Repository navigation
test(security): annotate intentional hardcoded-password detection fixture - #266
Conversation
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 44 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
The merged main commit fails
scan / rust-secretsontests/template_coverage_tests.rs:109: the detector's deliberate dummy HTML password is itself detected by the CI scanner.Add the scanner's documented inline
scanner-allow: rust-secretspragma to that one fixture line, with an explanatory comment. The input string and detector assertions are unchanged; no workflow or scanner pattern is changed.Validation: executed the exact rust-secrets step from the pinned vendored workflow against isolated fixtures. The original fails; the annotated fixture passes; adding an unrelated dummy API-key canary in the same tests directory still fails. Only two comments differ. Rust formatting and the existing detector test must also pass in CI.
This addresses the executing scanner failure after #265. Separate zero-job failures remain: the Rust CI startup annotation explicitly says the metadatastician/standards reusable is excluded by the repository's Actions policy. No policy change or mirror configuration is included.