Repository: cloudnative-pg/cloudnative-pg

Issue:
[Bug]: avoid using hardcoded users and password
### Is there an existing issue already for this bug?

- [x] I have searched for an existing issue, and could not find anything. I believe this is a new bug.

### I have read the troubleshooting guide

- [x] I have read the troubleshooting guide and I think this is a new bug.

### I am running a supported version of CloudNativePG

- [x] I have read the troubleshooting guide and I think this is a new bug.

### Contact Details

_No response_

### Version

1.27 (latest patch)

### What version of Kubernetes are you using?

1.34

### What is your Kubernetes environment?

Self-managed: kind (evaluation)

### How did you install the operator?

YAML manifest

### What happened?

Snyk tests and GitHub code scanning are reporting some hard coded  user and password, these are all in tests and should be fixed to avoid false positives

### Cluster resource

```shell

```

### Relevant log output

```shell

```

### Code of Conduct

- [x] I agree to follow this project's Code of Conduct

Discussion:

Solution patch:
diff --git a/.github/generate-test-artifacts.py b/.github/generate-test-artifacts.py
index c81268ec..7680b3c2 100644
--- a/.github/generate-test-artifacts.py
+++ b/.github/generate-test-artifacts.py
@@ -154,7 +154,7 @@ def write_artifact(artifact, artifact_dir, matrix):
     """writes an artifact to local storage as a JSON file
 
     The computed filename will be used as the ID to introduce the payload into
-    Elastic for the E2E Test . Should be unique across the current GH run.
+    Elastic for the E2E Test. Should be unique across the current GH run.
     So: MatrixID + Test
     Because we may run this on MSFT Azure, where filename length limits still
     exist, we HASH the test name.
@@ -162,14 +162,16 @@ def write_artifact(artifact, artifact_dir, matrix):
     Repository, and with Repo + Run ID + MatrixID + Test Hash, gives a unique
     ID in Elastic to each object.
     """
+    if artifact_dir is None:
+        print("No artifact dir provided")
+        return
     whitespace = re.compile(r"\s")
     slug = whitespace.sub("_", artifact["name"])
     h = hashlib.sha224(slug.encode("utf-8")).hexdigest()
-    filename = matrix["id"] + "_" + h + ".json"
-    if artifact_dir != "":
-        filename = artifact_dir + "/" + filename
+    filename = clean_path(matrix["id"] + "_" + h + ".json")
+    artifact_file = os.path.join(artifact_dir, filename)
     try:
-        with open(filename, "w") as f:
+        with open(artifact_file, "w") as f:
             f.write(json.dumps(artifact))
     except (FileNotFoundError, PermissionError) as e:
         print(f"Error: {e}")
@@ -204,6 +206,12 @@ def create_artifact(matrix, name, state, error):
     }
 
 
+def clean_path(path):
+    """Sanitize a path, removing any redundant separators and up-level references"""
+    normpath = os.path.normpath(path)
+    return os.path.join(os.path.dirname(normpath), os.path.basename(normpath))
+
+
 if __name__ == "__main__":
     parser = argparse.ArgumentParser(
         description="Create JSON artifacts from E2E JSON report"
@@ -213,6 +221,7 @@ if __name__ == "__main__":
         "--file",
         type=str,
         help="report JSON file with test run, as produce by ginkgo",
+        required=True,
     )
     parser.add_argument(
         "-o",
@@ -220,6 +229,7 @@ if __name__ == "__main__":
         type=str,
         default="",
         help="directory where we write the artifacts",
+        required=True,
     )
     parser.add_argument(
         "-m", "--matrix", type=str, help="the matrix with GH execution variables"
@@ -246,16 +256,15 @@ if __name__ == "__main__":
 
     print(matrix)
 
-    outputDir = ""
-    if args.outdir:
-        outputDir = args.outdir
-        if not os.path.exists(outputDir):
-            os.makedirs(outputDir)
-            print("Directory ", outputDir, " Created ")
+    outputDir = clean_path(args.outdir)
+    if not os.path.exists(outputDir):
+        os.makedirs(outputDir)
+        print("Directory ", outputDir, " Created ")
 
