fix: reduce PR gate false positives and retain advisory secret scans by lvj-repox · Pull Request #10 · HYGON-AI/quality-gate

lvj-repox · 2026-09-20T09:31:16Z

Changes

Fix Kubernetes multi-document YAML false positives; retain malformed-document, duplicate-key and Actions structure blockers.
Recognized templates explicitly require rendered validation.
Restore pinned offline Gitleaks with redacted advisory findings; scanner failures remain invalid.
Make ambiguous vendor wording advisory and replace arbitrary substring matching.
Deduplicate PR annotations, retain escaped advisory details, and conservatively handle comment-only syntax debt.
Enforce LF for shell entrypoints to prevent Windows-exported archives breaking Linux bootstrap.

Validation completed at `37231b2`

GitHub CI passed: https://github.com/HYGON-AI/quality-gate/actions/runs/35504353487
Verified separately on the actual Linux quality runner in an isolated directory, without changing active runner configuration.
Compilation and native self-tests passed.
All 36 unit regressions passed.
All 6 bootstrap integration tests passed on the quality runner, including Python 3.8 rejection (hosted CI skips that one because Python 3.8 is absent).
Real pinned Gitleaks: synthetic detection, advisory-only decision, redaction and exit 0 passed.
Full production-policy seven-tool integration: all 10 scenarios passed (clean, wording, Semgrep, Ruff, ShellCheck, Actionlint, Yamllint, incremental filtering, Lizard, failure retaining blockers).
Exact image digests for Gitleaks, Semgrep and Ruff matched policy. Local quality-tools:1.0.0 image ID: sha256:4930643706a17e766a0861dcb1cd3010aa6bb7f3376122ef3adf212510ea6750.
Final integration results retained on the runner at /home/github/quality-gate-verify-37231b2-results/results.json. No target repository source or raw scanner reports committed.
Previously replayed both original sglang-das incident manifests: no YAML false positives.

Release boundary

Tests cover the current suite and reproduced incidents, not every possible future repository input.
No merge, tag, consumer workflow upgrade or protected-main change performed.
CI temporarily enabled for validation and restored to its previous disabled state.
PR remains open for review and an explicitly approved release/rollout.

Extended false-positive validation at `a20ee58`

Latest CI passed: https://github.com/HYGON-AI/quality-gate/actions/runs/35506438770
43 unit tests passed on the quality runner, including table-driven YAML edge cases.
Native self-tests and all 6 bootstrap tests passed, without skips on the quality runner.
All 15 full production-image integration scenarios passed. Added multi-document YAML, typed keys, block scalars, Helm template and malformed later-document controls.
Found and fixed two typed-scalar key false positives (integer versus quoted string; null versus quoted string). Native validation now considers scalar tags; Yamllint suppression requires proven distinct tags at the exact line and column. Genuine same-type duplicate keys remain blocked, including same-line controls.
Real Gitleaks controls passed: synthetic credential detected and redacted; dtype comparisons still advisory but exit 0; environment references, documentation placeholders and ordinary key variables emitted no secret advisory; credentials deleted later in PR history still produced a redacted advisory.
Results retained at /home/github/quality-gate-verify-a20ee58-results/results.json.
This is synthetic edge/reconstruction coverage, not an exhaustive replay of real PRs across all repositories. No promise of zero future false positives.
CI restored disabled; no release, merge or consumer-repository changes.

