QA: vendored compiled libraries are excluded from publication, not fatal (applied)
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
1 changed file +16 −4
modified
services/qa/src/gates.ts
+16 −4
@@ -609,16 +609,28 @@ export async function runGates(ctx: GateContext): Promise<GateResult[]> { | ||
| 609 | 609 | const t = (await a.read()).toString("utf8"); |
| 610 | 610 | if (SECRET_PATTERNS.some((re) => re.test(t))) leaks.push(a.path); |
| 611 | 611 | } |
| 612 | − const dangerous = ctx.artifacts | |
| 613 | − .filter((a) => /\.(exe|dll|dylib|so|app|pkg|dmg|bat|cmd|scr)$/i.test(a.path)) | |
| 612 | + const binaries = ctx.artifacts | |
| 613 | + .filter((a) => /\.(exe|dll|dylib|so|app|pkg|dmg|bat|cmd|scr|bin)$/i.test(a.path)) | |
| 614 | 614 | .map((a) => a.path); |
| 615 | + // compiled libraries vendored under dependency directories are excluded from publication (never promoted); only | |
| 616 | + // executables outside those directories, or Windows/macOS installers and scripts, are fatal | |
| 617 | + const dangerous = binaries.filter( | |
| 618 | + (p) => | |
| 619 | + !/(^|\/)(\.pydeps|\.venv|venv|node_modules|__pycache__|\.cache)(\/|$)/.test(p) || | |
| 620 | + /\.(exe|dll|bat|cmd|scr|app|pkg|dmg)$/i.test(p), | |
| 621 | + ); | |
| 615 | 622 | out.push( |
| 616 | 623 | leaks.length === 0 && dangerous.length === 0 |
| 617 | − ? pass("secrets.none", "hard", "no credential patterns or executable binaries in artifacts") | |
| 624 | + ? pass( | |
| 625 | + "secrets.none", | |
| 626 | + "hard", | |
| 627 | + `no credential patterns or dangerous executables in artifacts${binaries.length ? ` (${binaries.length} vendored compiled libraries excluded from publication)` : ""}`, | |
| 628 | + { excludedBinaries: binaries.slice(0, 20) }, | |
| 629 | + ) | |
| 618 | 630 | : fail( |
| 619 | 631 | "secrets.none", |
| 620 | 632 | "hard", |
| 621 | − `${leaks.length} artifact(s) contain secret-like strings; ${dangerous.length} dangerous binaries`, | |
| 633 | + `${leaks.length} artifact(s) contain secret-like strings; ${dangerous.length} dangerous executables`, | |
| 622 | 634 | { leaks, dangerous }, |
| 623 | 635 | ), |
| 624 | 636 | ); |
| 625 | 637 | |