test(security): remove secret-like redaction fixture literals - #1997
test(security): remove secret-like redaction fixture literals#1997seonghobae wants to merge 2 commits into
Conversation
|
Warning Review limit reachedNext included review available in 57 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
seonghobae
added
priority: high
ChatGPT Codex Connector
|
Exact-head verification receipt for
Fresh hosted state is non-terminal: |
|
DESIGN ASSURANCE exact-head admission — The bounded fixture repair preserves runtime redaction semantics and introduces no suppression, but this head is not merge-ready. Fresh hosted evidence is terminal failure for Keep the valid one-file delta and treat the Noema outcome as substantive fail-closed review evidence, not a transient success. Repair or obtain a new exact-head verdict that either removes the confirmed issue or returns CHANGES_REQUESTED consistently; then require terminal CodeQL/coverage/OpenCode and independent review before Ready/ordinary merge. |
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
41e5be557c9587545203a10bb301d7ebd0de9ba2. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- CodeQL PR/CodeQL compatibility analysis (actions): FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/34079059969/job/101622071973)
- CodeQL PR/CodeQL compatibility analysis (python): FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/34079059969/job/101622072014)
- CodeQL compatibility analysis (actions) check run: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/34079059969/job/101622071973)
- CodeQL compatibility analysis (python) check run: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/34079059969/job/101622072014)
- Required Noema Review/noema-review: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/34079060227/job/101622121441)
- noema-review check run: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/34079060227/job/101622121441)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Test: test_redact_sensitive_log_json_array.py"]
S1 --> I1["regression suite"]
I1 --> R1["Review risk: Test: test_redact_sensitive_log_json_array.py"]
R1 --> V1["targeted test run"]
OpenCode Review Overview
|
Preserve protected main@7fd571db and the one-path #1997 secret-shaped fixture repair without force-push or destructive rebase.
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
6f855db7b546ebd5dda4d4e7cf8b35eb0a8dd80a. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- CodeQL PR/CodeQL compatibility analysis (actions): FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/34183268416/job/101949137410)
- CodeQL compatibility analysis (actions) check run: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/34183268416/job/101949137410)
- Required Noema Review/noema-review: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/34183266384/job/101929180282)
- noema-review check run: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/34183266384/job/101929180282)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Test: test_redact_sensitive_log_json_array.py"]
S1 --> I1["regression suite"]
I1 --> R1["Review risk: Test: test_redact_sensitive_log_json_array.py"]
R1 --> V1["targeted test run"]
1 participant
Root cause
GitHub Advanced Security review on #1995 flagged two literal
secret123456789fixtures intests/test_redact_sensitive_log_json_array.pyas Generic API Keys (alerts 445 and 446). These are synthetic redaction inputs, but keeping scanner-shaped literals in protected source creates recurring review/check noise and obscures real secret findings.Repair
The two tests now construct the exact same runtime input from two non-secret-like literal segments. Redaction semantics and expected output are unchanged; only the static source representation changes. No allowlist, scanner suppression, production-path change, or secret masking bypass is introduced.
Exact-head evidence
A non-force two-parent reconciliation commit
6f855db7b546ebd5dda4d4e7cf8b35eb0a8dd80aadopts protectedmain@7fd571dbcdbae6acf29d8f4ee704d7ba6297e4dbwhile preserving #1997's only semantic delta intests/test_redact_sensitive_log_json_array.py. The effective protected-main-relative diff remains one file: the same runtime redaction values are assembled from non-secret-shaped literal segments.All predecessor workflow results belong to
41e5be557c9587545203a10bb301d7ebd0de9ba2and are not transferred. Hosted Checks and independent review for exact6f855db7b546ebd5dda4d4e7cf8b35eb0a8dd80aare newly required and non-passing until terminal.Ready admits current-head review; it is not merge, approval, release, or hosted-GREEN evidence. Terminal CodeQL and a qualifying independent review remain merge gates, not Ready prerequisites. After protected-main integration, #1725 must preserve this fix through its normal successor chain. No allowlist, bypass, self-approval, force update, no-op retrigger, or predecessor-evidence transfer is authorized.