fix(ci): stop Core main secret scans at the pushed commit - #4828
Merged
Conversation
On normal `main` pushes, we already supplied `github.event.before` as the TruffleHog base, but left `head` empty. That makes TruffleHog scan every fetched ref after the base instead of stopping at the commit that just landed. So, pass `GITHUB_SHA` as the head beside the existing base. Pull request, release-tag, and REST paths are unchanged. - **Expected green-run effect:** No meaningful full-pipeline savings are expected; this should reduce scanner input, but startup time dominates the observed scan duration. - **What it really buys us:** A green Core `main` scan is bounded to the exact push we meant to verify. This supports NVIDIA#4827 Signed-off-by: Chet Nichols III <chetn@nvidia.com>
Contributor
Author
|
@coderabbitai full_review, thanks! |
Contributor
Summary by CodeRabbit
WalkthroughThe CI workflow now sets the secret-scan range head to ChangesSecret scan range resolution
Estimated code review effort: 1 (Trivial) | ~2 minutes Possibly related issues
Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Contributor
|
🐇 ✅ Action performedFull review finished. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
On normal Core
mainpushes, we already gave TruffleHoggithub.event.beforeas the base but leftheadempty. TruffleHog treats that as an open-endedgit log --all, so it can scan commits from unrelated fetched refs and still report green. This adds the missingGITHUB_SHAhead so the check stops at the commit that actually landed; pull request, tag, and REST behavior stay unchanged.mainscan is bounded to the exact push we meant to verify.Related issues
This supports #4827
Type of Change
Breaking Changes
Testing
Additional Notes
The changed branch runs only after a push lands on
main, so the post-merge Core secret-scan job is the end-to-end check. It should loggithub.event.beforeasbase, the exact pushedGITHUB_SHAashead, nonzero scan work, and no source errors.Closes #4827