fix: add remaining nosemgrep comments and fix PII log

Author: emjay0921

spp_attachment_av_scan/models/ir_attachment.py

@@ -531,8 +531,8 @@ def action_download_quarantined_for_analysis(self):
                 )
 
             download_attachment = (
-                self.env["ir.attachment"]
-                .sudo()  # nosemgrep
+                self.env["ir.attachment"]  # nosemgrep
+                .sudo()
                 .with_context(skip_av_scan_queue=True)
                 .create(
                     {

spp_farmer_registry_demo/models/farmer_demo_generator.py

@@ -648,7 +648,7 @@ def _create_farm(
         is_female=False,
     ):
         """Create a farm with the given attributes."""
-        Partner = self.env["res.partner"].sudo()  # nosemgrep: semgrep.odoo-sudo-on-sensitive-models
+        Partner = self.env["res.partner"].sudo()  # nosemgrep
 
         farm_vals = {
             "name": name,
@@ -886,7 +886,7 @@ def _create_cooperatives(self, story_farms):
         Returns:
             dict: cooperative_id -> cooperative (res.partner)
         """
-        Partner = self.env["res.partner"].sudo()  # nosemgrep: semgrep.odoo-sudo-on-sensitive-models
+        Partner = self.env["res.partner"].sudo()  # nosemgrep
         Membership = self.env["spp.group.membership"].sudo()  # nosemgrep
 
         # Get or create the "cooperative" group type vocabulary code
@@ -2041,7 +2041,7 @@ def _create_single_change_request(self, registrant, cr_def, stats):
                 target_state,
                 cr_record.id,
                 cr_type_code,
-                registrant.name,
+                registrant.id,
             )
             return cr_record
 
@@ -2053,22 +2053,22 @@ def _set_cr_state(self, cr_record, target_state, apply=False, rejection_reason=N
         """Transition CR to target state using approval workflow."""
         try:
             if target_state == "pending":
-                cr_record.sudo().action_submit_for_approval()
+                cr_record.sudo().action_submit_for_approval()  # nosemgrep
             elif target_state == "approved":
-                cr_record.sudo().action_submit_for_approval()
-                cr_record.sudo().action_approve()
+                cr_record.sudo().action_submit_for_approval()  # nosemgrep
+                cr_record.sudo().action_approve()  # nosemgrep
             elif target_state == "rejected":
-                cr_record.sudo().action_submit_for_approval()
+                cr_record.sudo().action_submit_for_approval()  # nosemgrep
                 if hasattr(cr_record, "action_reject"):
-                    cr_record.sudo().action_reject()
+                    cr_record.sudo().action_reject()  # nosemgrep
                 if rejection_reason and "rejection_reason" in cr_record._fields:
-                    cr_record.sudo().write({"rejection_reason": rejection_reason})
+                    cr_record.sudo().write({"rejection_reason": rejection_reason})  # nosemgrep
             elif target_state == "revision":
-                cr_record.sudo().action_submit_for_approval()
+                cr_record.sudo().action_submit_for_approval()  # nosemgrep
                 if hasattr(cr_record, "action_request_revision"):
-                    cr_record.sudo().action_request_revision()
+                    cr_record.sudo().action_request_revision()  # nosemgrep
                 if revision_notes and "revision_notes" in cr_record._fields:
-                    cr_record.sudo().write({"revision_notes": revision_notes})
+                    cr_record.sudo().write({"revision_notes": revision_notes})  # nosemgrep
 
         except Exception as e:
             _logger.warning(
@@ -2082,14 +2082,14 @@ def _set_cr_state(self, cr_record, target_state, apply=False, rejection_reason=N
         # Always advance stage past "details" for non-draft CRs so the JS
         # openRecord router uses the review form instead of the old main form.
         if target_state != "draft" and "stage" in cr_record._fields:
-            cr_record.sudo().write({"stage": "review"})
+            cr_record.sudo().write({"stage": "review"})  # nosemgrep
 
         if apply:
             try:
-                cr_record.sudo().action_apply()
+                cr_record.sudo().action_apply()  # nosemgrep
             except Exception as e:
                 _logger.warning("Apply failed, setting flags directly: %s", e)
-                cr_record.sudo().write(
+                cr_record.sudo().write(  # nosemgrep
                     {
                         "approval_state": "approved",
                         "is_applied": True,
@@ -2261,7 +2261,7 @@ def _generate_blueprint_farms(self):
 
     def _get_vocab_code(self, namespace_uri, code):
         """Get a vocabulary code ID by namespace and code."""
-        VocabCode = self.env["spp.vocabulary.code"].sudo()
+        VocabCode = self.env["spp.vocabulary.code"].sudo()  # nosemgrep
         vocab = VocabCode.search(
             [("namespace_uri", "=", namespace_uri), ("code", "=", code)],
             limit=1,