Repository navigation
docs(platform): port the LavaFlow redaction docs from volcano-hosting - #172
Conversation
Ports the docs/public change in Kong/volcano-hosting#3401.
There was a problem hiding this comment.
🔵 Needs a closer look
The changes relax security-sensitive redaction guarantees, but the inaccessible hosting PR prevents verification that the documentation matches the implementation and released production behavior.
No open issues 🎉
What changed in this PR
Ports the latest LavaFlow redaction documentation from volcano-hosting into the platform guides before upstream docs/public is removed, following the earlier settings-docs port in #171.
Changes:
- Documents masking based on project secret values and gitleaks detection, with updated
Hidden: …messages. - Updates run-field and diff-withholding documentation, including credential-held runs and older saved fixes.
| File | Description |
|---|---|
content/platform/guides/lavaflow.md |
Updates redaction rules for run text, review findings, check output, and diffs. |
content/platform/guides/issues.md |
Updates secret detection and replacement text for issue explanations. |
Review effort: Balanced
AI review: no P0-P2 findingsDocs-only port of volcano-hosting#3401 into ⚪ P3
Not checked: The AI review read the diff, the code, and the PR's text; it ran no tests or builds and read nothing outside this repository.
Human review: not needed |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| command and output reads so when the run is held with `possible_credential`. | ||
| `status` and `exit_code` always show. | ||
| Commands and their output are checked for secrets like every text a run | ||
| serves ([Read a review's findings](#read-a-reviews-findings)). `status` and |
There was a problem hiding this comment.
⚪ P3: Secret-check link points to a section that only redirects to the real explanation
The new sentence "Commands and their output are checked for secrets like every text a run serves (Read a review's findings)" sends readers to the findings section. That section only says "as a run's other text does" and defines a secret value. The paragraph that lists repository check commands and output and explains the Hidden: … text is in Follow runs (line 1749). Linking #follow-runs directly would save readers the extra hop.
Found by claude-opus-5-5
| `diagnosis`, review findings and questions, hold reasons, and repository check | ||
| commands and output, in the run and in the runs list. A field that holds one | ||
| of your project's exact secret values, or a secret that | ||
| [gitleaks](https://github.com/gitleaks/gitleaks)' default rules detect, reads |
There was a problem hiding this comment.
⚪ P3: Names the scanner behind secret hiding (gitleaks), unlike the rest of the guide
spec/writing.md, which AGENTS.md says every page follows, asks docs to "describe what the platform does, not the vendor behind it." The new text in lavaflow.md and issues.md (line 227) defines hidden fields by "a secret that gitleaks' default rules detect." Elsewhere the same guide describes the same check as "anything that looks like a known kind of secret" or "a recognized secret" (lines 828–839). The new wording also makes a specific tool's default rule set part of the public contract, so the docs go stale if the detector or its version changes. issues.md also names gitleaks without the link lavaflow.md gives it. If you want to keep the tool's name, make the wording match across both pages; otherwise use the guide's existing "recognized secret" wording.
Found by claude-opus-5-5
Why
Kong/volcano-hosting#3401 changed
docs/publicafter #171 ported the last late change. Kong/volcano-hosting#3404 deletesdocs/public, so this carries the change over before that lands.What changed
content/platform/guides/issues.mdandcontent/platform/guides/lavaflow.md: thedocs/publicdiff from volcano-hosting2dc8049toe03f56b, applied as is.Testing
pnpm lint:docs contentandpnpm check:links: pass.🤖 Generated with Claude Code