diff --git a/bin/gstack-redact b/bin/gstack-redact index 45bb1235f..fdf4e6363 100755 --- a/bin/gstack-redact +++ b/bin/gstack-redact @@ -307,7 +307,9 @@ function main() { "\n", ); } - process.exit(0); + // Same truncation class as the report path below: the redacted BODY can + // be arbitrarily large; let stdout drain instead of process.exit(0). + return; } const result = scan(input, opts); @@ -326,7 +328,12 @@ function main() { process.stdout.write(` HIGH=${HIGH} MEDIUM=${MEDIUM} LOW=${LOW} WARN=${WARN}\n`); } } - process.exit(code); + // process.exit() discards stdout still buffered in the pipe: a report past + // ~145 KB read by a slow consumer (node's gate-secret-scan.mjs collector) + // arrived truncated, JSON.parse failed, and the CI quality gate failed + // CLOSED on a clean scan. Set the exit code and let the runtime drain + // stdout instead — same contract, no truncation. + process.exitCode = code; } main(); diff --git a/test/regression-pr1169-mktemp-fallbacks.test.ts b/test/regression-pr1169-mktemp-fallbacks.test.ts index ea727705b..02cfd78f0 100644 --- a/test/regression-pr1169-mktemp-fallbacks.test.ts +++ b/test/regression-pr1169-mktemp-fallbacks.test.ts @@ -120,7 +120,7 @@ echo "SHOULD NOT REACH: $TMP_DIR"`; const r = spawnSync( "bun", [path.join(ROOT, "bin", "gstack-redact"), "--from-file", "", "--json"], - { encoding: "utf-8", input: "sk-ant-api03-not-really-a-key", timeout: 15_000 }, + { encoding: "utf-8", input: "placeholder stdin content (never read on the error path)", timeout: 15_000 }, ); expect(r.status).toBe(1); expect(r.stderr).toContain("non-empty path");