fix(deploy-artifact): anchor kind=Secret grep to prevent SecretStore over-match#73
Merged
jorisjonkers-dev-agents[bot] merged 2 commits intoJul 12, 2026
Conversation
…SecretStore kinds Replaces the unanchored `grep -rl 'kind: Secret'` in reject_secret_kind with an anchored ERE `grep -rlE '^kind:[[:space:]]*Secret[[:space:]]*$'`, matching the pattern applied to deploy-preview/run.sh in #62. SecretStore and ClusterSecretStore manifests no longer produce false-positive E_FORBIDDEN_KIND rejections; bare `kind: Secret` still fails with the file named. Adds T-DA1 tests in tests/test_scorecard.py covering: - SecretStore passes - ClusterSecretStore passes - raw Secret fails and names the file - drift guard: anchored pattern present in run.sh
jorisjonkers-dev-agents
Bot
added
the
type: bug
…red pattern Updates DeployArtifactRunShTest.test_reject_secret_kind to assert the anchored ERE pattern (^kind:[[:space:]]*Secret[[:space:]]*$) is present in deploy-artifact/run.sh, rather than the bare 'kind: Secret' substring which survives in comments and doesn't verify the functional guard.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #66
actions/deploy-artifact/run.shused an unanchoredgrep -rl 'kind: Secret'in itsreject_secret_kindguard (E_FORBIDDEN_KIND), causing false-positive rejections of manifests containingSecretStoreandClusterSecretStorekinds (External Secrets Operator patterns).The fix applies the same anchored ERE pattern already used in
actions/deploy-preview/run.shsince #62:SecretStoreandClusterSecretStoremanifests pass through without rejectionkind: Secretmanifests still failE_FORBIDDEN_KINDwith the offending file namedTests added (T-DA1 in
tests/test_scorecard.py)Four new tests covering
reject_secret_kinddirectly by sourcingdeploy-artifact/run.sh:test_secretstore_passes—kind: SecretStoreis not rejectedtest_clustersecretstore_passes—kind: ClusterSecretStoreis not rejectedtest_raw_secret_fails_and_names_file—kind: Secretfails and names the filetest_anchored_pattern_in_run_sh— drift guard asserting the anchored pattern is present in source