Mark the MLflow test's fake credentials for TruffleHog

[kevalmorabia97]

What does this PR do?

Type of change: CI/CD bug fix

The nightly secret scan still fails (run). The lob exclusion worked — verified findings went 63 → 0 — but two unverified URI results remain, and --results=verified,unknown fails the job on those as well:

{"chunks": 2869, "verified_secrets": 0, "unverified_secrets": 2}
Found unverified URI result  x2   ->  exit 183

Both come from tests/unit/torch/utils/test_mlflow.py, which embeds credentials in a URI so the tests can assert they get masked:

(["--mlflow", "https://user:tok@mlflow.example.com"],
 ["--mlflow", "https://***@mlflow.example.com"]),

They arrived with #2023, which is why this is separate from the lob noise.

The fixtures are hoisted into two named constants so the trufflehog:ignore marker sits on one short line each. The marker only applies to the line containing the match, and a trailing comment on all four use sites would have blown the 100-character limit.

Deliberately narrow: unlike lob — irrelevant to this repo and reporting function names as verified — the URI detector is worth keeping. A real scheme://user:pass@host leak is plausible here, so the fixtures are annotated rather than the detector disabled.

Testing

tests/unit/torch/utils/test_mlflow.py: 54 passed, ruff check and format clean. A scan of all tracked files with the detector's own regex now reports 0 unmarked matches.

Only tonight's nightly can confirm the job goes green: the scan is diff-scoped on pull_request and full-history on schedule, which is why this class of failure never appears on a PR.

Before your PR is "Ready for review"

• Is this change backward compatible?: ✅
• If you copied code from any other sources or added a new PIP dependency, did you follow guidance in CONTRIBUTING.md: N/A
• Did you write any new necessary tests?: N/A — annotates existing test fixtures
• Did you update Changelog?: N/A
• Did you get Claude approval on this PR?: ❌ — not yet run

Summary by CodeRabbit

• Tests
  • Improved test coverage setup for credential-bearing URI redaction scenarios.
  • Confirmed masked outputs and command artifact behavior remain unchanged.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: f75381c8-191b-4d7d-9ac9-285b98f1076f

📥 Commits

Reviewing files that changed from the base of the PR and between 9b8caf6 and 54e7c1d.

📒 Files selected for processing (1)

• tests/unit/torch/utils/test_mlflow.py

---

📝 Walkthrough

Walkthrough

MLflow utility tests now use shared credential-bearing URI constants. The constants support URI redaction, command artifact, and tracking URI tests. Test behavior and expected masked outputs remain unchanged.

Changes

MLflow test fixture reuse

Layer / File(s)	Summary
Shared credential URI fixtures tests/unit/torch/utils/test_mlflow.py	Credential-bearing URI constants replace inline literals in redaction, command artifact, and tracking URI tests. TruffleHog suppression annotations accompany the fixtures.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: aanoosheh

🚥 Pre-merge checks | ✅ 6

✅ Passed checks (6 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes marking fake MLflow test credentials so TruffleHog ignores them.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Security Anti-Patterns	✅ Passed	The PR changes only tests/unit/torch/utils/test_mlflow.py; no modelopt or examples Python files changed, no prohibited constructs or # nosec comments were added.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch kmorabia/trufflehog-ignore-mlflow-fixtures

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.73%. Comparing base (9b8caf6) to head (54e7c1d).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2118   +/-   ##
=======================================
  Coverage   78.73%   78.73%           
=======================================
  Files         522      522           
  Lines       60342    60342           
=======================================
  Hits        47508    47508           
  Misses      12834    12834           

Flag	Coverage Δ
unit	55.30% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[github-actions]

PR Preview Action v1.8.1
Preview removed because the pull request was closed.
2026-08-10 06:37 UTC