Skip to content

Mark the MLflow test's fake credentials for TruffleHog #2118

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kevalmorabia97 merged 1 commit into from
Aug 10, 2026
Merged

Mark the MLflow test's fake credentials for TruffleHog #2118

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 9 additions & 6 deletions tests/unit/torch/utils/test_mlflow.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,11 @@
)

URI = "https://mlflow.example.com"
# Fake credentials for the redaction tests. TruffleHog's URI detector flags any
# scheme://user:pass@host, so the marker sits on the definitions; these tests exist
# precisely to prove such credentials are masked.
CREDS_URI = "https://user:tok@mlflow.example.com" # trufflehog:ignore
SHORT_CREDS_URI = "https://u:tok@host" # trufflehog:ignore


class FakeMlflow:
Expand Down Expand Up @@ -409,7 +414,7 @@ def test_unreachable_server_fails_before_the_work_starts(monkeypatch):
(["--password", "hunter2", "--verbose"], ["--password", "***", "--verbose"]),
# Credentials embedded in a URI are masked wherever they appear.
(
["--mlflow", "https://user:tok@mlflow.example.com"],
["--mlflow", CREDS_URI],
["--mlflow", "https://***@mlflow.example.com"],
),
# Ordinary arguments are untouched, including values that merely contain the word.
Expand All @@ -426,7 +431,7 @@ def test_redact_argv_masks_credentials(argv, expected):
def test_command_artifact_carries_no_secrets(fake_mlflow, monkeypatch):
"""argv reaches the server as command.txt, so secrets in it must not."""
monkeypatch.setattr(
sys, "argv", ["run.py", "--hf_token", "hf_abc123", "--mlflow", "https://u:tok@host"]
sys, "argv", ["run.py", "--hf_token", "hf_abc123", "--mlflow", SHORT_CREDS_URI]
)
logger = _logger()

Expand All @@ -444,9 +449,7 @@ def test_params_and_run_url_mask_credentials(monkeypatch):
fake = FakeMlflow()
monkeypatch.setitem(sys.modules, "mlflow", fake)
monkeypatch.setattr(sys, "argv", ["run.py"])
logger = MlflowRunLogger(
"https://user:tok@mlflow.example.com", "tester/hf_ptq/m-nvfp4", run_name="masked"
)
logger = MlflowRunLogger(CREDS_URI, "tester/hf_ptq/m-nvfp4", run_name="masked")

logger.start(params={"hf_token": "secret", "endpoint": "https://u:p@host", "qformat": "nvfp4"})
url = logger.run_url
Expand All @@ -455,7 +458,7 @@ def test_params_and_run_url_mask_credentials(monkeypatch):
assert fake.params == {"hf_token": "***", "endpoint": "https://***@host", "qformat": "nvfp4"}
assert "tok" not in url and "https://***@mlflow.example.com" in url
# The real URI is still what talks to the server.
assert fake.tracking_uri == "https://user:tok@mlflow.example.com"
assert fake.tracking_uri == CREDS_URI


def test_failure_after_start_run_does_not_orphan_the_run(monkeypatch):
Expand Down
Loading