📝 Description

This PR ensures that the following (false positive, see related Jira ticket) vulnerability https://github.com/mlrun/mlrun/security/code-scanning/135 will not happen. It will raise a runtimeError if changed.

The PR ensures that for adding source with kind="file", you need to be outside of the API to ensure you're not opening files inside it.

🛠️ Changes Made

• Changed the add_source() function to raise an error if kind=file and running inside the api

✅ Checklist

• I updated the documentation (if applicable)
• I have tested the changes in this PR
• If I introduced a deprecation:
  • I followed the Deprecation Guidelines
  • I updated the relevant Jira ticket for documentation

🧪 Testing

Manual test that helper function is correct, and that the flow that reach add_source do not enter kind=file when running from the API

🔗 References

• Ticket link: https://iguazio.atlassian.net/browse/ML-11249
• Design docs links:
• External links:

🚨 Breaking Changes?

• Yes (explain below)
• No

🔍️ Additional Notes