Repository navigation
fix(tests): a branch name with a secret word fails a span test #3638
Description
Problem
tests/ai/rag/test_rag_qdrant_span.py::test_upsert_span_names_the_server_by_host_and_port fails on a topic branch whose name holds one of the words secret, token or user.
The test checks that the span of qdrant.upsert_points leaks no part of the configured URL. It looks for those words in every value of the span attributes. The tracer adds the attributes vcs.ref.name and vcs.branch to each span. They hold the name of the git branch. So the check reads the branch name as if it were a leak.
Reproduction
- Create a checkout on a branch named
fix/2613-prose-after-a-token-colon. - Run
uv run devops ci test tests/ai/rag/test_rag_qdrant_span.py. - Six cases fail with
assert not ['fix/2613-prose-after-a-token-colon', 'fix/2613-prose-after-a-token-colon'].
On a detached head, the six cases pass. The full gate uv run devops ci fails in the same way on such a branch.
Expected
The test passes on every branch name. It checks the attributes that name the server, and it ignores the attributes of the version control source.
Evidence
src/devops_cli/telemetry/tracer.py function _detect_vcs_metadata reads the branch from the git head file of the checkout, and _read_git_head_ref returns it. A branch name that follows <type>/<issue>-<slug> can hold any word, so the check fails for a branch about a token, a secret or a user.
Activity
dan-petty commentedon Nov 5, 2026
Intake placed this item to the backlog: intake puts every new item in the backlog. A person plans the milestones.
fixprefix of the title gives the type.(tests)scope of the title gives the scope.It blocks CI on branches whose names contain certain words but does not affect production.It unblocks CI for developers on affected branch names but only for a subset of branches.The fix filters VCS attributes from the span attribute check in one test.Both concern the qdrant.upsert_points span; #2459 fixes the span to use host:port, the candidate fixes the test that verifies it to ignore VCS attributes.dan-petty commentedon Nov 5, 2026
The same failure showed again on 2026-11-05 for the branch
fix/2662-mask-url-user-name-without-password(pull request #3676), at origin/mainf6d57ecd. Six cases oftest_upsert_span_names_the_server_by_host_and_portfail with the branch name invcs.ref.nameandvcs.branch, because the name holds the worduser. They pass on a detached head. The full localuv run devops cifails on such a branch, so a branch that is about a user name, a token or a secret cannot pass the gate on a local checkout.