Secrets: add inline allowlist review set by vincentkoc · Pull Request #38314 · openclaw/openclaw

vincentkoc · 2026-03-06T20:16:46Z

Summary

add inline pragma: allowlist secret annotations for obvious detect-secrets false positives in source, generated, UI locale, and release metadata files
normalize repeated secretShape literals in src/secrets/target-registry-data.ts through shared constants so the allowlist stays reviewable
narrow detect-secrets file exclusions back to pnpm-lock.yaml instead of broadly excluding dist/, vendor/, and .detect-secrets.cfg
include the resulting .secrets.baseline refresh required by the current hook behavior

Why

This is a review PR for the current detect-secrets noise on branches while main is temporarily skipping the full scan. The goal is to make the allowlist changes explicit and easy to audit before we start fixing any real findings.

Validation

pnpm exec oxfmt --check on changed TS/Swift files
git diff --check
pre-commit run detect-secrets --files <changed files> with the refreshed .secrets.baseline

greptile-apps · 2026-03-06T20:23:34Z

Greptile Summary

This PR adds // pragma: allowlist secret (and XML/shell equivalents) to ~36 files to suppress detect-secrets false positives, refreshes the .secrets.baseline, and normalizes repeated "secret_input" / "sibling_ref" string literals in src/secrets/target-registry-data.ts into shared module-local constants. No functional logic is changed — every boolean-variable extraction (e.g. useSecretRefMode, usesSiblingRef, hasRuntimeApiKeyOverride) is semantically identical to the original inline comparison.

Key points:

All suppressions are on clearly non-sensitive values: field-name strings ("apiKey", "password"), enum-like literals ("ref", "config-first", "env-first"), public fingerprints/signatures, locale UI strings, and type definitions.
The SECRET_INPUT_SHAPE / SIBLING_REF_SHAPE constant extraction is a clean refactor; the constants are typed as their string literal types and remain compatible with the SecretTargetShape union.
The baseline should_exclude_file regex was broadened to exclude entire dist/ and vendor/ directory trees — see inline comment for a note on this.
One previously-tracked finding for src/config/schema.help.ts (hash bb7dfd9746e660e4a4374951ec5938ef0e343255) was removed from the baseline without a visible inline annotation in this diff — worth a quick confirmation that the suppression is accounted for.

Confidence Score: 4/5

Safe to merge — all changes are detect-secrets false-positive suppressions with no functional impact, pending confirmation of two minor baseline hygiene points.
The PR introduces no logic changes; every code modification is either a comment addition or a semantically-equivalent boolean-variable extraction. The main review items are both in .secrets.baseline: (1) the newly added dist/ and vendor/ directory exclusions are broader than necessary and could mask future accidental secret commits; (2) one prior baseline finding was dropped without a visible inline annotation, which warrants a quick verification. Neither of these is a blocker.
.secrets.baseline — verify the dropped schema.help.ts finding and consider tightening the new directory exclusion regex.

Comments Outside Diff (2)

.secrets.baseline, line 10 (link)

Broad directory exclusions could hide committed secrets

The updated exclusion regex now silently skips all files under dist/ and vendor/ directories. If any build artifact or vendored dependency that contains a real credential is ever committed, detect-secrets will not catch it.

Consider scoping the exclusion more tightly — e.g. only exclude well-known lock/generated files rather than entire directory trees — or add a comment in the baseline explaining the intent so future reviewers understand why these directories are skipped.
.secrets.baseline, line 28-34 (link)

Baseline finding dropped without a corresponding inline annotation

The entry for src/config/schema.help.ts with hash bb7dfd9746e660e4a4374951ec5938ef0e343255 (previously at line 187) is removed from the baseline, but the schema.help.ts diff in this PR does not show a // pragma: allowlist secret annotation being added at or near that line, nor does it show the line being deleted.

It would be worth confirming whether:
1. The line content legitimately changed (rotating the hash naturally) — in which case no action is needed.
2. The line was suppressed inline in a previous commit — worth verifying the annotation exists.
3. The suppression is accidental — in which case the entry should be re-added or an inline annotation added.

