From 54e7c1d56205a7c101f1c60524ddcf3bfcc3467f Mon Sep 17 00:00:00 2001 From: Keval Morabia <28916987+kevalmorabia97@users.noreply.github.com> Date: Sun, 9 Aug 2026 07:44:55 -0700 Subject: [PATCH] Mark the MLflow test's fake credentials for TruffleHog The nightly secret scan still fails after the lob exclusion: verified findings dropped 63 -> 0, but two unverified URI results remain, and --results=verified,unknown fails on those too. Both come from tests/unit/torch/utils/test_mlflow.py, whose fixtures embed credentials in a URI so the tests can assert they are masked. Hoisting them into two named constants puts the trufflehog:ignore marker on one short line each -- the marker only applies to the line containing the match, and a trailing comment on every use site would have exceeded the 100 char limit. Narrow on purpose: unlike lob, the URI detector is worth keeping active. A real scheme://user:pass@host leak is plausible in this repo, so the fixtures are annotated rather than the detector disabled. Co-Authored-By: Claude Opus 5 Signed-off-by: Keval Morabia <28916987+kevalmorabia97@users.noreply.github.com> --- tests/unit/torch/utils/test_mlflow.py | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/tests/unit/torch/utils/test_mlflow.py b/tests/unit/torch/utils/test_mlflow.py index 5e54b5fcc2c..6c95351c130 100644 --- a/tests/unit/torch/utils/test_mlflow.py +++ b/tests/unit/torch/utils/test_mlflow.py @@ -33,6 +33,11 @@ ) URI = "https://mlflow.example.com" +# Fake credentials for the redaction tests. TruffleHog's URI detector flags any +# scheme://user:pass@host, so the marker sits on the definitions; these tests exist +# precisely to prove such credentials are masked. +CREDS_URI = "https://user:tok@mlflow.example.com" # trufflehog:ignore +SHORT_CREDS_URI = "https://u:tok@host" # trufflehog:ignore class FakeMlflow: @@ -409,7 +414,7 @@ def test_unreachable_server_fails_before_the_work_starts(monkeypatch): (["--password", "hunter2", "--verbose"], ["--password", "***", "--verbose"]), # Credentials embedded in a URI are masked wherever they appear. ( - ["--mlflow", "https://user:tok@mlflow.example.com"], + ["--mlflow", CREDS_URI], ["--mlflow", "https://***@mlflow.example.com"], ), # Ordinary arguments are untouched, including values that merely contain the word. @@ -426,7 +431,7 @@ def test_redact_argv_masks_credentials(argv, expected): def test_command_artifact_carries_no_secrets(fake_mlflow, monkeypatch): """argv reaches the server as command.txt, so secrets in it must not.""" monkeypatch.setattr( - sys, "argv", ["run.py", "--hf_token", "hf_abc123", "--mlflow", "https://u:tok@host"] + sys, "argv", ["run.py", "--hf_token", "hf_abc123", "--mlflow", SHORT_CREDS_URI] ) logger = _logger() @@ -444,9 +449,7 @@ def test_params_and_run_url_mask_credentials(monkeypatch): fake = FakeMlflow() monkeypatch.setitem(sys.modules, "mlflow", fake) monkeypatch.setattr(sys, "argv", ["run.py"]) - logger = MlflowRunLogger( - "https://user:tok@mlflow.example.com", "tester/hf_ptq/m-nvfp4", run_name="masked" - ) + logger = MlflowRunLogger(CREDS_URI, "tester/hf_ptq/m-nvfp4", run_name="masked") logger.start(params={"hf_token": "secret", "endpoint": "https://u:p@host", "qformat": "nvfp4"}) url = logger.run_url @@ -455,7 +458,7 @@ def test_params_and_run_url_mask_credentials(monkeypatch): assert fake.params == {"hf_token": "***", "endpoint": "https://***@host", "qformat": "nvfp4"} assert "tok" not in url and "https://***@mlflow.example.com" in url # The real URI is still what talks to the server. - assert fake.tracking_uri == "https://user:tok@mlflow.example.com" + assert fake.tracking_uri == CREDS_URI def test_failure_after_start_run_does_not_orphan_the_run(monkeypatch):