Repository navigation
fix(controlplane): restrict GUAC credentials to service account keys - #3604
Merged
Merged
Conversation
Contributor
PR validation — ✅ 3 passing
AI Session Checks — 🟢 90% ·
|
| Avg score | Sessions | Failing policies | Attribution | Files | Lines | Total Duration |
|---|---|---|---|---|---|---|
| 🟢 90% | 1 | 100% AI / 0% Human | 2 | +124 / -1 | 45h8m35s |
🟢 90% — 100% AI — ⚠️ 1 policies failing
-
Oct 11, 2026 21:43 UTC · 45h8m35s · $209.22 · 1.5k in / 1.0M out · claude-code 2.1.296 (claude-opus-4-8)
Change Summary
-
- Revises the trace evidence-export spec across several review-driven follow-ups.
- Adds
trace init --local,trace export, related trace-state handling, docs, and tests. - Hardens the GUAC integration to accept only service account credentials and fixes the follow-up lint issue.
AI Session Overall Score
-
🟢 90% — Mixed capture, but work stayed aligned and heavily verified; planning was lighter than scope.
AI Session Analysis Breakdown
-
🟢 95% · verification
-
🟢 AI ran targeted tests, builds, vet, and a trace init/export smoke test. · High Impact
🟢 93% · solution-quality
-
No notes.
🟢 92% · alignment
-
🟢 AI compared spec and implementation before coding the missing trace work. · High Impact
🟢 90% · scope-discipline
-
No notes.
🟢 88% · user-trust-signal
-
🟢 The user explicitly said the GUAC branch fix was verified. · High Impact
🟡 68% · context-and-planning
-
🟠 Trace work crossed CLI, hooks, state, docs, and tests without a visible shared plan. · Medium Severity
💡 Before editing this many files, land a short visible plan the user can confirm.
-
File Attribution
████████████████████100% AI / 0% HumanStatus Attribution File Lines modified ai app/controlplane/plugins/core/guac/v1/guac_test.go+86 / -0 modified ai app/controlplane/plugins/core/guac/v1/guac.go+38 / -1
Policies (4, 1 failing)
Status Policy Material Messages ✅ Passed ai-config-ai-agents-allowedai-coding-session-d139ac- ✅ Passed ai-config-no-dangerous-commandsai-coding-session-d139ac- ⚠️ Failedai-config-no-secretsai-coding-session-d139ac- Secret (generic-password) detected in session content [turn=1458, source=tool_result, line=6]: 115: Credentials: &sdk.Credentials{Password: [CHAINLOOP_TRACE_REDACTED:generic-password],
- Secret (generic-password) detected in session content [turn=1464, source=tool_result, line=115]: 115 Credentials: &sdk.Credentials{Password: [CHAINLOOP_TRACE_REDACTED:generic-password],
- Secret (generic-password) detected in session content [turn=15, source=tool_result, line=115]: 115 Credentials: &sdk.Credentials{Password: [CHAINLOOP_TRACE_REDACTED:generic-password],
- Secret (generic-password) detected in session content [turn=43, source=tool_result, line=100]: 100 Credentials: &sdk.Credentials{Password: [CHAINLOOP_TRACE_REDACTED:generic-password],
- Secret (generic-password) detected in session content [turn=49, source=tool_result, line=140]: 140 Credentials: &sdk.Credentials{Password: [CHAINLOOP_TRACE_REDACTED:generic-password],
- Secret (generic-password) detected in session content [turn=51, source=tool_result, line=132]: 132 Credentials: &sdk.Credentials{Password: [CHAINLOOP_TRACE_REDACTED:generic-password],
- Secret (generic-password) detected in session content [turn=53, source=tool_result, line=117]: 117 response.Credentials = &sdk.Credentials{Password: [CHAINLOOP_TRACE_REDACTED:generic-password]
✅ Passed ai-config-mcp-servers-allowedai-coding-session-d139ac- -
Security Checks — ✅ 5 passing
✅ secret-scan
| Status | Policy | Messages |
|---|---|---|
| ✅ Passed | secrets-detection |
- |
✅ sast-scan
| Status | Policy | Messages |
|---|---|---|
| ✅ Passed | owasp-top10-2025 |
- |
| ✅ Passed | sast |
- |
| ✅ Passed | cwe-top25 |
- |
| ✅ Passed | cwe-top26-40-cusp |
- |
Scans not applied (3)
| Scan | Reason |
|---|---|
vulnerability-scan |
no manifest/lockfile changed |
github-actions-scan |
no workflow files changed |
iac-scan |
no IaC files changed |
Security context
✅ Nothing this change touches has a recorded security-fix history.
View in Chainloop ↗ · How this works ↗
Powered by Chainloop and Chainloop Trace
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
migmartri
previously approved these changes
Oct 13, 2026
The GUAC integration passed the supplied credentials to the Google Cloud Storage SDK without checking their type. GUAC only needs a service account key, so validate the credential and accept only that type, at registration and on every dispatch. Other credential types (external_account, impersonated_service_account, authorized_user, gdch_service_account) are no longer accepted. The service account key is the only type the GUAC docs describe. Chainloop-Trace-Sessions: d139ac66-b95f-4920-ac38-12997996037d Signed-off-by: Matías Insaurralde <matias@chainloop.dev>
matiasinsaurralde
force-pushed
the
fix/guac-credential-type-validation
branch
from
October 13, 2026 19:15
ba3bd34 to
63fd1ef
Compare
migmartri
approved these changes
Oct 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refs PFM-7760
Summary
The GUAC fan-out plugin passed the tenant-supplied credentials string straight to the Google Cloud Storage SDK without checking its type.
Reject any credential type but a service account key before the SDK sees it, at both registration and execution so existing registrations are covered too.