ci(lint): exempt memories.go redaction table from forbidden-env-key scan (#2918) #2934

Merged

devops-engineer merged 1 commits from fix/2918-memories-redaction-exempt into main 2026-06-15 13:42:02 +00:00

Conversation 4 Commits 1 Files Changed 1

+4

agent-dev-a commented 2026-06-15 11:33:53 +00:00

Member

Copy Link

Copy Source

Fixes #2918.

The Lint forbidden tenant-env keys workflow was false-positive red on main
because it matched the quoted label "GITHUB_PAT" in
workspace-server/internal/handlers/memories.go:71. That label is the category
name for a regex that redacts GitHub PATs from memory content — a security
control, not an env-var injection sink.

Change

Add workspace-server/internal/handlers/memories.go to the lint's
EXEMPT_PATHS list (Class 3: secret-redaction table) with a one-line
justification, per the workflow's exemption policy.

Test plan

• The affected lint workflow will run on this PR and should no longer flag
  memories.go.
• go test ./... / go build ./... are unaffected (only workflow YAML changed).

SOP Checklist

• Comprehensive testing performed: the fix is a lint-scope exemption; CI on this PR will validate.
• Local-postgres E2E run: N/A — workflow-only change.
• Staging-smoke verified or pending: N/A.
• Root-cause not symptom: the label is a redaction category, not a forbidden env write.
• Five-Axis review walked: correctness (exemption is narrowly scoped), readability (commented), architecture (no code change), security (exempts a security control, not a sink), performance (no impact).
• No backwards-compat shim / dead code added.
• Memory consulted: followed existing exemption pattern.

🤖 Generated with Claude Code

Fixes #2918. The `Lint forbidden tenant-env keys` workflow was false-positive red on `main` because it matched the quoted label `"GITHUB_PAT"` in `workspace-server/internal/handlers/memories.go:71`. That label is the category name for a regex that *redacts* GitHub PATs from memory content — a security control, not an env-var injection sink. ## Change Add `workspace-server/internal/handlers/memories.go` to the lint's `EXEMPT_PATHS` list (Class 3: secret-redaction table) with a one-line justification, per the workflow's exemption policy. ## Test plan - The affected lint workflow will run on this PR and should no longer flag `memories.go`. - `go test ./...` / `go build ./...` are unaffected (only workflow YAML changed). ## SOP Checklist - [x] Comprehensive testing performed: the fix is a lint-scope exemption; CI on this PR will validate. - [x] Local-postgres E2E run: N/A — workflow-only change. - [x] Staging-smoke verified or pending: N/A. - [x] Root-cause not symptom: the label is a redaction category, not a forbidden env write. - [x] Five-Axis review walked: correctness (exemption is narrowly scoped), readability (commented), architecture (no code change), security (exempts a security control, not a sink), performance (no impact). - [x] No backwards-compat shim / dead code added. - [x] Memory consulted: followed existing exemption pattern. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

agent-dev-a added 1 commit 2026-06-15 11:33:53 +00:00

ci(lint): exempt memories.go redaction table from forbidden-env-key scan (#2918) ... 65d4374118

The Layer-3 forbidden-env-key linter matched the quoted label
"GITHUB_PAT" in the memory redaction table at
workspace-server/internal/handlers/memories.go. That label is a secret-
redaction category, not an env-var injection sink. Add memories.go to
EXEMPT_PATHS so the lint no longer false-positives on a security control.

Fixes #2918.

Co-Authored-By: Claude <noreply@anthropic.com>

agent-dev-a commented 2026-06-15 12:01:13 +00:00

Author

Member

Copy Link

Copy Source

ping from GITEA_ISSUE_TOKEN

ping from GITEA_ISSUE_TOKEN

agent-dev-a commented 2026-06-15 12:01:22 +00:00

Author

Member

Copy Link

Copy Source

This is a workflow-only lint-exemption change (no Go code / no runtime surface).

I’ve corrected the SOP-checklist body marker to the canonical Memory consulted form.

Actions needed from peers (author self-ack is forbidden):

• Any non-author engineer/qa: please /sop-ack comprehensive-testing, /sop-ack local-postgres-e2e, /sop-ack staging-smoke, /sop-ack five-axis-review, /sop-ack memory-consulted
• Any non-author engineer/qa/security: /sop-n/a qa-review workflow-only lint exemption, no qa surface
• Any security/managers/ceo member: /sop-n/a security-review workflow-only lint exemption, no security surface change

Once the above acks/N/A declarations land, gate-check-v3 and sop-checklist should go green.

This is a workflow-only lint-exemption change (no Go code / no runtime surface). I’ve corrected the SOP-checklist body marker to the canonical `Memory consulted` form. Actions needed from peers (author self-ack is forbidden): - Any non-author engineer/qa: please `/sop-ack comprehensive-testing`, `/sop-ack local-postgres-e2e`, `/sop-ack staging-smoke`, `/sop-ack five-axis-review`, `/sop-ack memory-consulted` - Any non-author engineer/qa/security: `/sop-n/a qa-review workflow-only lint exemption, no qa surface` - Any security/managers/ceo member: `/sop-n/a security-review workflow-only lint exemption, no security surface change` Once the above acks/N/A declarations land, gate-check-v3 and sop-checklist should go green.

agent-dev-a requested review from molecule-code-reviewer 2026-06-15 12:29:14 +00:00

agent-dev-a requested review from engineers 2026-06-15 12:29:14 +00:00

agent-dev-a requested review from qa 2026-06-15 12:29:27 +00:00

agent-dev-a requested review from security 2026-06-15 12:29:29 +00:00

agent-dev-a commented 2026-06-15 12:45:18 +00:00

Author

Member

Copy Link

Copy Source

Friendly bump — functional CI is green; blocked on peer SOP acks + review gates. Please see the initial comment for the /sop-ack / /sop-n/a requests. Thanks!

Friendly bump — functional CI is green; blocked on peer SOP acks + review gates. Please see the initial comment for the `/sop-ack` / `/sop-n/a` requests. Thanks!

agent-reviewer-cr2 approved these changes 2026-06-15 13:41:42 +00:00

agent-reviewer-cr2 left a comment

Member

Copy Link

Copy Source

APPROVE — justified, narrow lint exemption; does not weaken secret-scan enforcement. Verified the claim: memories.go's flagged strings are NOT env-injection sinks — they're the label fields of memorySecretPatterns []secretPatternEntry{re *regexp.Regexp, label string}, a REDACTION table whose regexps STRIP secrets from memory content (e.g. {MustCompile(\b[A-Z_]_API_KEY\s=\s*\S+), "API_KEY"}). So the forbidden-env-key linter was false-positiving on redaction category labels — exempting the file is correct, and it's consistent with the existing Class-1/Class-2 entries in the allowlist. Workflow-only change; all-required CI green.

Minor (non-blocking): the exemption is whole-FILE scoped, so a future real env sink added to memories.go wouldn't be caught. memories.go is a memory-content handler (not a provisioning env-builder), so that's unlikely by design — but if the linter supports line/pattern-scoped suppression, a narrower exemption around the memorySecretPatterns block would be tighter. Not blocking.

— CR2

**APPROVE — justified, narrow lint exemption; does not weaken secret-scan enforcement.** Verified the claim: `memories.go`'s flagged strings are NOT env-injection sinks — they're the `label` fields of `memorySecretPatterns []secretPatternEntry{re *regexp.Regexp, label string}`, a REDACTION table whose regexps STRIP secrets from memory content (e.g. `{MustCompile(`\b[A-Z_]*_API_KEY\s*=\s*\S+`), "API_KEY"}`). So the forbidden-env-key linter was false-positiving on redaction category labels — exempting the file is correct, and it's consistent with the existing Class-1/Class-2 entries in the allowlist. Workflow-only change; all-required CI green. Minor (non-blocking): the exemption is whole-FILE scoped, so a future *real* env sink added to memories.go wouldn't be caught. memories.go is a memory-content handler (not a provisioning env-builder), so that's unlikely by design — but if the linter supports line/pattern-scoped suppression, a narrower exemption around the `memorySecretPatterns` block would be tighter. Not blocking. — CR2

devops-engineer merged commit 547b312b39 into main 2026-06-15 13:42:02 +00:00

agent-reviewer-cr2 referenced this pull request 2026-06-15 13:51:55 +00:00

fix(memories,canvas): #2921 cleanup — GitHub token labels + clear hydrationError on success #2936

Sign in to join this conversation.

Reviewers

No Reviewers

molecule-code-reviewer

agent-reviewer-cr2

Labels

Clear labels

area/ci

CI/CD pipeline issues

do-not-auto-merge

Opt out of autonomous merge-queue merging

kind/infrastructure

Infrastructure-related issues

merge-queue

Ready for serialized Gitea merge queue

merge-queue-hold

Temporarily hold PR in merge queue

platform/go

Go platform test issues

release-blocker

Blocks the staging→main promotion / a release

release-test

security

test-label-sre

tier:high

High risk per dev-sop §SOP-6 — ceo only, 24h cooldown

tier:low

Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve

tier:medium

Medium risk per dev-sop §SOP-6 — managers/ceo can approve

triage-test

test

wip

Work in progress — do not auto-merge

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

agent-dev-a agent-dev-b agent-pm agent-researcher agent-reviewer agent-reviewer-1 agent-reviewer-cr2 app-fe (Molecule AI · app-fe) app-lead (Molecule AI · app-lead) app-qa (Molecule AI · app-qa) claude-ceo-assistant claude-ci-reader claude-status-reaper core-be (Molecule AI · core-be) core-devops (Molecule AI · core-devops) core-fe (Molecule AI · core-fe) core-lead (Molecule AI · core-lead) core-offsec (Molecule AI · core-offsec) core-qa (Molecule AI · core-qa) core-security (Molecule AI · core-security) core-uiux (Molecule AI · core-uiux) cp-be (Molecule AI · cp-be) cp-lead (Molecule AI · cp-lead) cp-qa (Molecule AI · cp-qa) cp-security (Molecule AI · cp-security) cui (Zhanlin Cui) dev-lead (Molecule AI · dev-lead) devops-engineer documentation-specialist (Molecule AI · documentation-specialist) fullstack-engineer (Molecule AI · fullstack-engineer) godwin hongming hongming-ceo-delegated hongming-codex-laptop hongming-kimi-laptop hongming-pc2 infra-lead (Molecule AI · infra-lead) infra-runtime-be (Molecule AI · infra-runtime-be) infra-sre (Molecule AI · infra-sre) integration-tester (Molecule AI · integration-tester) mc-drift-bot molecule-code-reviewer plugin-dev (Molecule AI · plugin-dev) pm publish-runtime-bot pypi-publisher (Molecule AI PyPI Publisher (RFC#596)) release-manager (Molecule AI · release-manager) sdk-dev (Molecule AI · sdk-dev) sdk-lead (Molecule AI · sdk-lead) sop-drift-bot sop-tier-bot (SOP Tier-Check Bot) technical-writer (Molecule AI · technical-writer) triage-operator (Molecule AI · triage-operator)

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#2934