Skip to content

Refactor workflow output redaction - #120

Merged
robbycochran merged 1 commit into
rc/refactor-openshell-capabilitiesfrom
rc/refactor-explicit-workflow-redaction
Sep 4, 2026
Merged

Refactor workflow output redaction#120
robbycochran merged 1 commit into
rc/refactor-openshell-capabilitiesfrom
rc/refactor-explicit-workflow-redaction

Conversation

@robbycochran

@robbycochran robbycochran commented Sep 4, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Collaborator

Replaces reflection-based cloning for structured workflow output with an explicit schema-aware copy.

Every string field is now reviewed at the redaction boundary, while provider config and sandbox environment maps continue to expose keys but never values.

Validation:

  • gofmt
  • git diff --check
  • actionlint .github/workflows/*.yml
  • bash -n on test scripts
  • Go tests are delegated to CI because the available local Go is 1.19 while this module requires Go 1.25.

Summary by CodeRabbit

  • Bug Fixes
    • Improved workflow configuration redaction to better protect interpolated values, including settings, arguments, payloads, and provider details.
    • Preserved the configuration’s structure and literal values so workflow information remains clear and useful.
    • Added coverage to verify consistent redaction across workflow components while leaving non-sensitive values unchanged.

@coderabbitai

coderabbitai Bot commented Sep 4, 2026 •
edited
Loading

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 53877032-dbef-49e7-bb25-3e7ae69cf02e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: a2c919f8-5c6a-47d2-859a-a2f9066fadd8

📥 Commits

Reviewing files that changed from the base of the PR and between dc86f5f and 7b76577.

📒 Files selected for processing (2)
  • cmd/workflow_apply.go
  • cmd/workflow_apply_test.go

Included review availability: Your plan provides up to 12 included reviews per hour; 6 remain after this review.

Walkthrough

The workflow redaction path now uses explicit configuration handling instead of reflection. It redacts interpolated values across nested workflow settings, preserves literal values, and avoids aliasing boolean pointers. Tests cover the updated behavior.

Changes

Workflow redaction

Layer / File(s) Summary
Explicit configuration redaction
cmd/workflow_apply.go		 The redaction path explicitly copies harness, target, provider, sandbox, and payload fields. Interpolated strings and string slices become <redacted>. Sensitive maps preserve keys while redacting values.
Nested redaction coverage
cmd/workflow_apply_test.go		 Tests verify redaction across workflow metadata, targets, inference, sandbox settings, agent arguments, sources, payloads, and providers. Literal values remain unchanged.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 7b765

Workflow output redaction now uses explicit schema-aware copies, redacting interpolated values while preserving safe structure and literal values. No current merge-blocking risk is identified.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 8.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 12 functions across 2 files. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and concisely describes the main change: refactoring workflow output redaction from reflection-based handling to explicit, schema-aware redaction.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches 💡 2
📝 Generate docstrings 💡
  • Create stacked PR
  • Commit on current branch
🛠️ Fix failing CI checks 💡
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch rc/refactor-explicit-workflow-redaction

Comment @coderabbitai help to get the list of available commands.

@robbycochran

robbycochran commented Sep 4, 2026

Copy link
Copy Markdown
Collaborator Author

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Sep 4, 2026 •
edited
Loading

Copy link
Copy Markdown
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@robbycochran
robbycochran force-pushed the rc/refactor-explicit-workflow-redaction branch from 7b76577 to 8588489 Compare September 4, 2026 00:12
@robbycochran
robbycochran force-pushed the rc/refactor-explicit-workflow-redaction branch from 8588489 to db8c946 Compare September 4, 2026 00:20
@robbycochran
robbycochran force-pushed the rc/refactor-explicit-workflow-redaction branch from db8c946 to 24d78af Compare September 4, 2026 00:27
@robbycochran
robbycochran merged commit aa7a6bc into main Sep 4, 2026
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@robbycochran