Add .infisicalignore commit suggestion support to PR comments +semver: major#160
Merged
Add .infisicalignore commit suggestion support to PR comments +semver: major#160
Conversation
Reviewer's GuideAdds an automated .infisicalignore commit-suggestion workflow to the Infisical secrets check GitHub Action, generating a de-duplicated ignore file suggestion block and embedding it in PR comments so contributors can directly commit ignore list changes from the PR UI. Sequence diagram for Infisical .infisicalignore commit suggestion workflowsequenceDiagram
actor Developer
participant GitHub
participant InfisicalAction
participant IgnorefileStep as Check_ignorefile_step
participant SuggestionStep as Prepare_ignore_suggestion_step
participant CommentAction as Add_PR_Comment_Action
Developer->>GitHub: Push branch / open PR
GitHub->>InfisicalAction: Run Infisical secrets check action
InfisicalAction->>InfisicalAction: Scan for leaked secrets
InfisicalAction->>InfisicalAction: Set env.SECRETS_FOUND
alt Secrets found
InfisicalAction->>IgnorefileStep: Execute when env.SECRETS_FOUND == true
IgnorefileStep->>IgnorefileStep: Test for .infisicalignore
IgnorefileStep-->>InfisicalAction: outputs.exists = true or false
InfisicalAction->>SuggestionStep: Execute when env.SECRETS_FOUND == true
alt .infisicalignore exists
SuggestionStep->>SuggestionStep: Copy .infisicalignore to new-ignorefile.txt
SuggestionStep->>SuggestionStep: Append fingerprint.txt
else .infisicalignore missing
SuggestionStep->>SuggestionStep: Initialize new-ignorefile.txt from fingerprint.txt
end
SuggestionStep->>SuggestionStep: sort -u new-ignorefile.txt (deduplicate)
SuggestionStep-->>InfisicalAction: outputs.suggestion with ```suggestion:.infisicalignore block
InfisicalAction->>CommentAction: Call mshick/add-pr-comment with suggestion
CommentAction->>GitHub: Post PR comment with commit suggestion block
Developer->>GitHub: Click Commit suggestion in PR comment
GitHub->>GitHub: Apply patch to .infisicalignore (create or update)
else No secrets found
InfisicalAction->>CommentAction: Post success comment without suggestion
end
Flow diagram for .infisicalignore suggestion generation logicflowchart TD
A[Start: Secrets scan completed] --> B{env.SECRETS_FOUND == 'true'?}
B -- No --> Z[End: No ignore suggestion generated]
B -- Yes --> C{.infisicalignore exists?}
C -- Yes --> D[Copy existing .infisicalignore to new-ignorefile.txt]
D --> E[Append newline to new-ignorefile.txt]
E --> F[Append fingerprint.txt to new-ignorefile.txt]
C -- No --> G[Create new-ignorefile.txt from fingerprint.txt]
F --> H[Deduplicate entries: sort -u new-ignorefile.txt]
G --> H
H --> I[Begin suggestion output to GITHUB_OUTPUT]
I --> J[Write line: ```suggestion:.infisicalignore]
J --> K[Append contents of new-ignorefile.txt]
K --> L[Write closing ```]
L --> M[Write EOF marker for multiline output]
M --> N[Step output: ignore_suggestion.outputs.suggestion]
N --> O[PR comment embeds suggestion block]
O --> P[Developer can commit suggestion from PR UI]
P --> Z[End]
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
Contributor
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 14 minutes and 33 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
gstraccini
Bot
added
the
☑️ auto-merge
![gstraccini[bot]](https://avatars.githubusercontent.com/in/480132?s=60&v=4){kind=small}
 |
|
Overall Grade |
Security Reliability Complexity Hygiene |
Code Review Summary
| Analyzer | Status | Updated (UTC) | Details |
|---|---|---|---|
| Secrets |  |
Apr 12, 2026 1:15p.m. | Review ↗ |
Important
AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.
