Skip to content

Fix: [for cherry-picking] Credential and private-key rules now bypass l #65

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
qodo-code-review wants to merge 1 commit into from
Closed

Fix: [for cherry-picking] Credential and private-key rules now bypass l #65

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 12 additions & 3 deletions scripts/public-repo-guard/body-policy.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,10 +49,19 @@ check() {
# Filter with rg, not grep: BSD/macOS grep has no -P, so a `grep -P` allowlist
# silently errors out locally while working on GNU/CI — the gate would then
# disagree with itself depending on where it ran. rg is already required above.
# Credential and private-key formats are never allowlisted: a real secret must
# still block even when it appears in a policy example or an exempt line.
local matches
matches="$(printf '%s' "$raw" \
| rg -vN -- 'guard:allow[[:space:]]+[^[:space:]]' \
| rg -vNiP -- "$ABOUT_THE_CONTROL" || true)"
case "$name" in
stripe-live-key|stripe-account|anthropic-key|github-pat|supabase-pat|aws-akid|private-key)
matches="$raw"
;;
*)
matches="$(printf '%s' "$raw" \
| rg -vN -- 'guard:allow[[:space:]]+[^[:space:]]' \
| rg -vNiP -- "$ABOUT_THE_CONTROL" || true)"
;;
esac
Comment on lines +52 to +64

@devin-ai-integration devin-ai-integration Bot Aug 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔍 Body gate now diverges from the tree gate on credential allowlisting

scripts/public-repo-guard/content-policy.sh:56-60 still lets # guard:allow <reason> suppress its credential rules (stripe-live-key, stripe-account). After this change the two halves of the same gate disagree: the same credential-shaped string is exemptible in a committed file but unconditionally blocking in a PR body. If the intent is "a real secret always blocks", the tree scanner deserves the same treatment; otherwise the divergence should be documented so operators know which surface enforces which policy.

Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

[[ -z "$matches" ]] && return 0
local count; count="$(printf '%s\n' "$matches" | grep -c '')"
# Print the LINE NUMBER only — never the matched text. This annotation is itself
Expand Down
2 changes: 2 additions & 0 deletions scripts/public-repo-guard/tests/body-policy.test.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,8 @@ expect 1 'internal-only marker' \
AKID_FIXTURE="AKI""A1234567890ABCDEF"
expect 1 'AWS access key id' \
"The failing job had ${AKID_FIXTURE} configured."
expect 1 'allowlisted AWS access key id still blocks' \
"Example key: ${AKID_FIXTURE} — guard:allow documented-example"
expect 1 'internal tailscale IP' \
'It resolves to 100.71.4.19 from inside the fleet.'

Expand Down
Loading