fix(redaction): skip gh run view job/step prefixes - #1053
Conversation
Replay unique #929 source onto current origin/main. Skip shared ARCHITECTURE/CLAUDE/AGENTS trees and stale materialize files.
Treat only plausible JSON openers as span starts and score a failed parse against the window until the next opener. A ##[group] marker or prose [timeout] no longer fail-closes a later pretty-printed password object. Cite RFC 8259, ECMA-404, and ISO/IEC 21778 for duplicate-member layout. Co-authored-by: Seongho Bae <[email protected]>
Skip RFC 3339 runner timestamps inside raw JSON spans and open '[' only for a real JSON value so a downloaded pretty-printed password dump keeps ##[group] and [INFO] text instead of fail-closing the entire log. Co-authored-by: Seongho Bae <[email protected]>
Z-only prefixes still fail-closed a pretty-printed password dump when the collector emitted time-numoffset or a tab after the timestamp. Skip those RFC 3339 §5.6 forms the same way Z plus SPACE is skipped. Co-authored-by: Seongho Bae <[email protected]>
Keep failed-check excerpts visible when collect_failed_check_evidence.sh feeds gh run view --log-failed lines (job HTAB step HTAB plus the zip RFC 3339 timestamp, including UNKNOWN STEP). Redact credential-shaped job/step fields that remain inside a rewritten JSON span. Co-authored-by: Seongho Bae <[email protected]>
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Next action
Mark this pull request ready for review, then merge it instead of #1040, #1038, #1031, or #929.
This head skips the gh run view --log-failed job<HTAB>step<HTAB> collector prefix plus RFC 3339 Z / time-numoffset and SPACE or HTAB, so a pretty-printed password dump in the actual failed-check excerpt keeps ##[group] and status text. Skipped job/step fields that remain inside a rewritten span still pass unstructured redaction. A two-tab TSV without a timestamp is not eaten as a runner prefix.
Local focused selection: 177 passed; 100% statement/branch on the three owned modules (1,136 statements, 464 branches).
Do not self-approve. After it is green, treat [REDACTED] as evidence suppression and rerun the exact-head sandbox redaction quality job before closing #908.
Sent by Cursor Automation: Fix Issues
2 participants
Next action
Merge this successor instead of #1040. That head still fail-closes a pretty-printed password dump when
collect_failed_check_evidence.shfeedsgh run view --log-failedlines (job<HTAB>step<HTAB>plus the zip RFC 3339 timestamp).What changed
job<HTAB>step<HTAB>only when an RFC 3339 timestamp follows the second tab, then skipZortime-numoffsetplus SPACE or HTAB the same way JSON whitespace is skipped.UNKNOWN STEPand offset/HTAB zip lines as one span so group and status text stay visible.run:step text cannot survive on continuation lines.gh run viewnext to the existing APA 7 RFC 3339 / RFC 8259 / workflow-log references.Verification
Focused redaction selection: 177 passed. Owned modules
redact_sensitive_log.py,sandboxed_verify.py, andsandboxed_web_e2e.pyreport 100% statement and branch coverage (1,136 statements, 464 branches). Complete repository suite: 1232 passed plus 16 subtests before the two added collector fixtures; focused selection includes those fixtures.Acceptance
Do not merge #929, #1031, #1038, or #1040. After this head is green, treat
[REDACTED]as evidence suppression and rerun the exact-head sandbox redaction quality job before closing #908.