fix(forks): detect secrets referenced from advanced-mode fields - #6566
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
PR SummaryMedium Risk Overview Detection previously shared the resource-id ownership gate ( Reviewed by Cursor Bugbot for commit 1326701. Configure here. |
Greptile SummaryThis PR fixes workspace-fork promotion scanning so environment variables referenced by active advanced-mode fields and their active dependents are treated as required mappings.
Confidence Score: 5/5The PR appears safe to merge, with the revised reference scan matching canonical execution semantics and no actionable regressions identified. Active advanced values and their dependents now contribute live environment-variable requirements, while dormant and condition-hidden values remain excluded and manual resource IDs retain their existing escape-hatch behavior.
|
| Filename | Overview |
|---|---|
| apps/sim/ee/workspace-forking/lib/remap/remap-references.ts | Separates environment-variable detection from manual resource-ID suppression while retaining dormant and condition-hidden execution gates. |
| apps/sim/ee/workspace-forking/lib/remap/remap-references.test.ts | Adds focused regression tests covering active, dormant, hidden, inferred-mode, mapped, and resource-ID coexistence cases. |
Flowchart
%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[Inspect subblock value] --> B{Dormant or condition-hidden?}
B -- Yes --> C[Do not record ENV reference]
B -- No --> D[Record ENV reference]
D --> E{Resolver maps key?}
E -- Yes --> F[Rewrite to target ENV key]
E -- No --> G[Add required unmapped reference]
G --> H[Block promotion until mapped]
A --> I{User-owned manual resource ID?}
I -- Yes --> J[Keep resource ID verbatim]
Reviews (1): Last reviewed commit: "fix(forks): detect secrets referenced fr..." | Re-trigger Greptile
Summary
{{ENV}}detection in the fork reference scan shared one gate withresource-id detection, so a secret referenced from an ACTIVE advanced
(manual) canonical member — e.g. a
{{SLACK_CHANNEL}}typed into Slack'sadvanced "Channel ID" — was never recorded as a reference.
Three consequences, all silent:
could not be mapped across workspaces at all.
promote-planbuildsunmappedRequiredfrom the same scan, so therequired-env sync gate never fired for it.
{{KEY}}that resolves to nothing at runtime. The identical reference ina basic-mode field would have hard-blocked the same push.
Detection now gates on EXECUTION rather than ownership. A dormant member
and a condition-hidden field still go undetected — they never run, so they
must not become sync blockers — but an active manual member is exactly the
value that does run, and its key is a live secret reference like any other.
Resource-id detection keeps the
verbatimManualpolicy unchanged, so ahand-typed credential/KB id stays a user-owned escape hatch. This also
reconciles the two halves of the pass:
remapEnvInValuealready rewrote amanual member's ref unconditionally while detection suppressed it.
Pins the fix with cases for explicit
canonicalModesand the valueheuristic, rewrite/detect agreement on a mapped key, both still-undetected
paths, and the resource-id escape hatch surviving alongside env detection.
Type of Change
Testing
Tested manually
Checklist