaryIssues: none found → No action required IssuesNo issues identified. The structured findings data was empty, and the review agent's analysis of the PR (removing |
8ecf303
into
qualcomm-linux:main
boot-validate.py ran the --power-cycle-cmd string through a shell (subprocess.run(..., shell=True)), which the Semgrep rule subprocess-shell-true flags as an error. Since qcom-reusable-workflows v2.0.11 the preflight Semgrep job fails on any error-severity result, so every push to main has failed the QC Preflight Checks. Pull requests stay green only because their scans are limited to the diff. Dismissing the alert, or adding a nosemgrep comment, does not help: the gate reads the local SARIF file and ignores its suppressions.
Split the command with shlex and run it without a shell. Commands made of plain words and quoting behave as before; ones that need shell syntax (pipes, redirection, variable or ~ expansion) or are scripts without a #! line must now be wrapped in sh -c '...', as the script's docstring and help text and SKILL.md now say. If the command cannot be started (empty, missing binary, unbalanced quotes), log a warning and keep watching the console, as already done for a non-zero exit. Bump the skill version to 0.2 in SKILL.md and skills.json.