Repository navigation
Preserve Dart and Kotlin source expressions during secret scrubbing - #38
Open
RKS (rksharma-owg) wants to merge 1 commit into
Open
RKS (rksharma-owg) wants to merge 1 commit into
RKS (rksharma-owg) wants to merge 1 commit into
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The round artifact scrubber treats Dart and Kotlin source files as ordinary artifacts because their extensions are missing from the existing source-file set. Harmless expressions such as
privateKey: this.privateKeyare consequently replaced in place and lose closing syntax.Add
.dart,.kt, and.ktsto the established source classification. Known secret values are still redacted in these files, while credential-pattern redaction remains enabled for ordinary artifacts. The release-identity configuration and shipped frontend artifacts are regenerated throughpython -m argus_skill.release_tools.build_release, as required by the source digest checks.Regression tests exercise actual temporary files with lowercase/uppercase extensions, Git-visible changes and ordinary directories, whole-file and streamed reads, CRLF preservation, known dummy secrets in source, and an
.envpositive control. All 24 new cases fail on the baseline due to source-expression corruption and pass with the fix.Validation includes the secret-guard and release tests, Ruff, the canonical release build and artifact checks, wheel packaging, web type-checking and both frontend test suites. Exact-commit fork validation covers the upstream Linux full suite, macOS/Windows portable checks, frontend checks and Windows unsigned desktop packaging; the Linux/macOS/frontend/desktop jobs and prescribed Windows portable checks plus new regressions passed. Linux ran 7,805 passing tests with 49 skips; Windows Rust core tests ran 31 passing tests and the unsigned installer build completed.
Additional diagnostics found three existing secret-guard failures on Windows and one Lean-worker timeout failure in the broader local macOS suite. The same failures reproduce on untouched baseline (Windows control); no tests or unrelated behavior are changed to conceal them. The entire secret-guard module is outside the upstream Windows portable test list; the new cases are additionally exercised there.
Fixes #31.