Repository navigation
chore(secrets): refresh .secrets.baseline line-number drift - #3700
PetrefiedThunder wants to merge 1 commit into
Conversation
…rity workflow on main)
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
No actionable comments were generated in the recent review.
 |
| Check name | Status | Explanation |
|---|---|---|
| Title check |  |
The title names the main change: refreshing the .secrets.baseline file to fix line-number drift. The raw summary confirms that the only changes are six updated line numbers and a new generated_at time… |
| Description check | |
The description covers the core of the change. It states the problem (Secrets Audit step fails on main with exit 3), the fix (baseline refreshed with detect-secrets 1.5.0 using the exact security.yml … |
| Docstring Coverage | |
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat… |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
Full details: Title check
-
Explanation
The title names the main change: refreshing the .secrets.baseline file to fix line-number drift. The raw summary confirms that the only changes are six updated line numbers and a new generated_at timestamp, so the title matches the changeset. It uses the conventional chore(secrets) prefix and is specific.
Full details: Description check
-
Explanation
The description covers the core of the change. It states the problem (Secrets Audit step fails on main with exit 3), the fix (baseline refreshed with detect-secrets 1.5.0 using the exact security.yml command), and the scope of the diff (6 line_number values plus generated_at, all 452 entries unchanged). The template's Summary, Type of Change, Test Plan, Checklist, and Related Issues sections are missing. The description also does not say which checklist item applies, such as the hardcoded-secrets check. These gaps are minor for a generated baseline refresh, so the description is mostly complete.
Full details: Docstring Coverage
-
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
PR Blocker ChecklistHead SHA: Status: Ready
|
|
Duplicate of #3703, closed per VS Code Lead; branch kept |
The security workflow's Secrets Audit step fails on main (exit 3: "The baseline file was updated") because baseline line numbers drifted; no new findings. Refreshed with detect-secrets 1.5.0 using the exact security.yml command (generated by Codex in a fresh temp clone, verified independently). Diff: 6 line_number values + generated_at only; all 452 entries unchanged.
Infra sweep 2026-10-28 ~4 AM PT.
Note
Low Risk
Metadata-only baseline refresh with no new or removed secret findings; no runtime or application code changes.
Overview
Updates
.secrets.baselineso the Secrets Audit step stops failing with “baseline file was updated” after unrelated edits shifted line numbers in a handful of test files. The refresh was done with detect-secrets 1.5.0, matching CI/pre-commit.Only six existing entries had their
line_numbermetadata adjusted (frontend session-origin, api-security JWT fixture, graph labels security test);hashed_secretvalues and the rest of the baseline are unchanged.generated_atwas bumped to the new scan time.Reviewed by Cursor Bugbot for commit 055b12f. Bugbot is set up for automated code reviews on this repo. Configure here.