Skip to content

Feat/gitlab release scan - #755

Merged
frjcomp merged 7 commits into
mainfrom
feat/gitlab-release-scan
Oct 20, 2026
Merged

Feat/gitlab release scan#755
frjcomp merged 7 commits into
mainfrom
feat/gitlab-release-scan

Conversation

@frjcomp

@frjcomp frjcomp commented Oct 20, 2026

Copy link
Copy Markdown
Collaborator

No description provided.

frjcomp and others added 2 commits October 20, 2026 07:07
@frjcomp
feat(gitlab): scan release assets for secrets
d2534cc 
Add SDK-backed release discovery, bounded credential-safe downloads, and archive scanning with release provenance. Include configuration, documentation, and unit and end-to-end coverage.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@frjcomp
chore(devcontainer): include GitHub CLI feature
675a890 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot AI balanced review requested due to automatic review settings October 20, 2026 07:10
Copilot AI reviewed Oct 20, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Executable classification and ASCII-only preprocessing leave release scan coverage incomplete or produce truncated credentials.

2 open issues
What changed in this PR

Adds GitLab release-asset secret scanning to Pipeleek’s existing CLI and detection engine.

Changes:

  • Adds project/release filters, optional source scanning, and Web UI integration.
  • Implements guarded downloads and bounded nested-archive processing.
  • Adds tests, configuration documentation, and GitHub CLI development tooling.
File Description
tests/​e2e/​gitlab/​release/​scan_test.go Tests release scanning end to end.
pkg/​scan/​artifact/​release.go Processes release files and nested archives.
pkg/​scan/​artifact/​release_test.go Tests processing limits and detection.
pkg/​gitlab/​release/​scan/​scanner.go Discovers releases and coordinates scanning.
pkg/​gitlab/​release/​scan/​scanner_test.go Tests discovery, pagination, and validation.
pkg/​gitlab/​release/​scan/​download.go Downloads assets with credential and size controls.
pkg/​gitlab/​release/​scan/​download_test.go Tests download safeguards and failures.
pkg/​docs/​release_test.go Tests generated command documentation.
pkg/​config/​gen/​release_test.go Tests release configuration generation.
internal/​cmd/​gitlab/​release/​scan/​scan.go Defines scan flags and command execution.
internal/​cmd/​gitlab/​release/​scan/​scan_test.go Tests bindings and configuration precedence.
internal/​cmd/​gitlab/​release/​release.go Adds the release command group.
internal/​cmd/​gitlab/​release/​release_test.go Tests scan command registration.
internal/​cmd/​gitlab/​gitlab.go Registers release commands under GitLab.
internal/​cmd/​gitlab/​gitlab_test.go Checks the release command path.
docs/​introduction/​configuration.md Documents release configuration settings.
docs/​guides/​gitlab.md Explains usage, coverage, and safeguards.
.devcontainer/​devcontainer.json Adds GitHub CLI tooling.

Review effort: Balanced

Comment thread pkg/scan/artifact/release.go Outdated
Comment thread pkg/scan/artifact/release.go Outdated
frjcomp
frjcomp commented Oct 20, 2026
View reviewed changes
Comment thread docs/guides/gitlab.md
Comment thread docs/introduction/configuration.md Outdated
Comment thread pkg/gitlab/release/scan/download.go
Comment thread pkg/gitlab/release/scan/scanner.go
Comment thread pkg/scan/artifact/release.go Outdated
@frjcomp
fix(gitlab): simplify release scanning and refine failure logging
f77d27d 
Reuse shared artifact scanning and the standard HTTP client, preserve binary and UTF-8 scanning, and address release scan review feedback.

Silently skip unavailable assets, downgrade detection timeouts to warnings, and synchronize documentation and regression tests.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
frjcomp
frjcomp commented Oct 20, 2026
View reviewed changes
Comment thread docs/guides/gitlab.md Outdated
Comment thread pkg/gitlab/release/scan/download.go
Comment thread pkg/gitlab/release/scan/download.go
Comment thread pkg/gitlab/release/scan/download.go Outdated
Comment thread pkg/gitlab/release/scan/download.go
Comment thread pkg/gitlab/release/scan/download.go Outdated
Comment thread pkg/gitlab/release/scan/download.go Outdated
Comment thread pkg/scanner/artifact/artifact.go
frjcomp and others added 2 commits October 20, 2026 09:16
@frjcomp
refactor(gitlab): reuse release scan infrastructure
d31f1de 
Reuse SDK asset links, bounded concurrency and shared artifact scanning; simplify command setup and URL handling while retaining same-origin download authentication.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@frjcomp
fix(scan): restore artifact and repository debug logs
9298ff0 
Restore binary string-extraction diagnostics and log repository URLs during release scanning, with debug-level e2e coverage.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@frjcomp
frjcomp requested a balanced review from Copilot October 20, 2026 11:14
@frjcomp
fix(gitlab): increase release timeout and report project URLs
ae06abf 
Default release hit detection to two minutes while preserving explicit overrides, and use project web URLs consistently in release scan logs and findings.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot AI reviewed Oct 20, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Existing pipeline scans silently lose per-file scanning errors after the shared artifact refactor.

2 open issues
2 resolved since last review

Review effort: Balanced

Comment thread internal/cmd/gitlab/release/scan/scan.go
Comment thread pkg/scan/artifact/processor.go
@frjcomp
fix(scan): report per-file artifact scanning failures
6895d18 
Restore diagnostics for nested extraction errors and detection timeouts while preserving sibling processing and ZIP-level error handling.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@frjcomp
frjcomp requested a balanced review from Copilot October 20, 2026 11:32
Copilot AI reviewed Oct 20, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 Needs a closer look

The cross-platform artifact refactor needs runtime validation and human review, and a redirect credential-isolation issue remains unresolved.

No open issues 🎉

1 previously missed issue

In code that hasn't changed since last review

Medium severity Clear Referer on cross-origin redirects to prevent credential leakage

pkg/​gitlab/​release/​scan/​download.go:30

Go sets Referer from the previous request URL before calling CheckRedirect (except on HTTPS-to-HTTP redirects). A cross-origin redirect from /download?signature=sensitive therefore sends the signed query to the destination in Referer, even though PRIVATE-TOKEN is removed. Clear Referer on redirects and extend the credential-isolation test to assert that it is absent.

2 resolved since last review

Review effort: Balanced

@frjcomp
frjcomp enabled auto-merge (squash) October 20, 2026 11:39
@frjcomp
frjcomp merged commit 904ae9a into main Oct 20, 2026
14 checks passed
@frjcomp
frjcomp deleted the feat/gitlab-release-scan branch October 20, 2026 11:48
@frjcomp frjcomp mentioned this pull request Oct 20, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@frjcomp