_{Last reviewed commit: 76475ac}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8409eeb07b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a58b5d5ebf

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

* Secrets: add inline allowlist review set * Secrets: narrow detect-secrets file exclusions * Secrets: exclude Docker fingerprint false positive * Secrets: allowlist test and docs false positives * Secrets: refresh baseline after allowlist updates * Secrets: fix gateway chat fixture pragma * Secrets: format pre-commit config * Android: keep talk mode fixture JSON valid * Feishu: rely on client timeout injection * Secrets: allowlist provider auth test fixtures * Secrets: allowlist onboard search fixtures * Secrets: allowlist onboard mode fixture * Secrets: allowlist gateway auth mode fixture * Secrets: allowlist APNS wake test key * Secrets: allowlist gateway reload fixtures * Secrets: allowlist moonshot video fixture * Secrets: allowlist auto audio fixture * Secrets: allowlist tiny audio fixture * Secrets: allowlist embeddings fixtures * Secrets: allowlist resolve fixtures * Secrets: allowlist target registry pattern fixtures * Secrets: allowlist gateway chat env fixture * Secrets: refresh baseline after fixture allowlists * Secrets: reapply gateway chat env allowlist * Secrets: reapply gateway chat env allowlist * Secrets: stabilize gateway chat env allowlist * Secrets: allowlist runtime snapshot save fixture * Secrets: allowlist oauth profile fixtures * Secrets: allowlist compaction identifier fixture * Secrets: allowlist model auth fixture * Secrets: allowlist model status fixtures * Secrets: allowlist custom onboarding fixture * Secrets: allowlist mattermost token summary fixtures * Secrets: allowlist gateway auth suite fixtures * Secrets: allowlist channel summary fixture * Secrets: allowlist provider usage auth fixtures * Secrets: allowlist media proxy fixture * Secrets: allowlist secrets audit fixtures * Secrets: refresh baseline after final fixture allowlists * Feishu: prefer explicit client timeout * Feishu: test direct timeout precedence

(cherry picked from commit 42e3d8d6930bd24ebe6a3e68b6f65b36e3bbbf8e)

* Secrets: add inline allowlist review set * Secrets: narrow detect-secrets file exclusions * Secrets: exclude Docker fingerprint false positive * Secrets: allowlist test and docs false positives * Secrets: refresh baseline after allowlist updates * Secrets: fix gateway chat fixture pragma * Secrets: format pre-commit config * Android: keep talk mode fixture JSON valid * Feishu: rely on client timeout injection * Secrets: allowlist provider auth test fixtures * Secrets: allowlist onboard search fixtures * Secrets: allowlist onboard mode fixture * Secrets: allowlist gateway auth mode fixture * Secrets: allowlist APNS wake test key * Secrets: allowlist gateway reload fixtures * Secrets: allowlist moonshot video fixture * Secrets: allowlist auto audio fixture * Secrets: allowlist tiny audio fixture * Secrets: allowlist embeddings fixtures * Secrets: allowlist resolve fixtures * Secrets: allowlist target registry pattern fixtures * Secrets: allowlist gateway chat env fixture * Secrets: refresh baseline after fixture allowlists * Secrets: reapply gateway chat env allowlist * Secrets: reapply gateway chat env allowlist * Secrets: stabilize gateway chat env allowlist * Secrets: allowlist runtime snapshot save fixture * Secrets: allowlist oauth profile fixtures * Secrets: allowlist compaction identifier fixture * Secrets: allowlist model auth fixture * Secrets: allowlist model status fixtures * Secrets: allowlist custom onboarding fixture * Secrets: allowlist mattermost token summary fixtures * Secrets: allowlist gateway auth suite fixtures * Secrets: allowlist channel summary fixture * Secrets: allowlist provider usage auth fixtures * Secrets: allowlist media proxy fixture * Secrets: allowlist secrets audit fixtures * Secrets: refresh baseline after final fixture allowlists * Feishu: prefer explicit client timeout * Feishu: test direct timeout precedence

