Release 2.0.1: Interactive wizard and PyPI link fix - #3
Conversation
- Add `hammerdb-scale init --interactive` (-i) guided configuration wizard with Rich UI: 6-step flow covering deployment, database & benchmark, targets, credentials, benchmark parameters, and infrastructure - Extract _build_config_yaml() for shared use between wizard and plain init - Fix README.md documentation links broken on PyPI by converting relative paths to absolute GitHub URLs - Update USAGE-GUIDE.md with wizard documentation - Bump version to 2.0.1
| default=password, | ||
| hide_input=True, | ||
| ) | ||
| oracle_config = { |
Check failure
Code scanning / CodeQL
Clear-text storage of sensitive information High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 5 months ago
In general, to fix this issue we must avoid writing the actual password value into the generated YAML file. Instead, we should output either a placeholder string instructing the user how to provide the password securely (e.g., via environment variables or an external secret store) or a reference to an env var, while keeping the rest of the configuration generation unchanged.
The minimal, non‑breaking approach here is:
- Change
_build_config_yamlso that thepasswordargument is not interpolated into the YAML. - Instead, write a safe placeholder such as
"${HAMMERDB_DB_PASSWORD}"(or"changeme"), and add commented guidance in the generated YAML snippet to tell the user to define that environment variable (or edit the file manually). - Keep accepting the
passwordparameter and prompting for it ininit, but do not use it in the template content; this avoids larger refactors and still removes the clear‑text storage. If desired later, the unused parameter can be removed, but that’s outside the requested minimal fix.
Concretely:
-
In
_build_config_yaml, locate the section:250: defaults: 251: type: {db_type_str} 252: username: {username} 253: password: "{password}"
-
Replace the
passwordline with something like:252: username: {username} 253: password: "${HAMMERDB_DB_PASSWORD}" # set via environment variable; do not commit real passwords
This breaks the direct dataflow from the user‑supplied
passwordstring into the file, addressing all the listed variants at the same sink (line 409). -
No new imports or external libraries are required; we are just changing the literal generated into the YAML.
All CodeQL variants that refer to config_yaml being written to disk are satisfied because the sensitive input is no longer embedded in config_yaml at all.
| @@ -250,7 +250,7 @@ | ||
| defaults: | ||
| type: {db_type_str} | ||
| username: {username} | ||
| password: "{password}" | ||
| password: "${HAMMERDB_DB_PASSWORD}" # set via environment variable; do not commit real passwords | ||
| image: | ||
| repository: {image_repo} | ||
| tag: latest |
Summary
hammerdb-scale init -i/--interactive): 6-step guided configuration flow with Rich UI — numbered selection menus, input validation, optional advanced options, and a confirmation summary table before writingChanges
New files
src/hammerdb_scale/wizard.py— wizard flow, summary table, step headerstests/test_wizard.py— 13 tests covering wizard logic, cancellation, YAML output parityModified files
src/hammerdb_scale/cli.py— added-i/--interactiveflag, extracted_build_config_yaml()README.md— relative links → absolute GitHub URLsdocs/USAGE-GUIDE.md— wizard mode documentationCHANGELOG.md— 2.0.1 release notespyproject.toml,__init__.py,constants.py,output.py,reports/generator.pyTest plan
ruff checkandruff formatcleanhammerdb-scale init -ifor both Oracle and MSSQL pathshammerdb-scale validate