Fix: Telemetry INFO logging to print only once per process#6083
Fix: Telemetry INFO logging to print only once per process#6083rsareddy0329 wants to merge 6 commits into
Conversation
The review job runs under pull_request_target (trusted context with the
Bedrock role + secrets). It was checking out the fork's head SHA, which
actions/checkout now refuses ('pwn request' guard) — so the workflow failed on
every fork PR (~90% of PRs), e.g. run 29965762436 on #6083.
Rework to the safe diff-only pattern (mirrors aws/*-agentcore pr-security-review):
- Check out the BASE repo, never fork head code — untrusted PR code is never
executed in the privileged job.
- Fetch the PR diff via the API into /tmp/pr.diff as read-only ground truth.
- Remove Bash from allowedTools; Claude reads the diff + uses Read/Grep/Glob
against the trusted base tree for context. Skip cleanly on empty diffs.
Does NOT use allow-unsafe-pr-checkout, which would expose secrets to fork code.
|
Claude finished @rsareddy0329's task in 59s —— View job Code Review — Telemetry INFO logging once per process
The change is small, correct, and well-targeted. Moving the Things I like
Minor considerations (non-blocking)
Neither point is a blocker. The core fix is correct and the tests validate the intended behavior. LGTM. 👍 |
|
Claude finished @rsareddy0329's task in 1m 38s —— View job Code Review — Telemetry opt-out message once per process
The core idea — gating 🔴 Blocking: new test asserts on the wrong logger methodThe implementation now emits the message via if not telemetry_opt_out_flag and not _telemetry_msg_shown:
logger.warning(TELEMETRY_OPT_OUT_MESSAGING)
_telemetry_msg_shown = TrueBut with patch.object(telemetry_module.logger, "info") as mock_logger_info:
mock_local_client.mock_create_model()
...
info_calls = [call for call in mock_logger_info.call_args_list
if "telemetry" in str(call).lower() and "opt out" in str(call).lower()]
self.assertEqual(len(info_calls), 1, ...) # will get 0, not 1Since the message no longer goes through Note the sibling test Fix: patch 🟡 Behavior change: INFO → WARNINGThe PR title says "INFO logging," but the level was changed to 🟢 Minor (non-blocking)
Summary: fix the Note: the inline-comment tool wasn't available in this environment, so findings are consolidated here with file/line references. |
Issue #, if available:
Description of changes:
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.