Secrets: add inline allowlist review set

bbb3470

vincentkoc self-assigned this Mar 6, 2026

openclaw-barnacle Bot added app: ios App: ios app: web-ui App: web-ui gateway Gateway runtime cli CLI command changes commands Command implementations docker Docker and sandbox tooling agents Agent runtime and tooling size: M maintainer Maintainer-authored PR labels Mar 6, 2026

vincentkoc marked this pull request as ready for review March 6, 2026 20:20

Merge branch 'main' into vincentkoc-code/secrets-inline-allowlist-review

76475ac

Secrets: narrow detect-secrets file exclusions

8409eeb

chatgpt-codex-connector Bot reviewed Mar 6, 2026

View reviewed changes

Comment thread Dockerfile Outdated

Secrets: exclude Docker fingerprint false positive

18077a4

openclaw-barnacle Bot removed the docker Docker and sandbox tooling label Mar 6, 2026

vincentkoc added 2 commits March 6, 2026 18:21

Secrets: allowlist test and docs false positives

35322c5

Secrets: refresh baseline after allowlist updates

a58b5d5

This comment has been minimized.

Sign in to view

chatgpt-codex-connector Bot reviewed Mar 6, 2026

View reviewed changes

Comment thread apps/android/app/src/test/java/ai/openclaw/android/voice/TalkModeConfigParsingTest.kt Outdated

vincentkoc added 2 commits March 6, 2026 18:31

Secrets: fix gateway chat fixture pragma

c33d15c

Secrets: format pre-commit config

d05e6a4

vincentkoc added 14 commits March 6, 2026 19:11

Secrets: allowlist oauth profile fixtures

d291b58

Secrets: allowlist compaction identifier fixture

4fae328

Secrets: allowlist model auth fixture

62afbc6

Secrets: allowlist model status fixtures

040bc03

Secrets: allowlist custom onboarding fixture

49a0cad

Secrets: allowlist mattermost token summary fixtures

f389f5b

Secrets: allowlist gateway auth suite fixtures

aa0de35

Secrets: allowlist channel summary fixture

9ed6799

Secrets: allowlist provider usage auth fixtures

920cb28

Secrets: allowlist media proxy fixture

c0ab92c

Secrets: allowlist secrets audit fixtures

7fd7bc3

Secrets: refresh baseline after final fixture allowlists

0109025

Feishu: prefer explicit client timeout

ed654d9

Feishu: test direct timeout precedence

ea2c06e

vincentkoc merged commit 42e3d8d into main Mar 7, 2026
29 of 31 checks passed

vincentkoc deleted the vincentkoc-code/secrets-inline-allowlist-review branch March 7, 2026 00:35

vincentkoc mentioned this pull request Mar 7, 2026

CI: restore main detect-secrets scan #38438

Merged

18 tasks

github-actions Bot mentioned this pull request Mar 7, 2026

📡 Upstream Digest — 2026-03-07 01:15 UTC curtismercier/openclaw-mods#196

Open

alexyyyander mentioned this pull request Mar 7, 2026

fix/gateway token mismatch 38617 #38676

Closed

alexey-pelykh pushed a commit to remoteclaw/remoteclaw that referenced this pull request Mar 20, 2026

Secrets: add inline allowlist review set (openclaw#38314)

ae83a0b

(cherry picked from commit 42e3d8d6930bd24ebe6a3e68b6f65b36e3bbbf8e)

alexey-pelykh pushed a commit to remoteclaw/remoteclaw that referenced this pull request Mar 20, 2026

Secrets: add inline allowlist review set (openclaw#38314)

574678b

(cherry picked from commit 42e3d8d6930bd24ebe6a3e68b6f65b36e3bbbf8e)

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Secrets: add inline allowlist review set#38314

Secrets: add inline allowlist review set#38314
vincentkoc merged 42 commits into
mainfrom
vincentkoc-code/secrets-inline-allowlist-review

vincentkoc commented Mar 6, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot commented Mar 6, 2026 •

edited

Loading

Comments Outside Diff (2)

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

This comment has been minimized.

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

vincentkoc commented Mar 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Why

Validation

Uh oh!

greptile-apps Bot commented Mar 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 4/5

Comments Outside Diff (2)

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

This comment has been minimized.

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vincentkoc commented Mar 6, 2026 •

edited

Loading

greptile-apps Bot commented Mar 6, 2026 •

edited

Loading