Garry Tanandcapy-ai[bot] 76e2d3f987 Catch secrets in files git treats as binary before they are pushed (GST-2195) (#4243) ...

* Scan files git calls binary for secrets before push and in pregate (GST-2195)

A NUL byte, UTF-16 text or a -diff attribute made git print 'Binary files differ', so a token in that file passed pregate's secrets check and the pre-push hook. Both diffs now use --text and read such files through scannableText, keeping only credential findings; pregate's secrets check also fails closed when its merge-base diff does not finish.

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* Find tokens in UTF-16 text that is mostly Cyrillic or CJK, and note the size limit for binaries

Review-Finding: p1/red-team#1 reader=red-team
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* Read each line of a binary file both plainly and as UTF-16, so a nearby byte cannot hide a token

Review-Finding: p2/specialist-batched#1 reader=specialist-batched
Review-Finding: p2/red-team#1 reader=red-team
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* Keep tokens beside CJK characters in UTF-16 files whole, and parse large added diffs in linear time

Review-Finding: p2v/outside-voice#1 reader=outside-voice
Review-Finding: p2v/targeted#1 reader=targeted
Review-Finding: p2v/outside-voice#2 reader=outside-voice
Review-Finding: p2v/adversarial-native#1 reader=adversarial-native
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* Split two long sentences in the changelog entry for binary-file scanning

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* Describe how the secret check reads binary files, its size limits and its new pass line

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* Say which UTF-16 layouts the binary-file secret scan does not catch yet

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

---------

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

2026-11-09 22:52:26 +00:00

..

checks

Catch secrets in files git treats as binary before they are pushed (GST-2195) (#4243)

2026-11-09 22:52:26 +00:00

allowlist.ts

v1.92.8.0 fix(redact): env.kv reads Python, Dart and JSX source syntax as code (#3630) (#3742)

2026-11-01 01:50:36 +00:00

config.ts

v1.94.17.0 ci-carry: guard carry, jobs-mapped lanes, aliases, per-file carry of runner-skipped files, path-skipped jobs (GST-1186, GST-1189, GST-1190) (#3929)

2026-11-03 14:14:50 +00:00

context.ts

v1.93.33.0 wave(review): #3705 #3744 #3745 #3764 #3765 #3795 (#3852)

2026-11-03 01:40:07 +00:00

django.ts

v1.91.161.0 fix(pregate): Django, Dart, asset and tool-config lanes; init drafts from the repo (#3266-#3269) (#3306)

2026-10-20 01:38:26 +00:00

docs-lane.ts

fix(pregate): waive version-stamp-only manifests from the lanes check (GBRA-95) (#3461)

2026-10-26 12:14:55 +00:00

docs-only-lane.ts

Let pull requests that only change human-facing docs skip the test suites (GST-1951) (#4178)

2026-11-09 01:42:33 +00:00

environment.ts

v1.91.254.0 pregate: starter policy, benign-finding allowlist, environment vs diff failures, per-run scratch (#3480)

2026-10-26 20:17:41 +00:00

flaky-exception.ts

v1.94.9.0 feat(pregate): owner-granted flaky exception for named cases in a red run (GST-1096) (#3911)

2026-11-03 08:34:42 +00:00

head-policy.ts

ship accept: a lanes-only head policy gates the final tree; owner-granted test-lane exception (GST-1595) (#4061)

2026-11-06 10:16:00 +00:00

import-graph.ts

v1.91.348.0 pregate: map tests to dotfiles named in quoted literals (GST-246) (#3661)

2026-10-31 02:58:48 +00:00

index.ts

Let pull requests that only change human-facing docs skip the test suites (GST-1951) (#4178)

2026-11-09 01:42:33 +00:00

init-draft.ts

v1.93.15.0 fix(pregate): pytest, Playwright and mixed-language runners; literals stops flagging stray digits (#3598, #3492) (#3741)

2026-11-02 19:23:49 +00:00

lane-selection.ts

test-impact: tracer and reuse keys for free tests; pregate keeps main's always-run list (GST-167 PR 2, GST-233) (#3801)

2026-11-05 00:43:21 +00:00

regate.ts

v1.91.98.0 fix: plan obligations meet repo gates; priced paid gates; machine-proved restamps (field wave C, items 14-17) (#3166)

2026-10-13 15:38:41 +00:00

remote-receipt.ts

v1.91.336.0 ship-queue: assign VERSION/CHANGELOG at merge time (changelog fragments + gstack-ship-queue land) (#3594)

2026-10-30 16:54:58 +00:00

run-check.ts

Let a repository name its own docs-only paths in its ship policy (GST-1974) (#4185)

2026-11-09 04:14:37 +00:00

run-scratch.ts

v1.91.254.0 pregate: starter policy, benign-finding allowlist, environment vs diff failures, per-run scratch (#3480)

2026-10-26 20:17:41 +00:00

runtime.ts

v1.94.44.0 fix(install): a child's install for another workflow no longer drops /ship's install verdict (GST-1233) (#3960)

2026-11-03 22:58:53 +00:00

rust.ts

v1.91.197.0 fix(pregate): Rust crate lanes and nested JS package runners (#3344, port of #3346) (#3380)

2026-10-25 06:25:53 +00:00

stamp-only.ts

fix(pregate): waive version-stamp-only manifests from the lanes check (GBRA-95) (#3461)

2026-10-26 12:14:55 +00:00

starter.ts

v1.92.35.0 fix(pregate): a timeout-only policy keeps lane verdicts, warn lanes runs the tests, [] keeps removed-test suites (GST-775) (#3792)

2026-11-01 16:28:03 +00:00

supervise.ts

v1.93.35.0 fix: pregate no longer kills a quiet test suite that is busy working (GST-1095) (#3899)

2026-11-03 01:59:44 +00:00

types.ts

v1.94.0.0 ship: CI is the one full test run (CI carry, tree cache, /ship beside CI) (#3901)

2026-11-03 04:02:41 +00:00

workflows.ts

v1.93.1.0 fix(pregate): clear --run-url accepts a reusable-workflow lane's caller run (GST-971) (#3865)

2026-11-02 14:59:10 +00:00