feat(security): allow reviewed image-secret false positives

kiyi commented

2026-09-18 22:09:31 -05:00

Member

ComfyUI run 72 is blocked by public yt-dlp client constants/test URLs detected as image secrets. Add an opt-in, exact-fingerprint false-positive review for image trivy-secret findings: classification=false_positive plus an HTTPS evidence link, existing owner/control/issue/expiry, and an immutable image/build-input subject. Normal secret mitigations still block; Gitleaks, malware and scanner failures remain non-waivable. Reports retain the classification and evidence. Human review must establish that a value is not private; the gate cannot infer that from its format.

Validation: all 152 workflow tests passed on Linux, including new negative cases for source subjects, ordinary waivers, changed fingerprints, missing review fields, Gitleaks and malware.

Owner explicitly authorized this scoped policy change. After review/merge, publish a new immutable minor release (proposed v1.13.0); ComfyUI must adopt it before its new exception fields can be evaluated. No release or full image job was dispatched. Related: Homelab/Comfy-UI#1

ComfyUI run 72 is blocked by public yt-dlp client constants/test URLs detected as image secrets. Add an opt-in, exact-fingerprint false-positive review for image trivy-secret findings: classification=false_positive plus an HTTPS evidence link, existing owner/control/issue/expiry, and an immutable image/build-input subject. Normal secret mitigations still block; Gitleaks, malware and scanner failures remain non-waivable. Reports retain the classification and evidence. Human review must establish that a value is not private; the gate cannot infer that from its format. Validation: all 152 workflow tests passed on Linux, including new negative cases for source subjects, ordinary waivers, changed fingerprints, missing review fields, Gitleaks and malware. Owner explicitly authorized this scoped policy change. After review/merge, publish a new immutable minor release (proposed v1.13.0); ComfyUI must adopt it before its new exception fields can be evaluated. No release or full image job was dispatched. Related: https://git.gitchegumi.com/Homelab/Comfy-UI/issues/1

kiyi added 1 commit

2026-09-18 22:09:31 -05:00

feat(security): allow reviewed image-secret false positives

Workflow acceptance / acceptance (pull_request) Successful in 2m47s

Details

Library checks / tests (pull_request) Successful in 4m2s

Details

Repository security / security (pull_request) Has been cancelled

Details

Repository security / security-1 (pull_request) Has been cancelled

Details

817187b617