hygon-ai-reviewer · 2026-09-20T09:31:31Z

AI Review

审查尚未完整完成，无法给出整体结论；当前没有可发布的已确认问题，不代表代码没有问题。

部分结果不可用：1/6 批未完整完成，已保留可用问题。

审查未完整完成：以 GitHub 返回的 PR diff 为主体，关联上下文仅用于核验，未运行代码。

覆盖情况：共 20 个文件，已审查 4 个，部分审查 4 个，待审查 12 个。

进度已保存。正在继续处理。

hygon-ai-reviewer · 2026-09-20T09:35:55Z

AI Review

审查尚未完整完成，无法给出整体结论；当前没有可发布的已确认问题，不代表代码没有问题。

部分结果不可用：1/7 批未完整完成，已保留可用问题。

审查未完整完成：以 GitHub 返回的 PR diff 为主体，关联上下文仅用于核验，未运行代码。

覆盖情况：共 20 个文件，已审查 10 个，部分审查 4 个，待审查 6 个。

进度已保存。正在继续处理。

hygon-ai-reviewer · 2026-09-20T09:51:02Z

AI Review

审查尚未完整完成，无法给出整体结论；当前没有可发布的已确认问题，不代表代码没有问题。

部分结果不可用：2/7 批未完整完成，已保留可用问题。

审查未完整完成：以 GitHub 返回的 PR diff 为主体，关联上下文仅用于核验，未运行代码。

覆盖情况：共 20 个文件，已审查 6 个，部分审查 8 个，待审查 6 个。

进度已保存。正在继续处理。

hygon-ai-reviewer · 2026-09-20T10:00:10Z

AI Review

审查尚未完整完成，无法给出整体结论；当前没有可发布的已确认问题，不代表代码没有问题。

审查未完整完成：以 GitHub 返回的 PR diff 为主体，关联上下文仅用于核验，未运行代码。

覆盖情况：共 20 个文件，已审查 3 个，待审查 17 个。

进度已保存。正在继续处理。

hygon-ai-reviewer · 2026-09-20T10:03:17Z

AI Review

审查尚未完整完成，无法给出整体结论；当前没有可发布的已确认问题，不代表代码没有问题。

部分结果不可用：2/7 批未完整完成，已保留可用问题。

审查未完整完成：以 GitHub 返回的 PR diff 为主体，关联上下文仅用于核验，未运行代码。

覆盖情况：共 20 个文件，已审查 6 个，部分审查 8 个，待审查 6 个。

进度已保存。正在继续处理。

hygon-ai-reviewer

AI Review

🟢 未发现有明确证据的问题

在已提供并完成审查的 diff 范围内未形成可确认问题。

变更概览

本次变更主要包含：

本次改动在 PR 质量门禁的 security-check 中重新加入 Gitleaks（与 Semgrep 并列、结果为咨询性），并在 CI 中新增单元回归、Runner 引导集成及真实密钥扫描器集成测试步骤，同时更新英文文档与 .gitattributes 行尾配置。
在策略文件中新增 Gitleaks 扫描器配置：以固定镜像摘要启用离线密钥扫描，级别为 advisory，并定义占位符值、文档路径与示例目录的过滤规则。
更新 README 并新增低噪声门禁实施计划文档，说明多文档 YAML 支持、密钥与词法命中降为提示、注解聚合及新的本地验证命令。
本批将 gitleaks 接入本地扫描执行器与外部检查清单（输出脱敏、仅提示不阻断），并在 GitHub 注解输出中新增按规则/路径/级别的去重逻辑及告示条数上限处理。

文件审查摘要

文件	变更	审查结果
`src/hygon_quality_security/secret_placeholders.py`	新增 · +202/-0	—
`tests/test_low_noise.py`	新增 · +148/-0	—
`src/hygon_quality_security/scanner_parsers.py`	修改 · +63/-0	—
`README.md`	修改 · +26/-32	—
`tests/gitleaks_integration.py`	新增 · +57/-0	—
`src/hygon_pr_gate/yaml_checks.py`	新增 · +54/-0	—
`README.en.md`	修改 · +33/-8	—
`policies/quality-security/hygon-quality-security-v1.1.yaml`	修改 · +40/-0	—
`src/hygon_pr_gate/audit_pr.py`	修改 · +19/-7	—
`docs/plans/2026-09-20-low-noise-gate.md`	新增 · +24/-0	—
`src/hygon_pr_gate/native_checks.py`	修改 · +20/-4	—
`.github/workflows/ci.yml`	修改 · +18/-0	—
`src/hygon_pr_gate/local_executor.py`	修改 · +17/-1	—
`src/hygon_pr_gate/sensitive_diff_check.py`	修改 · +8/-8	—
`tests/pr_gate_self_test.py`	修改 · +7/-7	—
`src/hygon_pr_gate/render_summary.py`	修改 · +8/-5	—
`src/hygon_quality_security/quality_driver.py`	修改 · +9/-0	—
`tests/test_universal_scope.py`	修改 · +5/-3	—
`.github/workflows/pr-quality-gate.yml`	修改 · +2/-2	—
`.gitattributes`	新增 · +2/-0	—

