fix(secrets): replace SIGALRM with cross-platform timeout (closes #91)

[Wolfvin]

Problem

codelens secrets crashed on Windows because scripts/secrets_engine.py used signal.signal(signal.SIGALRM, ...) to enforce a per-file regex timeout. SIGALRM is a POSIX-only signal — it does not exist on Windows — so every invocation raised:

AttributeError: module 'signal' has no attribute 'SIGALRM'

The surrounding except (OSError, ValueError) fallback did not catch AttributeError, so the error propagated and killed the command. All TestSecretsEngine tests failed on Windows for the same reason.

Closes #91.

Approach

Chosen: Replace SIGALRM entirely with a concurrent.futures.ThreadPoolExecutor + future.result(timeout=...) based timeout. This was preferred over a hasattr(signal, "SIGALRM") guard because:

• Single code path on all platforms (no platform branching).
• No dead code — the old except (OSError, ValueError) fallback (which only existed to paper over the Windows crash) is removed, along with the _regex_timeout_handler signal handler.
• Windows now gets real timeout protection too (the hasattr guard would have left Windows without any timeout, merely avoiding the crash).
• Behaviour on Linux/macOS is preserved: per-file timeout is still PER_FILE_REGEX_TIMEOUT (5s) and the file is still skipped on timeout via the existing _RegexTimeout exception.

Files changed

scripts/secrets_engine.py:

1. import signal replaced with import concurrent.futures.
2. Removed _regex_timeout_handler(signum, frame) (dead code after refactor).
3. Added module-level constant _ENTROPY_EXTENSIONS (single source of truth for the entropy-eligible extensions set, previously duplicated across two call sites).
4. Added _scan_file_with_timeout(content, rel_path, ext, is_test) helper that runs _scan_file_patterns (+ optional _scan_file_entropy) inside a worker thread with a hard timeout.
5. Replaced the try/except SIGALRM block (and its except (OSError, ValueError) fallback) in detect_secrets with a single call to _scan_file_with_timeout. The except _RegexTimeout: handler is kept so timeout skips are still counted and logged.

Verification

Check	Result
python scripts/codelens.py secrets no longer raises AttributeError on Windows	Verified by simulating Windows (monkey-patched signal to delete SIGALRM/alarm) — detect_secrets() runs cleanly and returns findings.
TestSecretsEngine passes	10/10 pass (the file actually has 10 tests, not 9 as the issue stated).
No regressions in full suite	PYTHONUTF8=1 python -m pytest tests/ --ignore=tests/test_integration.py results in 863 passed, 12 skipped, 0 failed.

PYTHONUTF8=1 python -m pytest tests/ -k "TestSecretsEngine" -v --ignore=tests/test_integration.py
# => 10 passed, 865 deselected in 1.16s

Notes

• The worker thread spawned by ThreadPoolExecutor is a daemon on Python 3.9+, so a runaway regex that exceeds the timeout does not block process exit on modern Python. On Python 3.8 (the project's minimum), the leaked worker self-terminates when the regex eventually completes; this matches the prior worst-case behaviour of SIGALRM (which also could not actually interrupt a C-level regex match, only raise between bytecode instructions).
• No public API of secrets_engine changed. detect_secrets() signature and return shape are identical.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud