Sync mirror main with upstream main#18
Closed
michaelmeaney wants to merge 3 commits into
Closed
Conversation
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Update cryptography, PyJWT, aiohttp, idna, and Pygments to versions containing security and compatibility fixes.\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Author
|
Closing this obsolete sync PR. The exact upstream tree is now available on the stable upstream-main branch, which will become the repository default branch. |
There was a problem hiding this comment.
Pull request overview
Synchronizes this mirror repository’s main branch to match the upstream Attuned-Corp/guardette:main state (at the referenced upstream commit), effectively replacing prior mirror-specific additions with upstream’s current implementation.
Changes:
- Removes previously introduced observability subsystem (package, middleware, config, tests, and related docs/env vars).
- Simplifies
pseudonymize_emailback to salt+SHA-256 only (removing algorithm selection and HMAC mode), with corresponding config/doc/test updates. - Updates CI/security automation and dependency management configuration to match upstream (workflows, lockfiles, auxiliary tooling configs).
Reviewed changes
Copilot reviewed 28 out of 30 changed files in this pull request and generated 8 comments.
Show a summary per file
| File | Description |
|---|---|
| tests/test_secrets.py | Simplifies imports and removes AWS secret-cache expiry/error-wrapping tests that existed in the mirror branch. |
| tests/test_pseudonymize_email.py | Removes tests for HMAC pseudonymization mode and related config validation. |
| tests/test_proxy.py | Removes tests for accept-encoding stripping and auth/upstream metrics classification. |
| tests/test_observability.py | Removes observability module tests (feature flags, safe logging/headers, metrics). |
| tests/test_config.py | Removes config assertions/tests related to pseudonymization algorithm selection. |
| tests/test_auth.py | Removes tests for basic/bearer/GCP auth handlers that existed in the mirror branch. |
| src/guardette/proxy.py | Reworks request logging/correlation handling and removes observability hooks/metrics; changes header stripping behavior. |
| src/guardette/observability/middleware.py | Deletes observability middleware implementation. |
| src/guardette/observability/headers.py | Deletes safe header allowlist/sanitization logic. |
| src/guardette/observability/events.py | Deletes structured event + metrics event emitter implementation. |
| src/guardette/observability/config.py | Deletes observability configuration/env parsing. |
| src/guardette/observability/init.py | Deletes configure_observability integration entrypoint. |
| src/guardette/logging.py | Replaces prior constrained/observability-aware logging with a simpler JSON formatter and unconditional handler setup. |
| src/guardette/default_auth/init.py | Adjusts import lint suppression comment to match upstream. |
| src/guardette/default_actions/pseudonymize_email.py | Removes HMAC/strategy abstraction; uses salt+SHA-256 only and simplifies config validation. |
| src/guardette/constants.py | Removes the request-id header constant used by the deleted observability feature. |
| src/guardette/config.py | Removes pseudonymize-algorithm and HMAC-key config parsing/validation. |
| README.md | Updates environment variable documentation to remove observability + HMAC algorithm details. |
| pyproject.toml | Adjusts dependency constraints (e.g., idna minimum version). |
| poetry.toml | Removes solver min-release-age configuration. |
| poetry.lock | Updates lockfile hash to reflect dependency/config changes. |
| docs/REDACTION.md | Updates pseudonymize_email documentation to reflect salt-only hashing and removes algorithm/HMAC guidance. |
| docker-compose.yml | Removes pseudonymize algorithm + HMAC key env wiring. |
| .pinact.yml | Removes pinact configuration. |
| .gitignore | Removes .codeql/ ignore entry. |
| .github/workflows/security.yml | Removes the security workflow (zizmor/codeql/actionlint) present in the mirror branch. |
| .github/workflows/ci.yaml | Replaces the prior pinned/hardened CI workflow with a simplified upstream workflow. |
| .github/dependabot.yml | Removes Dependabot configuration. |
| .env.example | Removes observability and HMAC-related example environment variables. |
| .client/adr/observability-options.md | Removes the observability ADR document. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
39
to
46
| STRIP_REQUEST_HEADERS = { | ||
| PROXY_HOST_HEADER.lower(), | ||
| "authorization", | ||
| "host", | ||
| "connection", | ||
| "content-length", | ||
| "transfer-encoding", | ||
| "accept-encoding", | ||
| } |
| extra={ | ||
| "correlation_id": correlation_id, | ||
| "method": request.method, | ||
| "url": str(request.url), |
| "rule_count": sum(len(source.rules) for source in self.policy.sources), | ||
| }, | ||
| ) | ||
| logger.info("Guardette policy loaded", extra={"policy": json.dumps(self.policy.model_dump())}) |
| extra={ | ||
| "correlation_id": correlation_id, | ||
| "error_class": type(ge).__name__, | ||
| "exception": str(ge), |
| extra={ | ||
| "correlation_id": correlation_id, | ||
| "error_class": type(exc).__name__, | ||
| "exception": str(exc), |
Comment on lines
+22
to
31
| # Include other extra attributes | ||
| extra_attributes = ( | ||
| set(record.__dict__.keys()) | ||
| - set(logging.LogRecord(None, None, None, None, "", (), None).__dict__.keys()) | ||
| - {"exc_info"} | ||
| ) | ||
| for key in extra_attributes: | ||
| if key not in log_record: | ||
| log_record[key] = record.__dict__.get(key) | ||
|
|
Comment on lines
+42
to
+46
| # Console Handler | ||
| console_handler = logging.StreamHandler(sys.stdout) | ||
| console_handler.setLevel(log_level) | ||
| console_handler.setFormatter(formatter) | ||
| logger.addHandler(console_handler) |
| python -m pip install --user poetry==2.4.1 | ||
| echo "$HOME/.local/bin" >> "$GITHUB_PATH" | ||
|
|
||
| uses: actions/checkout@v6 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Attuned-Corp/guardette:mainatf9cc700.The recent mirror work is preserved in local safety refs and
stash@{0}and will be recreated as follow-up stacked PRs after this sync merges.