CM-68872: gate secret-scan async (presigned) flow behind CYCODE_SECRET_SCAN_ASYNC#496
Merged
MaorDavidzon merged 3 commits intoJul 15, 2026
Merged
Conversation
…T_SCAN_ASYNC Secret scans revert to the previous batched/API-upload flow by default; the S3 presigned direct-upload async flow is now opt-in via the CYCODE_SECRET_SCAN_ASYNC env var. SAST behavior is unchanged. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Claude Code Review
This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.
Tip: disable this comment in your organization's Code Review settings.
omer-roth
commented
Jul 15, 2026
MaorDavidzon
approved these changes
Jul 15, 2026
ilia-cy
approved these changes
Jul 15, 2026
mateusz-sterczewski
approved these changes
Jul 15, 2026
MaorDavidzon
deleted the
CM-68872-cli-disable-async-flow-for-secret-scans
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Commit c7dcb13 (CM-67391) switched secret CLI scans to the S3 presigned direct-upload async flow. This reverts secret scans to the previous batched/API-upload flow by default, and makes the presigned async flow opt-in via the
CYCODE_SECRET_SCAN_ASYNCenv var. SAST is unchanged (always presigned).Changes
consts.py:PRESIGNED_UPLOAD_SCAN_TYPES = {SAST_SCAN_TYPE}; removed SECRET fromZIP_MAX_SIZE_LIMIT_IN_BYTES; addedSECRET_SCAN_ASYNC_ENV_VAR_NAME = 'CYCODE_SECRET_SCAN_ASYNC'.scan_utils.should_use_presigned_upload: secret → presigned only when the env var is truthy (read at runtime).zip_documents._validate_zip_file_size: 5 GB limit derived fromshould_use_presigned_upload(single source of truth).config.py: extractedparse_bool(shared byget_val_as_bool) to avoid duplicating the truthy-string set._should_use_sync_flowguard (general, not secret-specific).Tests
126 passing. New
tests/cli/utils/test_scan_utils.pycovers the gate (both modes, truthy/falsy values) and zip size limit (both modes); routing and commit-range fallback tests updated.🤖 Generated with Claude Code