From ef689f9fe4c0b55aece1e394a29475c96e32c06d Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 30 Aug 2026 16:42:50 +0900 Subject: [PATCH 1/2] fix(edge): skip binary assets in Pingora policy scan Signed-off-by: Seongho Bae --- scripts/ci/pingora_edge_policy.py | 12 ++++++++++++ tests/test_pingora_edge_policy.py | 3 +++ 2 files changed, 15 insertions(+) diff --git a/scripts/ci/pingora_edge_policy.py b/scripts/ci/pingora_edge_policy.py index 706fe69fc1..bf8f5bd426 100644 --- a/scripts/ci/pingora_edge_policy.py +++ b/scripts/ci/pingora_edge_policy.py @@ -29,6 +29,16 @@ GITHUB_API_ORIGIN = "https://api.github.com" DOCUMENT_SUFFIXES = frozenset({".md", ".mdx", ".rst", ".adoc", ".txt"}) +NON_RUNTIME_BINARY_SUFFIXES = frozenset({ + ".avif", + ".gif", + ".ico", + ".jpeg", + ".jpg", + ".pdf", + ".png", + ".webp", +}) SOURCE_TEST_SUFFIXES = frozenset({".py", ".pyi", ".js", ".mjs", ".cjs", ".ts", ".tsx", ".rs"}) LICENSE_NAMES = frozenset({"license", "license.md", "copying", "copyrights", "notice"}) DOCUMENTATION_DIRECTORIES = frozenset({"doc", "docs", "documentation"}) @@ -305,6 +315,8 @@ def _needs_content_scan(changed: ChangedFile) -> bool: if changed.status == "removed" or _is_documentation_or_source_fixture(changed.path): return False + if PurePosixPath(changed.path.lower()).suffix in NON_RUNTIME_BINARY_SUFFIXES: + return False if not changed.patch_available: return True if _runtime_path_rule(changed.path) is not None: diff --git a/tests/test_pingora_edge_policy.py b/tests/test_pingora_edge_policy.py index 584e540749..898e692c53 100644 --- a/tests/test_pingora_edge_policy.py +++ b/tests/test_pingora_edge_policy.py @@ -109,6 +109,9 @@ def test_needs_content_scan_is_delta_bounded() -> None: changed = policy.ChangedFile assert not policy._needs_content_scan(changed("Dockerfile", "removed", "+FROM nginx")) assert not policy._needs_content_scan(changed("README.md", "modified", "+nginx")) + assert not policy._needs_content_scan( + changed("docs/screenshots/edge.png", "added", "", patch_available=False) + ) assert policy._needs_content_scan(changed("Dockerfile", "modified", "-FROM nginx\n+FROM scratch")) assert policy._needs_content_scan(changed("config/runtime.txt", "modified", "+FROM nginx")) assert policy._needs_content_scan(changed("infra/nginx/default.yaml", "modified", "+server: edge")) From 34705429f1386fb07da955e6595bcfdbd8387212 Mon Sep 17 00:00:00 2001 From: Claude Date: Sun, 30 Aug 2026 09:56:08 +0000 Subject: [PATCH 2/2] fix(pingora): scan Nginx runtime paths before the binary-suffix exemption MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Devin flagged an unresolved finding on PR #1427: _needs_content_scan checked the new NON_RUNTIME_BINARY_SUFFIXES exemption before the path-based _runtime_path_rule check, so a real Nginx runtime artifact (e.g. anything under an "nginx" directory) named with one of the exempted binary suffixes would skip the fail-closed scan entirely on extension alone. Reorder so the path-based rule runs first — it needs only the path, not patch content, so moving it earlier is free — and add a regression covering both an nginx-directory .png/.pdf (must scan) and a genuinely non-runtime doc screenshot (still exempt). --- scripts/ci/pingora_edge_policy.py | 8 ++++++-- tests/test_pingora_edge_policy.py | 23 +++++++++++++++++++++++ 2 files changed, 29 insertions(+), 2 deletions(-) diff --git a/scripts/ci/pingora_edge_policy.py b/scripts/ci/pingora_edge_policy.py index bf8f5bd426..24f657daa8 100644 --- a/scripts/ci/pingora_edge_policy.py +++ b/scripts/ci/pingora_edge_policy.py @@ -315,12 +315,16 @@ def _needs_content_scan(changed: ChangedFile) -> bool: if changed.status == "removed" or _is_documentation_or_source_fixture(changed.path): return False + # Path-based runtime detection must run before the binary-suffix exemption + # below: a file under an Nginx runtime path (e.g. an "nginx" directory) is + # a scan candidate regardless of its extension, so a real config cannot + # dodge the fail-closed policy just by being named "config.png". + if _runtime_path_rule(changed.path) is not None: + return True if PurePosixPath(changed.path.lower()).suffix in NON_RUNTIME_BINARY_SUFFIXES: return False if not changed.patch_available: return True - if _runtime_path_rule(changed.path) is not None: - return True lower_path = changed.path.lower() if PurePosixPath(lower_path).name in {"dockerfile", "containerfile", "docker-compose.yml", "docker-compose.yaml", "compose.yml", "compose.yaml"}: return True diff --git a/tests/test_pingora_edge_policy.py b/tests/test_pingora_edge_policy.py index 898e692c53..7720e359e1 100644 --- a/tests/test_pingora_edge_policy.py +++ b/tests/test_pingora_edge_policy.py @@ -128,6 +128,29 @@ def test_needs_content_scan_is_delta_bounded() -> None: assert not policy._needs_content_scan(changed("src/runtime.go", "modified", "+exec pingora")) +def test_binary_suffix_exemption_never_overrides_an_nginx_runtime_path() -> None: + """A runtime-path match takes precedence over the binary-suffix exemption. + + Filename extension alone cannot prove a file is inert: an Nginx runtime + artifact named with a suffix from ``NON_RUNTIME_BINARY_SUFFIXES`` (e.g. a + config mistakenly or adversarially named ``*.png``) must still scan, or + the exemption added for legitimate doc screenshots would let a real + runtime artifact dodge the fail-closed policy just by its extension. + """ + + changed = policy.ChangedFile + assert policy._needs_content_scan( + changed("infra/nginx/screenshot.png", "added", "", patch_available=False) + ) + assert policy._needs_content_scan( + changed("infra/nginx/evidence.pdf", "added", "", patch_available=False) + ) + # The exemption still applies to a genuinely non-runtime binary path. + assert not policy._needs_content_scan( + changed("docs/screenshots/edge.pdf", "added", "", patch_available=False) + ) + + def test_active_test_source_is_scanned_while_dedicated_fixtures_are_exempt() -> None: """Executable test helpers remain candidates; only explicit fixtures are exempt."""