Skip to content

Fix API payload truncation, add client-secret action input, and cap workflow run pagination#25

Merged
Rishabh4275 merged 3 commits into
mainfrom
users/richawla/p4iStuff
Apr 7, 2026
Merged

Fix API payload truncation, add client-secret action input, and cap workflow run pagination#25
Rishabh4275 merged 3 commits into
mainfrom
users/richawla/p4iStuff

Conversation

@Rishabh4275

Copy link
Copy Markdown
Collaborator

Motivation and Context

  1. API payloads were silently truncated — A jsonReplacer intended for log sanitization was also used when serializing HTTP request bodies via JSON.stringify(payload, this.jsonReplacer). Any string field over 1,000 characters (file diffs, PR descriptions, commit details) was truncated to 100 characters + "... [truncated in logs]" in the
    actual API request, causing incomplete data to be sent to Purview.

  2. client-secret required an environment variable instead of an action inputclient-certificate was a proper action input (core.getInput), but client-secret was
    read from process.env['AZURE_CLIENT_SECRET']. This was inconsistent and required users to pass the secret via env: instead of with:.

  3. Workflow run history check had no pagination capfindLastProcessedCommitSha() paginated through all successful workflow runs with no upper bound. For repos with
    long histories this could result in excessive API calls, even though the query is already scoped to a single branch.

Description

Fix API payload truncation:

  • Removed this.jsonReplacer from all 5 JSON.stringify() calls that serialize HTTP request bodies in PurviewClient (processContentAsync, processContent,
    uploadSignal, searchTenantProtectionScope, searchUserProtectionScope). These now use plain JSON.stringify(payload).
  • Deleted the now-unused jsonReplacer method from PurviewClient. The logger's own jsonReplacer (in logger.ts) is unaffected and continues to handle log formatting
    separately.

Add client-secret action input:

  • Added client-secret as a new input in action.yml, alongside client-certificate.
  • Changed inputValidator.ts from process.env['AZURE_CLIENT_SECRET'] to core.getInput('client-secret').
  • Updated tests to use setupInputMocks({ 'client-secret': ... }) instead of setting the env var.
  • Updated workflow samples in sample/purview-scan.yml, README.md, sample/README.md, and Instructions.md to document and demonstrate the new input.

Cap workflow run pagination:

  • Added maxRuns = 20 limit to findLastProcessedCommitSha(). The loop now stops after checking 20 runs (2 pages of 10), which is sufficient since the query is already
    branch-scoped.

Contribution Checklist

  • The code builds clean without any errors or warnings
  • The PR follows the Contribution Guidelines
  • All unit tests pass (180/180), and existing tests were updated where needed
  • The dist/ folder has been rebuilt (npm run build && npm run package)
  • Is this a breaking change? If yes, add "[BREAKING]" prefix to the title of the PR.

@Rishabh4275 Rishabh4275 merged commit 8bb10d9 into main Apr 7, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants