sanitize: allowlist six pre-existing history-scan denies - #42
Merged
Conversation
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
The push/schedule sanitizer (--tracked --history) already failed these six deterministic findings on d880c0f and still fails them on the PR #41 pin bump. Tracked scan is clean; this does not change the scanner, skip --history, or broaden beyond the six denies. Add history-blob allowlist entries for cmd/portable-ghar-runtime-lock/main_test.go@99d55b0de82a227bcfd52f4b9ca64130db9c4338 lines 43 (DEPLOYID002), 53 (URI001), and 74 (DEPLOYID002), matching the existing @504a9c865eb35654def0a297c05c2b3b25b80895 exceptions. The flagged lines are byte-identical; hashes were computed with the scanner's own line hasher against the full blob OID. Add the Cursor Agent cursor.com identity and the unprefixed users.noreply.github.com co-author form to PUBLIC_HISTORY_METADATA_LINES. Keep the existing GitHub-id form. Co-authored-by: John Osumi <sumitake@users.noreply.github.com>
cursor
Bot
force-pushed
the
cursor/sanitize-history-allowlist-bf52
branch
from
August 28, 2026 15:03
7351487 to
940f6f7
Compare
sumitake
marked this pull request as ready for review
August 28, 2026 15:04
|
You have reached your Codex usage limits for security reviews. Please try again later. |
10 tasks
sumitake
added a commit
that referenced
this pull request
Aug 31, 2026
After #42, --history still fails one remaining HISTORY_META deny on 167ba40: the merge-commit Cursor Agent cursor.com Co-authored-by trailer. PUBLIC_HISTORY_METADATA_LINES already has the bare identity and the John Osumi Co-authored-by form. Add the missing exact trailer. Does not change the scanner, skip --history, or broaden beyond this line. Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: John Osumi <sumitake@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Sanitization on push to
mainfails in Sanitize history and metadata (python3 scripts/sanitize_public.py --tracked --history). Tracked scan already passes. The same six deterministic denies already failed ond880c0f0; they are pre-existing and were not introduced by PR #41.This PR does not revert PR #41, does not change the scanner, and does not skip
--history. It only allowlists the six quoted findings.History-blob entries for
cmd/portable-ghar-runtime-lock/main_test.go@99d55b0de82a227bcfd52f4b9ca64130db9c4338lines 43 (DEPLOYID002), 53 (URI001), and 74 (DEPLOYID002). Same class and schema as the existing@504a9c865eb35654def0a297c05c2b3b25b80895entries. Line hashes were computed with the scanner's own hasher against the full blob; they match the existing sibling entries because the flagged lines are byte-identical.Two identities added to
PUBLIC_HISTORY_METADATA_LINESinscripts/sanitize_public.py:users.noreply.github.comco-author formThe existing GitHub-id form is unchanged. Entries are written with the existing
"".join((..., "@domain"))split so the scanner does not flag the table itself.Head:
940f6f7b0b10d729c00bcb80613a9138e3f2bd6don12f6cd32ae0830a3c95217dca381122eed4827e5.Test plan
python3 -m unittest tests.sanitization.test_sanitize_public— 121 tests, 0 failurespython3 -m unittest discover -s tests -p 'test_*.py'— 290 tests, 0 failurespython3 scripts/sanitize_public.py --tracked—sanitization passedpython3 scripts/sanitize_public.py --tracked --history—sanitization passed(this is the failing push step)--historyskip changes. Allowlist growth is the three history-blob rows plus the two metadata identities.Existing table test iterates
PUBLIC_HISTORY_METADATA_LINES; no new tests were added because that test is not a hardcoded expected-set.PUBLIC-SAFETY checklist
owner/repository,example-fleet,operator@example.invalid).python3 scripts/sanitize_public.py --trackedlocally and it reportedsanitization passed.python3 scripts/check_repository_metadata.pylocally (if this PR touches governance/repository metadata) and it exited 0.Governance/repository metadata is untouched, so the metadata script is N/A.
Additional context
The UUID/userinfo findings are historical copies of the already-inspected synthetic GitHub release-asset fixture in
cmd/portable-ghar-runtime-lock/main_test.go. The HISTORY_META findings come from commit7fec2d93(Cursor Agent author/committer and the unprefixed co-author trailer).Do not merge from this agent.