[PR #64] [MERGED] fix(publish): catch OpenAI project keys and GitHub fine-grained tokens #94

New issue

Closed

opened 2026-10-15 20:53:21 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 20:53:21 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/rehan-remade/universal-modder/pull/64
Author: @kevin9327
Created: 10/5/2026
Status: ✅ Merged
Merged: 10/5/2026
Merged by: @rehan-remade

Base: main ← Head: fix/secret-key-formats

📝 Commits (1)

dcd1c6d fix(publish): catch OpenAI project keys and GitHub fine-grained tokens

📊 Changes

2 files changed (+22 additions, -2 deletions)

View changed files

📝 tests/test_um.py (+18 -0)
📝 um/publish.py (+4 -2)

📄 Description

um publish check and um kb check share SECRET_PATTERNS, and two of the patterns only match older key formats:

OpenAI: sk-(?:proj-)?[A-Za-z0-9]{32,} wants 32 plain alphanumerics right after the prefix. Project keys (sk-proj-…) have - and _ in their body, so a key is missed whenever one of those shows up in its first 32 characters, which happens for most keys. Service-account (sk-svcacct-…) and admin (sk-admin-…) keys never match.
GitHub: only classic tokens (ghp_, gho_, ghu_, ghs_, ghr_) are recognized. Fine-grained personal access tokens (github_pat_…), which GitHub now suggests by default, pass the check.

So a mod folder or a field note with one of these keys in it gets PASS.

Change:

OpenAI: prefixed keys (proj, svcacct, admin) accept [A-Za-z0-9_-] in the body. Legacy sk- keys keep the old alphanumeric-only rule, so kebab-case text like sk-learn-… still doesn't match.
GitHub: also match github_pat_ followed by 60+ token characters.

Tests: added test_secret_patterns_catch_current_key_formats (fixtures assembled at runtime like the existing publish test, so the repo's own publish check stays clean) and a negative case. Three of the new cases fail on main and pass with this change.

uv run --with pytest pytest -q tests   # 57 passed
./bin/um publish check .                # 0 failures (same single existing warning as main)
./bin/um kb check --index               # PASS: 44 notes checked

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/rehan-remade/universal-modder/pull/64 **Author:** [@kevin9327](https://github.com/kevin9327) **Created:** 10/5/2026 **Status:** ✅ Merged **Merged:** 10/5/2026 **Merged by:** [@rehan-remade](https://github.com/rehan-remade) **Base:** `main` ← **Head:** `fix/secret-key-formats` --- ### 📝 Commits (1) - [`dcd1c6d`](https://github.com/rehan-remade/universal-modder/commit/dcd1c6d010974c517bdda286392a9bc4f7edf3b3) fix(publish): catch OpenAI project keys and GitHub fine-grained tokens ### 📊 Changes **2 files changed** (+22 additions, -2 deletions) <details> <summary>View changed files</summary> 📝 `tests/test_um.py` (+18 -0) 📝 `um/publish.py` (+4 -2) </details> ### 📄 Description `um publish check` and `um kb check` share `SECRET_PATTERNS`, and two of the patterns only match older key formats: - **OpenAI**: `sk-(?:proj-)?[A-Za-z0-9]{32,}` wants 32 plain alphanumerics right after the prefix. Project keys (`sk-proj-…`) have `-` and `_` in their body, so a key is missed whenever one of those shows up in its first 32 characters, which happens for most keys. Service-account (`sk-svcacct-…`) and admin (`sk-admin-…`) keys never match. - **GitHub**: only classic tokens (`ghp_`, `gho_`, `ghu_`, `ghs_`, `ghr_`) are recognized. Fine-grained personal access tokens (`github_pat_…`), which GitHub now suggests by default, pass the check. So a mod folder or a field note with one of these keys in it gets `PASS`. Change: - OpenAI: prefixed keys (`proj`, `svcacct`, `admin`) accept `[A-Za-z0-9_-]` in the body. Legacy `sk-` keys keep the old alphanumeric-only rule, so kebab-case text like `sk-learn-…` still doesn't match. - GitHub: also match `github_pat_` followed by 60+ token characters. Tests: added `test_secret_patterns_catch_current_key_formats` (fixtures assembled at runtime like the existing publish test, so the repo's own publish check stays clean) and a negative case. Three of the new cases fail on `main` and pass with this change. ``` uv run --with pytest pytest -q tests # 57 passed ./bin/um publish check . # 0 failures (same single existing warning as main) ./bin/um kb check --index # PASS: 44 notes checked ``` --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-15 20:53:21 +00:00