fix(ci): verify release tag secret-scan ranges - #4808
Merged
Conversation
On the `v2.1.0-rc.2` tag, Core and REST both reported clean secret scans, but neither checked the release range we meant. Core scanned about 23.9 MB of open-ended history because it had no head, while REST scanned zero bytes because it had neither a base nor a head. So, use the shared scan-range resolver for tags too. It finds the closest tag behind the release commit on its first-parent history, then gives both scanners that exact base plus the current tag commit. Pull request behavior stays the same, and main/manual runs are unchanged. Expected green-run effect: no reliable full-pipeline savings. Core avoids its observed open-ended scan, while REST intentionally does real work instead of zero. What it really buys us: a green release-tag check from either workflow means both scanners were given the same known commit range. This supports NVIDIA#4806 Signed-off-by: Chet Nichols III <chetn@nvidia.com>
Contributor
Summary by CodeRabbit
WalkthroughThe PR replaces the PR-only scan-range resolver with a shared resolver. The resolver supports pull requests and release tags, validates refs and SHAs, rejects empty ranges, and integrates with Core and REST TruffleHog workflows. ChangesSecret-scan range resolution
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant CIWorkflow
participant SecretScanResolver
participant GitHubAPI
participant GitRepository
CIWorkflow->>SecretScanResolver: provide workflow ref and commit SHA
SecretScanResolver->>GitHubAPI: retrieve pull-request base SHA
GitHubAPI-->>SecretScanResolver: return base SHA
SecretScanResolver->>GitRepository: compute merge base or previous release tag
GitRepository-->>SecretScanResolver: return resolved base commit
SecretScanResolver-->>CIWorkflow: emit base and head SHAs
Possibly related issues
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Contributor
Author
|
@coderabbitai full_review, thanks! |
Contributor
|
🐇 ✅ Action performedFull review finished. |
🔐 TruffleHog Secret Scan✅ No secrets or credentials found! Your code has been scanned for 700+ types of secrets and credentials. All clear! 🎉 🕐 Last updated: 2026-08-11 02:51:51 UTC | Commit: 608a7fc |
nv-dmendoza
approved these changes
Aug 11, 2026
| - name: Compute TruffleHog scan range | ||
| id: scan-range | ||
| if: startsWith(github.ref, 'refs/heads/pull-request/') | ||
| if: startsWith(github.ref, 'refs/heads/pull-request/') || (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')) |
Collaborator
There was a problem hiding this comment.
isn't triggering on just startsWith tags enough?
Contributor
Author
There was a problem hiding this comment.
Oh yeah so workflow_dispatch can also be launched against a tag, so checking only startsWith(github.ref, 'refs/tags/') would change manually run behavior(s) too. The github.event_name == 'push' guard keeps it scoped to actual release tag pushes, and leaves manual runs unchanged. This is probably a good place for a comment or something, haha.
10 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This follows #4715 and #4788 by using the same shared resolver for tags (for both Core and REST), finding the closest tag behind the release commit on its first-parent history, and giving both secret scanners that exact base plus the current tag commit. Pull request behavior stays the same, and main/manual runs are unchanged.
Related issues
This supports #4806
Type of Change
Breaking Changes
Testing
Unit tests added/updated
Integration tests added/updated
Manual testing performed
No testing required (docs, internal refactor, etc.)
bash .github/ci/test-resolve-secret-scan-range.shExercised the resolver against the existing
v2.1.0-rc.2tag; it returnedv2.1.0-rc.1's commit as the base and the exactv2.1.0-rc.2commit as the head.Core/REST final-gate inventories, token-permission policies, concurrency policies,
actionlint, Bash syntax, andgit diff --check.cargo make format-nightlycargo make clippyCached full Carbide-lints gate.
Additional Notes
This does not create a test release tag because these workflows publish release artifacts. The next natural tag is the hosted acceptance check: Core and REST should log the same non-empty base/head range, with no
No commits to scanfallback. Managed-action source-error classification remains separate from this repository-side range fix.Closes #4806