Open Code Review: inspect review scope, filters and model work
Read the .env path filter and test its limits
Use fifteen isolated Go cases to understand template exceptions and the boundary between an environment-filename helper and the complete secret-path filter.
What you will learn
- Follow the caller before the helper
- Exercise a small piece of real code
- Keep filename checks within their scope
Before you start
- Git changes and merge-base comparisons
- Basic CLI use and model API credentials
Choose a review scope, explain exclusions, prepare a controlled pilot and distinguish source inspection from runtime evidence.
Key takeaways
- The helper has three exact template exceptions.
- Other secret patterns can still reject a template path.
- The executed fifteen-case fixture does not scan file contents.
Follow the caller before the helper
IsSecretPath lowercases its input, checks the .env family and then evaluates embedded glob patterns. The .env helper uses path.Base, explicitly permits .env.example, .env.sample and .env.template, and otherwise rejects .env and names beginning with .env.
The caller matters to interpretation. The helper alone returns false for .ssh/.env.example because it recognizes the template name. The full IsSecretPath function still checks its other patterns, and the upstream test expects that path to be rejected because it is inside .ssh.
Exercise a small piece of real code
Our fixture extracts the inspected upstream isSecretEnvPath function and compiles it with Go’s standard library. Fifteen cases include nested names, template exceptions, .env.example.secret, uppercase caller input and a trailing slash. All fifteen passed in the local Go execution.
The fixture applies strings.ToLower to model the caller’s input contract. It does not import the glob dependency or execute the complete selector. Reporting the fixture as a security scan of OCR would exceed what was tested. Its report records the source hash and each expected value.
Keep filename checks within their scope
The source explicitly says file contents are not inspected by IsSecretPath. A harmless-looking source filename can still contain a credential, and a template filename does not prove that its values are placeholders. Review data-handling policy before sending selected content to a provider.
A false result from the secret-path predicate also does not mean a file will be reviewed. Extension rules, default exclusions and later selection checks still apply. Conversely, a path admitted by this narrow helper can be rejected by another secret glob, as the .ssh template case demonstrates.
Decision guide
| Criterion | Option A | Option B |
|---|---|---|
| Best when | You need predictable behavior and easy auditing | You need adaptive optimization and have reliable telemetry |
| Main risk | May leave performance on the table | Can become difficult to explain or debug |
Implementation steps
- 1
Inspect the caller, helper and upstream test before interpreting a return value.
- 2
Run the isolated helper fixture with synthetic filenames.
- 3
Keep full-selector and content-secret checks as separate verification tasks.
Copy-ready example
// SPDX-License-Identifier: Apache-2.0
// Copyright 2026 alibaba/open-code-review Contributors
// Imports: path, strings. Input: strings.ToLower(filePath).
func isSecretEnvPath(lowerPath string) bool {
base := path.Base(lowerPath)
switch base {
case ".env.example", ".env.sample", ".env.template":
return false
}
return base == ".env" || strings.HasPrefix(base, ".env.")
}Frequently asked questions
Does .env.example always reach the model?
No. Other secret-path and selection checks still apply, and the filename alone says nothing about its contents.
Why did the isolated .ssh/.env.example case return false?
The fixture tests only the basename helper. The full function’s later directory glob can reject it, as the upstream test specifies.
Sources
- Open Code Review / internal/config/allowlist/secret_path.goSource checked 2026-09-18
- Open Code Review / internal/config/allowlist/secret_path_test.goSource checked 2026-09-18
- Open Code Review / internal/agent/selection.goSource checked 2026-09-18