Skip to content

fix: scope install security scan to deployable content - #2598

Open
Aryan Singh K. (aryansk) wants to merge 1 commit into
microsoft:mainfrom
aryansk:fix/2490-security-scan-deployable-files
Open

fix: scope install security scan to deployable content#2598
Aryan Singh K. (aryansk) wants to merge 1 commit into
microsoft:mainfrom
aryansk:fix/2490-security-scan-deployable-files

Conversation

@aryansk

Copy link
Copy Markdown

Closes #2490

Summary

  • allow SecurityGate.scan_files callers to restrict which paths are scanned
  • scope the install pre-deploy blocker to deployable APM/plugin primitive paths instead of the entire fetched source tree
  • clarify that a failed install may remove the fetched source checkout
  • add regression coverage separating deployable content from source-only fixtures/docs

Validation

  • patch syntax and application context were checked against current main
  • repository tests could not be executed in this chat environment; CI should run the project test suite

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

This PR narrows the pre-deploy security scan to “deployable” package content by introducing a path filter in the security gate and defining deployable-path heuristics, with accompanying unit tests.

Changes:

  • Add an optional path_filter callback to SecurityGate.scan_files to skip scanning non-matching files.
  • Define _is_deployable_source_path and deployable path patterns used by the install pre-deploy scan.
  • Add unit tests covering deployable vs source-only paths and Windows path normalization.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File Description
tests/unit/install/test_security_scan_scope.py Adds tests for deployable-path detection logic and path normalization.
src/apm_cli/security/gate.py Adds path_filter to optionally exclude files from scanning.
src/apm_cli/install/helpers/security_scan.py Implements deployable path heuristics and wires filtering into the pre-deploy scan.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment on lines +84 to 86
path_filter=None,
) -> ScanVerdict:
"""Walk *root*, scan every regular file, return a verdict.
@@ -96,6 +97,8 @@ def scan_files(
if fpath.is_symlink():
continue
rel = portable_relpath(fpath, root)
@@ -0,0 +1,29 @@
from apm_cli.install.helpers.security_scan import _is_deployable_source_path
Comment on lines +70 to +75
verdict = SecurityGate.scan_files(
install_path,
policy=BLOCK_POLICY,
force=force,
path_filter=_is_deployable_source_path,
)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[BUG] Install security scan flags hidden characters in files that are never deployed (repo-wide scan vs deployable primitives)

2 participants