@arjunkhera/atlas 0.4.17 → 0.4.18

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "atlas",
-  "version": "0.4.17",
+  "version": "0.4.18",
   "description": "Atlas: the delivery lifecycle, its crews and the Atlas tools, for any repository.",
   "author": {
     "name": "Arjun Khera"

package/door/lib/fails-before.mjs

@@ -292,7 +292,9 @@ export function freshTree(top, tree, sha) {
 // commit has a fixed author, date and message, so it holds no history and names neither real commit.
 export function gitTree(tree) {
   const env = { PATH: process.env.PATH ?? '/usr/bin:/bin', HOME: tree, GIT_CONFIG_NOSYSTEM: '1', GIT_AUTHOR_NAME: 'atlas', GIT_AUTHOR_EMAIL: 'atlas@invalid', GIT_COMMITTER_NAME: 'atlas', GIT_COMMITTER_EMAIL: 'atlas@invalid', GIT_AUTHOR_DATE: '2000-01-01T00:00:00Z', GIT_COMMITTER_DATE: '2000-01-01T00:00:00Z' };
-  for (const args of [['init', '-q', '-b', 'main'], ['add', '-A'], ['commit', '-q', '--no-verify', '--no-gpg-sign', '-m', 'tree']]) {
+  // No auto gc or background maintenance: it can still write in .git while
+  // the run removes the tree (ENOTEMPTY on atlas#223).
+  for (const args of [['init', '-q', '-b', 'main'], ['config', 'gc.auto', '0'], ['config', 'maintenance.auto', 'false'], ['add', '-A'], ['commit', '-q', '--no-verify', '--no-gpg-sign', '-m', 'tree']]) {
     const r = spawnSync('git', args, { cwd: tree, env, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
     if (r.status !== 0) throw new Error(`git ${args[0]} in the run tree failed: ${String(r.stderr).trim().split('\n')[0]}`);
   }
@@ -322,7 +324,7 @@ export function runSide({ top, changed, plans, side, work = join(tmpdir(), 'atla
         }
       }
       gitTree(tree);
-      for (const dir of ['home', 'tmp', 'report']) { rmSync(join(work, dir), { recursive: true, force: true }); mkdirSync(join(work, dir), { recursive: true }); }
+      for (const dir of ['home', 'tmp', 'report']) { rmSync(join(work, dir), { recursive: true, force: true, maxRetries: 5, retryDelay: 200 }); mkdirSync(join(work, dir), { recursive: true }); }
       const command = commandOf(p.runner, p.path, report);
       if (python && p.runner === 'pytest' && spawnSync('python3', ['-B', '-c', 'import pytest'], { cwd: tree, env }).status !== 0) {
         out.files[p.path] = { command, cases: null, why: 'pytest is not installed', none: true };

package/door/lib/gate-check.mjs

@@ -26,7 +26,7 @@
 import { spawnSync } from 'node:child_process';
 import { readFileSync, appendFileSync } from 'node:fs';
 import { resolve } from 'node:path';
-import { classify, changedPaths, compile, matcher } from './owner-only.mjs';
+import { classify, changedPaths, compile, matcher, fakeSecret } from './owner-only.mjs';
 import { listChanged } from './changed-tests.mjs';
 import { parseYaml, SECRET_PATTERNS } from '../../shape/check.mjs';
 import { brakeState, undoOf, tripText } from './brake.mjs';
@@ -101,7 +101,7 @@ export function secretRows(root, base, head, changes) {
     for (const added of addedLines(root, base, head, change.path)) {
       const found = patterns.find((pattern) => {
         const hit = pattern.regex.exec(added.text);
-        return hit && !(pattern.id === 'url-credential' && EXAMPLE_HOST.test(hit[0]));
+        return hit && !fakeSecret(pattern.id, hit[0]) && !(pattern.id === 'url-credential' && EXAMPLE_HOST.test(hit[0]));
       });
       if (found) rows.push({ kind: 'red', class: 'secret', path: change.path, line: added.line, cause: `secret pattern ${found.id}` });
     }

