QA: vendored compiled libraries are excluded from publication, not fatal (applied)
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
1 changed file +16 −4
modified
services/qa/src/gates.ts
+16 −4
@@ -609,16 +609,28 @@ export async function runGates(ctx: GateContext): Promise<GateResult[]> { | |||||
| 609 | const t = (await a.read()).toString("utf8"); | 609 | const t = (await a.read()).toString("utf8"); | ||
| 610 | if (SECRET_PATTERNS.some((re) => re.test(t))) leaks.push(a.path); | 610 | if (SECRET_PATTERNS.some((re) => re.test(t))) leaks.push(a.path); | ||
| 611 | } | 611 | } | ||
| 612 | − const dangerous = ctx.artifacts | 612 | + const binaries = ctx.artifacts | ||
| 613 | − .filter((a) => /\.(exe|dll|dylib|so|app|pkg|dmg|bat|cmd|scr)$/i.test(a.path)) | 613 | + .filter((a) => /\.(exe|dll|dylib|so|app|pkg|dmg|bat|cmd|scr|bin)$/i.test(a.path)) | ||
| 614 | .map((a) => a.path); | 614 | .map((a) => a.path); | ||
| 615 | + // compiled libraries vendored under dependency directories are excluded from publication (never promoted); only | ||||
| 616 | + // executables outside those directories, or Windows/macOS installers and scripts, are fatal | ||||
| 617 | + const dangerous = binaries.filter( | ||||
| 618 | + (p) => | ||||
| 619 | + !/(^|\/)(\.pydeps|\.venv|venv|node_modules|__pycache__|\.cache)(\/|$)/.test(p) || | ||||
| 620 | + /\.(exe|dll|bat|cmd|scr|app|pkg|dmg)$/i.test(p), | ||||
| 621 | + ); | ||||
| 615 | out.push( | 622 | out.push( | ||
| 616 | leaks.length === 0 && dangerous.length === 0 | 623 | leaks.length === 0 && dangerous.length === 0 | ||
| 617 | − ? pass("secrets.none", "hard", "no credential patterns or executable binaries in artifacts") | 624 | + ? pass( | ||
| 625 | + "secrets.none", | ||||
| 626 | + "hard", | ||||
| 627 | + `no credential patterns or dangerous executables in artifacts${binaries.length ? ` (${binaries.length} vendored compiled libraries excluded from publication)` : ""}`, | ||||
| 628 | + { excludedBinaries: binaries.slice(0, 20) }, | ||||
| 629 | + ) | ||||
| 618 | : fail( | 630 | : fail( | ||
| 619 | "secrets.none", | 631 | "secrets.none", | ||
| 620 | "hard", | 632 | "hard", | ||
| 621 | − `${leaks.length} artifact(s) contain secret-like strings; ${dangerous.length} dangerous binaries`, | 633 | + `${leaks.length} artifact(s) contain secret-like strings; ${dangerous.length} dangerous executables`, | ||
| 622 | { leaks, dangerous }, | 634 | { leaks, dangerous }, | ||
| 623 | ), | 635 | ), | ||
| 624 | ); | 636 | ); | ||
| 625 | 637 | ||||