Deterministic full-history credential verification - #881
Conversation
Keep TruffleHog hard-failing provider-verified live credentials and source scan errors across full Git history while relying on mandatory Trivy and repository pattern scans for deterministic current-tree credential detection. Pin the policy and reviewed exclusion allowlist in workflow contract tests, and record complete pm-4ris regression evidence.
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
|
Warning Review limit reached
Next review available in: 28 seconds Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Repository UI (base), Organization UI (inherited) Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (5)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Reviewer's GuideAdjusts the security workflow’s TruffleHog configuration to treat only provider-verified live credentials as findings while failing on scan errors, and extends the CI workflow contract test to enforce the new configuration and the TruffleHog exclusion list for deterministic full-history credential verification. Flow diagram for updated CI security credential verificationflowchart TD
A[GitHubActions security job] --> B[Trivy deterministic current-tree scan]
B --> C[Repository pattern scans]
C --> D[TruffleHog scan --results=verified --fail-on-scan-errors]
D --> E{candidate secret}
E -->|provider verifies live| F[Mark verified credential and fail job]
E -->|provider timeout or network failure| G[No finding from provider check]
D --> H{scan error}
H -->|yes| F
H -->|no| I[Job succeeds]
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
@greptileai review @coderabbitai full review Please review exact head |
|
I will verify that the workflow:
✅ Action performedFull review finished. Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 10 minutes. |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've left some high level feedback:
- The CI contract test hard-codes the entire
.trufflehog-exclude-paths.txtcontents, which may be brittle as exclusions evolve; consider asserting a minimal required subset or sourcing the expected patterns from a shared constant to reduce maintenance overhead.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- The CI contract test hard-codes the entire `.trufflehog-exclude-paths.txt` contents, which may be brittle as exclusions evolve; consider asserting a minimal required subset or sourcing the expected patterns from a shared constant to reduce maintenance overhead.Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
|
Bot feedback acknowledgement on exact head
There are zero inline review threads and no actionable code finding from these artifacts. |
|
Greptile review limitation: the exact-head review was explicitly dispatched, but the free reviewer returned |
|
@coderabbitai review |
✅ Action performedReview finished.
|
|
CodeRabbit final retry acknowledgement: after the included-review window reopened, the explicit review completed on exact head |
|
Tracked in PM: pm-4ris. |
1 participant
Outcome
Fixes the scheduled full-history security regression discovered after #880: provider timeouts no longer turn ordinary PM hash-chain values into nondeterministic
unknownsecret failures. TruffleHog still scans all Git history and hard-fails provider-verified live credentials plus source scan errors. Deterministic current-tree credential detection remains mandatory through Trivy andpnpm security:scan.Project management
Verification
node scripts/run-tests.mjs test -- tests/integration/ci-workflow-contract.spec.ts— 12/12node scripts/run-tests.mjs coverage— 424 files, 6,773 tests, exact 100/100/100/100pnpm lint— ESLint and zero-clone jscpdpnpm quality:static— 100% docstrings plus SDK/package/token/context gatespnpm security:scan— no credential-like tracked valuespnpm changelog:pm:check— unchanged and current on pm-changelog 2026.8.3Historical report
Supersedes the false-positive scheduled failure in run 30798451130. The previously failing Windows nightly provenance test was independently fixed and is green on merged main #880.
Summary by Sourcery
Tighten the security CI workflow’s TruffleHog integration to keep full-history credential scans deterministic and aligned with documented exclusions.
Enhancements:
CI:
Tests:
Summary by cubic
Make full-history credential scanning deterministic by updating
trufflesecurity/trufflehogto fail on verified secrets and scan errors, not on unverifiable "unknown" results. This removes flaky scheduled failures from provider timeouts while keeping hard-fail on real credentials; current-tree detection stays enforced via Trivy andpnpm security:scan..github/workflows/security.ymlto use--results=verified --fail-on-scan-errors --exclude-paths=.trufflehog-exclude-paths.txtand keepfetch-depth: 0for scheduled full-history scans.tests/integration/ci-workflow-contract.spec.tsto pin these flags and the reviewed exclusion allowlist.Written for commit 4f096c0. Summary will update on new commits.