chore(secrets): refresh .secrets.baseline line-number drift by PetrefiedThunder · Pull Request #3703 · regengine/RegEngine

PetrefiedThunder · 2026-10-28T11:39:31Z

Summary

Main's Secrets Audit (detect-secrets) job in .github/workflows/security.yml fails with exit 3 (The baseline file was updated) when .secrets.baseline line numbers drift. That job runs detect-secrets-hook (not scripts/ci/check_secrets_baseline.sh, which treats exit 3 as OK).

Refreshed with detect-secrets==1.5.0 using the same flags as CI:

detect-secrets-hook --baseline .secrets.baseline \
  --exclude-files '.*\.lock$' \
  --exclude-files '.*package-lock\.json$' \
  --exclude-files '\.secrets\.baseline$' \
  $(git ls-files)

Audit of baseline delta (no secret values)

Change	Count
Total findings before/after	452 / 452
New findings	0
Removed findings	0
Line-number drift only	6
`generated_at`	bumped

Line-number drift (existing hashed entries, test fixtures only)

File	Type	Lines
`frontend/src/__tests__/api/session-origin.test.ts`	Secret Keyword	250→251, 275→276, 304→305, 331→332
`frontend/src/test/security/api-security.test.ts`	JSON Web Token	133→148
`services/graph/tests/test_labels_security.py`	Secret Keyword	205→272

No new baseline entries. Diff is baseline-only.

Note

Overlaps open #3700 (chore/secrets-baseline-refresh-2026-10-28). This PR is the Lead-requested muse/secrets-baseline-refresh branch; close one as duplicate after merge.

Verification

Local post-commit: detect-secrets-hook (CI command) exits 0; scripts/ci/check_secrets_baseline.sh exits 0.
Secrets Audit is skipped on PRs (if: github.event_name != 'pull_request'); it will run on the merge push to main.

Reviewer: Hermes (or other non-muse engine).

Note

Low Risk
Metadata-only baseline refresh with unchanged secret hashes; no runtime or security logic changes.

Overview
Updates .secrets.baseline so main’s Secrets Audit (detect-secrets-hook in security.yml) stops failing with exit 3 when stored line numbers no longer match the repo.

The diff is baseline-only: generated_at is bumped, and six existing allowlisted findings (same hashed_secret values) get corrected line numbers in test fixtures—session-origin.test.ts (four entries), api-security.test.ts (JWT), and test_labels_security.py. No new or removed findings; total count stays 452.

^{Reviewed by Cursor Bugbot for commit 0b430d2. Bugbot is set up for automated code reviews on this repo. Configure here.}

Secrets Audit (detect-secrets 1.5.0) fails on main with exit 3 when baseline line numbers drift. No new or removed findings (452 unchanged); six test-fixture entries shifted lines; generated_at bumped. Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com>

vercel · 2026-10-28T11:39:33Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
regengine	Ready	Preview	Oct 28, 2026 11:41am UTC

chatgpt-codex-connector · 2026-10-28T11:39:47Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-28T11:40:41.339015Z	`0b430d2`	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

coderabbitai · 2026-10-28T11:40:07Z

No actionable comments were generated in the recent review.

Recent review info

Run configuration

Source mode: Auto
Repository: regengine/RegEngine
Branch: muse/secrets-baseline-refresh
File: .coderabbit.yaml
Commit: 0b430d2
Layers: Repository YAML
Review profile: ASSERTIVE
Plan: Advanced
Run ID: c3a58e21-a1f4-418d-be4d-08e9cb56efe4

Commits

Reviewing files that changed from the base of the PR and between 8548c09 and 0b430d2.

Files selected for processing: 1

.secrets.baseline

Limit details: You’ve used all 10 included reviews currently available.

Walkthrough

The secrets baseline now records updated finding line numbers for three test files. The baseline generation timestamp changed from October 26 to October 28, 2026.

Priority: Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Merge Risk: Minimal · up to 0b430

This refreshes recorded line numbers and the timestamp in the secrets baseline. It does not change runtime behavior. The recorded locations match the source, so merge risk is minimal.