     # If the ginkgo report file is not found, produce a "failed" artifact
-    if not os.path.exists(args.file):
-        print("Report ", args.file, " not found ")
+    file_report = clean_path(args.file)
+    if not os.path.exists(file_report):
+        print("Report ", file_report, " not found ")
         # we still want to get an entry in the E2E Dashboard for workflows that even
         # failed to run the ginkgo suite or failed to produce a JSON report.
         # We create a custom Artifact with a `failed` status for the Dashboard
@@ -263,7 +272,7 @@ if __name__ == "__main__":
             matrix,
             "Open Ginkgo report",
             "failed",
-            "ginkgo Report Not Found: " + args.file,
+            "ginkgo Report Not Found: " + file_report,
         )
         write_artifact(artifact, outputDir, matrix)
         exit(0)
@@ -271,7 +280,7 @@ if __name__ == "__main__":
     # MAIN LOOP: go over each `SpecReport` in the Ginkgo JSON output, convert
     # each to the normalized JSON format and create a JSON file for each of those
     try:
-        with open(args.file) as json_file:
+        with open(file_report) as json_file:
             testResults = json.load(json_file)
             for t in testResults[0]["SpecReports"]:
                 if (t["State"] != "skipped") and is_user_spec(t):
diff --git a/.github/pg_versions.json b/.github/pg_versions.json
index 462e8dcc..b8139bd0 100644
--- a/.github/pg_versions.json
+++ b/.github/pg_versions.json
@@ -1,26 +1,26 @@
 {
   "18": [
     "18.0-system-trixie",
-    "18.0-202510201453-system-trixie"
+    "18.0-202511030807-system-trixie"
   ],
   "17": [
     "17.6-system-trixie",
-    "17.6-202510201453-system-trixie"
+    "17.6-202511030807-system-trixie"
   ],
   "16": [
     "16.10-system-trixie",
-    "16.10-202510201453-system-trixie"
+    "16.10-202511030807-system-trixie"
   ],
   "15": [
     "15.14-system-trixie",
-    "15.14-202510201453-system-trixie"
+    "15.14-202511030807-system-trixie"
   ],
   "14": [
     "14.19-system-trixie",
-    "14.19-202510201453-system-trixie"
+    "14.19-202511030807-system-trixie"
   ],
   "13": [
     "13.22-system-trixie",
-    "13.22-202510201453-system-trixie"
+    "13.22-202511030807-system-trixie"
   ]
 }
\ No newline at end of file
diff --git a/Makefile b/Makefile
index e2eb36b4..a3daaa00 100644
--- a/Makefile
+++ b/Makefile
@@ -59,7 +59,7 @@ GENREF_VERSION ?= 015aaac611407c4fe591bc8700d2c67b7521efca
 # renovate: datasource=go depName=github.com/goreleaser/goreleaser
 GORELEASER_VERSION ?= v2.12.7
 # renovate: datasource=docker depName=jonasbn/github-action-spellcheck versioning=docker
-SPELLCHECK_VERSION ?= 0.53.0
+SPELLCHECK_VERSION ?= 0.54.0
 # renovate: datasource=docker depName=getwoke/woke versioning=docker
 WOKE_VERSION ?= 0.19.0
 # renovate: datasource=github-releases depName=operator-framework/operator-sdk versioning=loose



Test patch:
diff --git a/internal/cmd/plugin/pgadmin/pgadmin_test.go b/internal/cmd/plugin/pgadmin/pgadmin_test.go
index 0c9a4e19..0cc068f8 100644
--- a/internal/cmd/plugin/pgadmin/pgadmin_test.go
+++ b/internal/cmd/plugin/pgadmin/pgadmin_test.go
@@ -26,6 +26,7 @@ import (
 
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/util/intstr"
+	"k8s.io/apimachinery/pkg/util/rand"
 
 	"github.com/cloudnative-pg/cloudnative-pg/internal/cmd/plugin"
 
@@ -35,6 +36,7 @@ import (
 
 var _ = Describe("command methods", func() {
 	var cmd *command
+	pgadminPassword := rand.String(12)
 
 	BeforeEach(func() {
 		cmd = &command{
@@ -46,7 +48,7 @@ var _ = Describe("command methods", func() {
 			ServiceName:                   "example-service",
 			SecretName:                    "example-secret-name",
 			PgadminUsername:               "example-username",
-			PgadminPassword:               "example-password",
+			PgadminPassword:               pgadminPassword,
 			Mode:                          ModeServer, // or ModeDesktop for the desktop mode
 			PgadminImage:                  "example-image",
 		}
@@ -148,7 +150,7 @@ var _ = Describe("command methods", func() {
 		Expect(secret.ObjectMeta.Namespace).To(Equal(plugin.Namespace))
 
 		Expect(secret.StringData).To(HaveKeyWithValue("username", "example-username"))
-		Expect(secret.StringData).To(HaveKeyWithValue("password", "example-password"))
+		Expect(secret.StringData).To(HaveKeyWithValue("password", pgadminPassword))
 	})
 })
 
diff --git a/internal/management/controller/roles/runnable_test.go b/internal/management/controller/roles/runnable_test.go
index 31d427b3..ab1e8c5e 100644
--- a/internal/management/controller/roles/runnable_test.go
+++ b/internal/management/controller/roles/runnable_test.go
@@ -31,6 +31,7 @@ import (
 	"github.com/lib/pq"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/rand"
 	"k8s.io/utils/ptr"
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
 
@@ -576,8 +577,11 @@ const (
 	secretNameNoPass   = "vinci-secret-no-pass"
 	secretNameNotExist = "vinci-secret-name-not-exist"
 	userNameNotExist   = "vinci-not-exist"
-	userName           = "vinci"
-	password           = "vinci1234"
+)
+
+var (
+	userName = rand.String(12)
+	password = rand.String(12)
 )
 
 var _ = DescribeTable("role secrets test",
diff --git a/pkg/management/postgres/configuration_test.go b/pkg/management/postgres/configuration_test.go
index 48cd5984..70a200c8 100644
--- a/pkg/management/postgres/configuration_test.go
+++ b/pkg/management/postgres/configuration_test.go
@@ -29,6 +29,7 @@ import (
 	"github.com/cloudnative-pg/machinery/pkg/postgres/version"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/rand"
 	"k8s.io/utils/ptr"
 
 	apiv1 "github.com/cloudnative-pg/cloudnative-pg/api/v1"
@@ -39,7 +40,6 @@ import (
 )
 
 const (
-	ldapPassword        = "ldapPassword"
 	ldapBaseDN          = "ldapBaseDN"
 	ldapBindDN          = "ldapBindDN"
 	ldapSearchAttribute = "ldapSearchAttribute"
@@ -52,6 +52,8 @@ const (
 )
 
 var _ = Describe("testing the building of the ldap config string", func() {
+	ldapPassword := rand.String(12)
+
 	cluster := apiv1.Cluster{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      "configurationTest",