Contributor
|
Failed to generate code suggestions for PR |
Up to standards ✅🟢 Issues
|
Owner
Author
|
Infisical secrets check: ✅ No secrets leaked! 💻 Scan logs2026-04-12T13:16:41Z INF scanning for exposed secrets...
1:16PM INF 142 commits scanned.
2026-04-12T13:16:41Z INF scan completed in 24.4ms
2026-04-12T13:16:41Z INF no leaks found
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 1 issue, and left some high level feedback:
- Using
sort -uonnew-ignorefile.txtremoves duplicates but also reorders the existing.infisicalignorecontents, which may be surprising for users relying on a specific ordering; consider a de-duplication approach that preserves the original line order. - The temporary
new-ignorefile.txtfile is left in the workspace after the run; if you want to keep the workspace clean for later steps or debugging, consider either usingmktempin a subdirectory or removing the file once the suggestion output has been written.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- Using `sort -u` on `new-ignorefile.txt` removes duplicates but also reorders the existing `.infisicalignore` contents, which may be surprising for users relying on a specific ordering; consider a de-duplication approach that preserves the original line order.
- The temporary `new-ignorefile.txt` file is left in the workspace after the run; if you want to keep the workspace clean for later steps or debugging, consider either using `mktemp` in a subdirectory or removing the file once the suggestion output has been written.
## Individual Comments
### Comment 1
<location path="action.yml" line_range="313" />
<code_context>
+ sort -u new-ignorefile.txt -o new-ignorefile.txt
+
+ echo "suggestion<<EOF" >> $GITHUB_OUTPUT
+ echo '```suggestion:.infisicalignore' >> $GITHUB_OUTPUT
+ cat new-ignorefile.txt >> $GITHUB_OUTPUT
+ echo '```' >> $GITHUB_OUTPUT
</code_context>
<issue_to_address>
**suggestion:** GitHub suggestion blocks don’t support specifying a filename, which may prevent this from rendering as an apply‑patch suggestion.
GitHub expects the marker to be exactly ```suggestion followed by the replacement text and then ``` on its own line. The `:.infisicalignore` suffix isn’t supported and will cause a plain code block instead of an interactive suggestion. To fix this, update the line to:
```bash
echo '```suggestion' >> $GITHUB_OUTPUT
```
so the output is treated as an apply‑patch suggestion.
```suggestion
echo '```suggestion' >> $GITHUB_OUTPUT
```
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
| sort -u new-ignorefile.txt -o new-ignorefile.txt | ||
|
|
||
| echo "suggestion<<EOF" >> $GITHUB_OUTPUT | ||
| echo '```suggestion:.infisicalignore' >> $GITHUB_OUTPUT |
There was a problem hiding this comment.
suggestion: GitHub suggestion blocks don’t support specifying a filename, which may prevent this from rendering as an apply‑patch suggestion.
GitHub expects the marker to be exactly suggestion followed by the replacement text and then on its own line. The :.infisicalignore suffix isn’t supported and will cause a plain code block instead of an interactive suggestion. To fix this, update the line to:
echo '```suggestion' >> $GITHUB_OUTPUTso the output is treated as an apply‑patch suggestion.
Suggested change
| echo '```suggestion:.infisicalignore' >> $GITHUB_OUTPUT | |
| echo '```suggestion' >> $GITHUB_OUTPUT |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📑 Description
This pull request enhances the Infisical secrets check action by adding an automated commit suggestion workflow that allows developers to create or update the
.infisicalignorefile directly from the pull request UI.When leaked secrets are detected:
.infisicalignorealready exists in the repositoryThis significantly improves usability by turning the action into an interactive remediation workflow instead of only reporting scan results.
Why this is a major version bump
The PR comment output format changes by introducing a suggestion block that enables direct commits from the UI. While backwards compatible in behavior, this modifies the generated comment structure and downstream integrations relying on exact comment formatting may be affected.
✅ Checks
☢️ Does this introduce a breaking change?
Summary by Sourcery
Add support for suggesting .infisicalignore updates directly within PR comments when leaked secrets are detected.
New Features:
Enhancements: