Fix API payload truncation, add client-secret action input, and cap workflow run pagination#25
Merged
Merged
Conversation
eoindoherty1
approved these changes
Apr 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation and Context
API payloads were silently truncated — A
jsonReplacerintended for log sanitization was also used when serializing HTTP request bodies viaJSON.stringify(payload, this.jsonReplacer). Any string field over 1,000 characters (file diffs, PR descriptions, commit details) was truncated to 100 characters +"... [truncated in logs]"in theactual API request, causing incomplete data to be sent to Purview.
client-secretrequired an environment variable instead of an action input —client-certificatewas a proper action input (core.getInput), butclient-secretwasread from
process.env['AZURE_CLIENT_SECRET']. This was inconsistent and required users to pass the secret viaenv:instead ofwith:.Workflow run history check had no pagination cap —
findLastProcessedCommitSha()paginated through all successful workflow runs with no upper bound. For repos withlong histories this could result in excessive API calls, even though the query is already scoped to a single branch.
Description
Fix API payload truncation:
this.jsonReplacerfrom all 5JSON.stringify()calls that serialize HTTP request bodies inPurviewClient(processContentAsync,processContent,uploadSignal,searchTenantProtectionScope,searchUserProtectionScope). These now use plainJSON.stringify(payload).jsonReplacermethod fromPurviewClient. The logger's ownjsonReplacer(inlogger.ts) is unaffected and continues to handle log formattingseparately.
Add
client-secretaction input:client-secretas a new input inaction.yml, alongsideclient-certificate.inputValidator.tsfromprocess.env['AZURE_CLIENT_SECRET']tocore.getInput('client-secret').setupInputMocks({ 'client-secret': ... })instead of setting the env var.sample/purview-scan.yml,README.md,sample/README.md, andInstructions.mdto document and demonstrate the new input.Cap workflow run pagination:
maxRuns = 20limit tofindLastProcessedCommitSha(). The loop now stops after checking 20 runs (2 pages of 10), which is sufficient since the query is alreadybranch-scoped.
Contribution Checklist
npm run build && npm run package)