sanitize: allowlist Cursor Agent Co-authored-by trailer - #43
Conversation
After #42, --history still fails one remaining HISTORY_META deny on 167ba40: the merge-commit Cursor Agent cursor.com Co-authored-by trailer. PUBLIC_HISTORY_METADATA_LINES already has the bare identity and the John Osumi Co-authored-by form. Add the missing exact trailer. Does not change the scanner, skip --history, or broaden beyond this line. Co-authored-by: John Osumi <sumitake@users.noreply.github.com>
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
You have reached your Codex usage limits for security reviews. Please try again later. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 642ab6e921
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "@cursor.com>", | ||
| ) | ||
| ), | ||
| "".join(("Co-authored-by: Cursor Agent <cursoragent", "@cursor.com>")), |
There was a problem hiding this comment.
On the push, schedule, and manual contexts inspected in .github/workflows/sanitization.yml, this addition still cannot make --tracked --history pass for the reviewed commit: _scan_public_history_metadata compares the complete finding line against this exact string, while commit 7999348c has the unallowlisted author/committer Codex <codex@openai.com>, backtick-wrapped and composite body lines containing the Cursor address, and a footer UUID. Directly scanning its metadata produces six HISTORY_META findings, so the push-time sanitization job remains broken even though the test plan passed against the different 642ab6e commit; recreate the commit with scan-clean metadata or explicitly handle every intended literal.
Useful? React with 👍 / 👎.
2 participants
Summary
After #42, Sanitization
--history(run 33207270005) cleared the original six denies. It now fails only the merge-commit trailer on167ba403:Co-authored-by: Cursor Agent <cursoragent@cursor.com>PUBLIC_HISTORY_METADATA_LINESalready has the bare identityCursor Agent <cursoragent@cursor.com>andCo-authored-by: John Osumi <sumitake@users.noreply.github.com>. This adds the missing exact trailer, written the same way as the existing entries (the@is split so the file itself does not trip the scanner).Does not revert #42. Does not change the scanner. Does not skip
--history. Does not broaden the allowlist beyond this one line.Test plan
python3 -m unittest tests.sanitization.test_sanitize_public.H10History.test_public_history_metadata_allowance_is_literal_and_closedpassespython3 -m unittest discover -s tests -p 'test_*.py'passes (290 tests)python3 scripts/sanitize_public.py --trackedreportssanitization passedpython3 scripts/sanitize_public.py --tracked --historyreportssanitization passedPUBLIC_HISTORY_METADATA_LINESmember; no extra machineryPUBLIC-SAFETY checklist
owner/repository,example-fleet,operator@example.invalid).python3 scripts/sanitize_public.py --trackedlocally and it reportedsanitization passed.python3 scripts/check_repository_metadata.pylocally (if this PR touches governance/repository metadata) and it exited 0.Governance metadata was not touched;
check_repository_metadata.pyis N/A.Additional context
The allowlist entry is the exact body line that
--historynow denies. Same existing_scan_public_history_metadatafunction.Local verification on
642ab6e9215ee0edad21a901f408dfa2a21e8639:--trackedand--tracked --historyboth printsanitization passed