base-layer/configkit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

Prepare sensitivity dependencies once per recorded operation

Browse Source
This commit is contained in:
Eric Rakestraw
2026-10-27 03:18:55 +00:00
parent b281adb751
commit fb71421956
5 changed files with 89 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
internal/engine/secret.go
View File

@@ -34,7 +34,7 @@ func classifySecretPathsWithEvidence(schema *schemaDescriptor, predicate func(Pa
var dependencies, inherited []secretDependency
if model := metadata.historyEvidence(); model != nil {
dependencies, inherited = model.sensitivityDependencies()
for _, candidate := range model.sensitivityCandidates() {
for _, candidate := range model.sensitivityCandidates(inherited) {
pointer := candidate.path.String()
paths[pointer] = candidate.path.clone()
if candidate.classify {
@@ -43,10 +43,6 @@ func classifySecretPathsWithEvidence(schema *schemaDescriptor, predicate func(Pa
if candidate.sensitive {
secret[pointer] = true
}
for _, dependency := range candidate.dependencies {
paths[dependency.String()] = dependency.clone()
addCandidate(dependency)
}
}
for _, edge := range dependencies {
paths[edge.target.String()] = edge.target.clone()