package/door/lib/gate.mjs

@@ -237,14 +237,12 @@ export function refusal(run, { name, pr, sha, baseRef, homes, sides = () => [] }
   // the side branch's file, so it does not count.
   if (pulls.some((each) => each.base?.ref !== baseRef)) return `also of a pull request into ${pulls.find((each) => each.base?.ref !== baseRef).base?.ref ?? 'another branch'}`;
   // GitHub builds that list when it is read, from the open pull requests of
-  // the head branch. Once a side pull request closes, its gate run names only
-  // this one, and its title can be set to match. So the gate also refuses a
-  // head branch that ever had a pull request into another branch.
-  if (name === GATE_CHECK) {
-    const side = sides();
-    if (side === null) return 'no head branch to check for side pull requests';
-    if (side.length) return `the head branch also had #${side[0].number} into ${side[0].base?.ref ?? 'another branch'}`;
-  }
+  // the head branch. Once a side pull request closes, its run names only this
+  // one. So no run counts when the head branch ever had a pull request into
+  // another branch (atlas#212 for the gate; item 043f8c00 for every check).
+  const side = sides();
+  if (side === null) return 'no head branch to check for side pull requests';
+  if (side.length) return `the head branch also had #${side[0].number} into ${side[0].base?.ref ?? 'another branch'}`;
   return null;
 }
 
@@ -268,7 +266,7 @@ export function jobRefusal(job, check, run) {
 function pinnedRuns(gh, repo, { pr, sha, baseRef, head, checks }) {
   const homes = homesAt(gh, repo, baseRef, checks);
   // Every pull request, open or closed, from the head branch into another
-  // branch. Read once, and only when a gate run needs it.
+  // branch. Read once, when the first run needs it.
   let sideList;
   const sides = () => {
     if (sideList !== undefined) return sideList;

package/door/lib/owner-only.mjs

@@ -498,6 +498,38 @@ const newest = (paths) => paths.reduce((best, path) => (best === null || newer(p
 
 // `rules` names the commit whose list holds; the default is the base. The
 // gate replay passes today's main branch, to ask what today's list would do.
+// Item b6e264a9, from the 30-day replay: the loose pattern "named-value"
+// (token = ..., secret: ...) matched test code in most of its hits, such as
+// a fake environment value. It does not count in a test file or under
+// archive/. The patterns of a known shape still count there.
+export const LOOSE_PATTERN = 'named-value';
+// A spec/ folder is not on the list: a schema repo keeps product text there.
+export const TEST_PATH = /(^|\/)(test|tests|__tests__)\/|\.(test|spec)\.[^/]+$|(^|\/)test_[^/]*\.py$|_test\.(py|go)$|^archive\//;
+// A value that says it is fake, such as "sk-fake-model-key-...", is no key.
+export const FAKE_VALUE = /fake|dummy|placeholder|example/i;
+// The part of a hit that holds the value: the user and password of a URL
+// credential, the text after ":" or "=" of a named value, else the whole
+// token. The word test reads only that part, so a host such as
+// db.examplecorp.io or a word after the value does not hide a real secret
+// (verifier, atlas#221).
+export function secretValue(id, text) {
+  if (id === 'url-credential') return text.slice(text.indexOf('://') + 3, text.lastIndexOf('@'));
+  if (id === LOOSE_PATTERN) return (/[:=]\s*(.*)$/s.exec(text)?.[1] ?? text).replace(/["',;})\]].*$/s, '');
+  return text;
+}
+export const fakeSecret = (id, text) => FAKE_VALUE.test(secretValue(id, text));
+// The first secret pattern that one added line of this path shows, or null.
+export function secretIn(patterns, path, lines) {
+  for (const pattern of patterns) {
+    if (pattern.id === LOOSE_PATTERN && TEST_PATH.test(path)) continue;
+    for (const line of lines) {
+      const hit = pattern.regex.exec(line);
+      if (hit && !fakeSecret(pattern.id, hit[0])) return { pattern, hit };
+    }
+  }
+  return null;
+}
+
 export function classify({ root, base, head, rules: rulesRef = null, classes = loadClasses() }) {
   const { rules, product, tree } = rulesAt({ root, ref: rulesRef ?? base, classes });
   const baseTree = rulesRef ? treeAt(root, base) : tree;
@@ -544,7 +576,7 @@ export function classify({ root, base, head, rules: rulesRef = null, classes = l
       if (kitRelease && sign.version_key) continue;
       if (sign.type === 'path' || sign.type === 'any_change') hits.push([sign.class, cause]);
       else if (sign.type === 'secret') {
-        const found = secrets.find((pattern) => changesOf().added.some((line) => pattern.regex.test(line)));
+        const found = secretIn(secrets, path, changesOf().added)?.pattern;
         if (found) hits.push([sign.class, `${cause} (${found.id})`]);
       } else if (sign.type === 'added_line') {
         const regex = compile(sign.pattern);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arjunkhera/atlas",
-  "version": "0.4.17",
+  "version": "0.4.18",
   "description": "Atlas: the delivery lifecycle, its crews and the Atlas tools, as a Claude Code plugin for any repository.",
   "type": "module",
   "license": "UNLICENSED",