fix(registry): shorten the placeholder app id in catalog examples - #2686
Open
liangshuo-1 wants to merge 1 commit into
Open
fix(registry): shorten the placeholder app id in catalog examples#2686liangshuo-1 wants to merge 1 commit into
liangshuo-1 wants to merge 1 commit into
Conversation
The example app id in the catalog is the public placeholder from the open platform documentation, not a credential. Its shape is what causes trouble: cli_ followed by exactly sixteen lowercase alphanumerics is what this repository's own lark-bot-app-id detector looks for, so gitleaks reports the four example values in im.json and task.json. On the branch those reports were suppressed by .gitleaksignore fingerprints, and a gitleaks fingerprint is bound to a commit SHA. Squash-merging #2232 moved the same content into a new commit, every fingerprint stopped matching, and the push scan on main reported all four. Two of them were never covered by a fingerprint at all; they stayed quiet only because the branch's incremental scans no longer reached the commit that introduced them. Shortening the placeholder to cli_example keeps the examples readable and takes them out of the detector's shape, so the reports go away at the source instead of being re-pinned to a SHA that the next squash would invalidate. The two fingerprints that named these task.json values are dropped with them. Verified with gitleaks v8.18.4 against this repository's own config: four reports on the merge commit before the change, none after, and none with the ignore file removed entirely. Manifest size and sha256 are recomputed for the two shards.
github-actions
Bot
added
the
size/M
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (4)
💤 Files with no reviewable changes (1)
Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review. 📝 WalkthroughWalkthroughThe service schemas now use ChangesCatalog updates
Estimated code review effort: 1 (Trivial) | ~2 minutes Suggested reviewers: Merge Risk: ⚪ Minimal · up to Published IM and Task API examples now use a clearly synthetic app ID, with corresponding catalog metadata updated. No merge-blocking risk is evident. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
🚀 PR Preview Install Guide🧰 CLI updatenpm i -g https://pkg.pr.new/larksuite/cli/@larksuite/cli@03781b23844f42dad86af6ece83efd5225e0f14e🧩 Skill updatenpx skills add larksuite/cli#fix/catalog-example-app-id -y -g |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #2686 +/- ##
=======================================
Coverage 76.37% 76.37%
=======================================
Files 1121 1121
Lines 128233 128233
=======================================
Hits 97932 97932
Misses 22458 22458
Partials 7843 7843 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
mainis red on the push scan forad8766b61. Gitleaks reports four values in the committed catalog: the example app id from the open platform documentation, a public placeholder rather than a credential. What trips the rule is its shape, sincecli_plus exactly sixteen lowercase alphanumerics is what this repository's ownlark-bot-app-idpattern looks for.Shortening it to
cli_examplekeeps the examples readable and takes them out of that shape. Four values, two inim.jsonand two intask.json.Why the branch was green
A
.gitleaksignorefingerprint is bound to a commit SHA. Squash-merging #2232 moved the same content into a new commit, so every entry stopped matching. Two of the four were never covered by a fingerprint at all and stayed quiet only because the branch's incremental scans no longer reached the commit that introduced them. Fixing the value means the next squash cannot bring the reports back, so the two fingerprints naming thesetask.jsonvalues are dropped with them.Verification
Local gitleaks v8.18.4 with this repository's own config, same scope as the CI push scan: four reports on
ad8766b61matching the CI SARIF line for line, none on this commit, and none with.gitleaksignoreremoved entirely. The registry, cmd, service, schema and publiccontent packages pass, and manifestsizeandsha256are recomputed so the embedded catalog still validates.The three remaining fingerprints also name commits absent from
main's history and cannot match anything either; worth cleaning up separately.