Architecture risk: Low · up to 0b430

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

observed — Modified behavior in .secrets.baseline: Updated the four recorded finding line numbers in frontend/src/__tests__/api/session-origin.test.ts from 250, 275, 304, and 331 to 251, 276, 305, and 332.
observed — Modified behavior in .secrets.baseline: Updated the recorded finding line number in frontend/src/test/security/api-security.test.ts from 133 to 148.
observed — Modified behavior in .secrets.baseline: Updated the recorded finding line number in services/graph/tests/test_labels_security.py from 205 to 272.
observed — Modified behavior in .secrets.baseline: Changed the baseline generation timestamp from 2026-10-26T14:49:21Z to 2026-10-28T11:32:08Z.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly identifies the baseline refresh and the line-number drift it addresses.
Description check		The description provides a detailed summary, verification results, change classification, risk context, and related issue information. It does not use every template checkbox, but it contains the requ…
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description provides a detailed summary, verification results, change classification, risk context, and related issue information. It does not use every template checkbox, but it contains the required decision-making context.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Finishing Touches

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Usage-based review receipt

Mode: Continue automatically
Reviewed files: 1
Waived: $0.25 (charged $0.00)
View usage details

Note

This review exceeded your plan’s limits and used usage-based reviews—free during trial, billed after paid activation unless disabled. Manage usage-based reviews.

_{Comment @coderabbitai help to get the list of available commands.}

PetrefiedThunder · 2026-10-28T11:47:48Z

REVIEW: PASS claude 0b430d2

Verified Muse baseline refresh (structure-only; no secret values or hashes in this comment):

Diff touches only .secrets.baseline (+7/−7)
Findings 452→452; 0 added / 0 removed keyed by (filename, type, hashed_secret)
Exactly 6 line_number drifts; is_verified unchanged; plugins_used (27) and filters_used (13) identical; version 1.5.0 unchanged; generated_at bumped only (no exclusion widening)
Drift files are existing test fixtures; shifts match main code since prior baseline:
- frontend/src/__tests__/api/session-origin.test.ts Secret Keyword: 250→251, 275→276, 304→305, 331→332 (+1 from fix(frontend): QA signal timeout copy and ingest/integrations timeouts (SEL-414) #3622)
- frontend/src/test/security/api-security.test.ts JSON Web Token: 133→148 (fix(security): URL host checks and key-file emission (code-scanning batch 3) #3695)
- services/graph/tests/test_labels_security.py Secret Keyword: 205→272 (+67 from feat(labels): landing page for scanned label QR codes #3685)
Local CI-equivalent detect-secrets-hook exit 0; scripts/ci/check_secrets_baseline.sh exit 0
Note: GitHub check Secrets Audit (detect-secrets) is skipped on pull_request by design and will run on merge to main

github-actions · 2026-10-28T12:48:45Z

PR Blocker Checklist

Head SHA: 0b430d2822a7ff070bfd6e35ee95ef053e7fd507

Status: Ready

All review threads resolved
No reviews requesting changes
No blocked review engines

vercel Bot deployed to Preview October 28, 2026 11:41

View deployment

PetrefiedThunder mentioned this pull request Oct 28, 2026

fix(health): fail readiness on essential worker/scheduler errors (E07) #3704

Merged

PetrefiedThunder merged commit 5bb0b33 into main Oct 28, 2026
49 of 52 checks passed

PetrefiedThunder deleted the muse/secrets-baseline-refresh branch October 28, 2026 13:23

PetrefiedThunder mentioned this pull request Oct 28, 2026

chore(secrets): refresh .secrets.baseline line-number drift #3700

Closed

Navigation Menu

Repository navigation

chore(secrets): refresh .secrets.baseline line-number drift - #3703

chore(secrets): refresh .secrets.baseline line-number drift#3703
PetrefiedThunder merged 1 commit into
mainfrom
muse/secrets-baseline-refresh

PetrefiedThunder commented Oct 28, 2026 •

edited by cursor Bot

Loading

Uh oh!

vercel Bot commented Oct 28, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Oct 28, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 28, 2026 •

edited

Loading

Uh oh!

PetrefiedThunder commented Oct 28, 2026

Uh oh!

github-actions Bot commented Oct 28, 2026

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

PetrefiedThunder commented Oct 28, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Audit of baseline delta (no secret values)

Line-number drift (existing hashed entries, test fixtures only)

Note

Verification

Uh oh!

vercel Bot commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

coderabbitai Bot commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Usage-based review receipt

Uh oh!

PetrefiedThunder commented Oct 28, 2026

Uh oh!

github-actions Bot commented Oct 28, 2026

PR Blocker Checklist

Status: Ready

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

PetrefiedThunder commented Oct 28, 2026 •

edited by cursor Bot

Loading

vercel Bot commented Oct 28, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 28, 2026 •

edited

Loading

coderabbitai Bot commented Oct 28, 2026 •

edited

Loading