其余 1 个文件未逐项展开。

审查信息

变更统计：21 个文件，+763/-78。
覆盖情况：共 21 个文件，已完整审查 21 个。
候选问题：1 项；证据复核过滤：1 项；发布前敏感信息保护：0 项。
本服务以 GitHub 提供的 PR diff 为审查主体，PR 描述与按相关性选取的仓库片段仅用于核验；未执行代码或重跑测试，结论仍需维护者核验。

hygon-ai-reviewer · 2026-09-20T10:53:43Z

AI Review

审查尚未完整完成，无法给出整体结论；当前没有可发布的已确认问题，不代表代码没有问题。

审查未完整完成：以 GitHub 返回的 PR diff 为主体，关联上下文仅用于核验，未运行代码。

覆盖情况：共 22 个文件，已审查 6 个，待审查 16 个。

进度已保存。正在继续处理。

hygon-ai-reviewer · 2026-09-20T10:56:37Z

AI Review

审查尚未完整完成，无法给出整体结论；当前没有可发布的已确认问题，不代表代码没有问题。

部分结果不可用：1/9 批未完整完成，已保留可用问题。

审查未完整完成：以 GitHub 返回的 PR diff 为主体，关联上下文仅用于核验，未运行代码。

覆盖情况：共 22 个文件，已审查 14 个，部分审查 2 个，待审查 6 个。

进度已保存。正在继续处理。

fix: reduce gate false positives and make secret findings advisory

97353b5

test: cover advisory redaction and retain escaped summary details

752db28

docs: align README structure with v2.0.3 and clarify validation limits

76be574

test: expose redacted scanner failure diagnostics

2ef600d

test: size smoke-test container for hosted CI

201d1d0

fix: preserve LF for Linux shell entrypoints

37231b2

hygon-ai-reviewer Bot reviewed Sep 20, 2026

View reviewed changes

fix: distinguish YAML key types and expand false-positive regressions

ac96240

lvj-repox added 2 commits September 20, 2026 18:54

fix: suppress only proven typed-key yamllint false positives

4139c7b

test: distinguish same-line duplicate key positions

a20ee58

lvj-repox merged commit 6fd4b43 into main Sep 20, 2026
2 checks passed

Navigation Menu

Repository navigation

fix: reduce PR gate false positives and retain advisory secret scans - #10

fix: reduce PR gate false positives and retain advisory secret scans#10
lvj-repox merged 9 commits into
mainfrom
fix/low-noise-gate-20260920

lvj-repox commented Sep 20, 2026 •

edited

Loading

Uh oh!

hygon-ai-reviewer Bot commented Sep 20, 2026 •

edited

Loading

Uh oh!

hygon-ai-reviewer Bot commented Sep 20, 2026 •

edited

Loading

Uh oh!

hygon-ai-reviewer Bot commented Sep 20, 2026 •

edited

Loading

Uh oh!

hygon-ai-reviewer Bot commented Sep 20, 2026 •

edited

Loading

Uh oh!

hygon-ai-reviewer Bot commented Sep 20, 2026 •

edited

Loading

Uh oh!

hygon-ai-reviewer Bot left a comment

Uh oh!

hygon-ai-reviewer Bot commented Sep 20, 2026 •

edited

Loading

Uh oh!

hygon-ai-reviewer Bot commented Sep 20, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

lvj-repox commented Sep 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Validation completed at 37231b2

Release boundary

Extended false-positive validation at a20ee58

Uh oh!

hygon-ai-reviewer Bot commented Sep 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

AI Review

Uh oh!

hygon-ai-reviewer Bot commented Sep 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

AI Review

Uh oh!

hygon-ai-reviewer Bot commented Sep 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

AI Review

Uh oh!

hygon-ai-reviewer Bot commented Sep 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

AI Review

Uh oh!

hygon-ai-reviewer Bot commented Sep 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

AI Review

Uh oh!

hygon-ai-reviewer Bot left a comment

Choose a reason for hiding this comment

AI Review

🟢 未发现有明确证据的问题

Uh oh!

hygon-ai-reviewer Bot commented Sep 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

AI Review

Uh oh!

hygon-ai-reviewer Bot commented Sep 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

AI Review

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

lvj-repox commented Sep 20, 2026 •

edited

Loading

Validation completed at `37231b2`

Extended false-positive validation at `a20ee58`

hygon-ai-reviewer Bot commented Sep 20, 2026 •

edited

Loading

hygon-ai-reviewer Bot commented Sep 20, 2026 •

edited

Loading

hygon-ai-reviewer Bot commented Sep 20, 2026 •

edited

Loading

hygon-ai-reviewer Bot commented Sep 20, 2026 •

edited

Loading

hygon-ai-reviewer Bot commented Sep 20, 2026 •

edited

Loading

hygon-ai-reviewer Bot commented Sep 20, 2026 •

edited

Loading

hygon-ai-reviewer Bot commented Sep 20, 2026 •

edited

Loading