feat: allow to scan secrets without buffering whole lines #6318
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
🎉 Thanks for submitting a pull request! 🎉
Summary
Possible fix for https://linear.app/netlify/issue/FRB-1778/oom-during-ef-bundling (it's not really confirmed, other than logs pointing to secret scanning being a problem and buffering whole very large lines seems like only thing that I managed to reproduce OOM problems with)
For review, I suggest checking commits 1 by 1 as well as toggling "Ignore whitespace changes" in diff viewer.
Description
This adds a new scanning method that is not relying on buffering whole lines in scanned files (through
node:readline
) and instead allow to operate on smaller chunks of stream ( max length of secrets to scan +whatever size stream.on('data')
would result in)Because this is new method I want to be careful and introduce feature flag that opt into new search algorithm (feature flag not yet created in devcycle, because I don't really like
secret_scanning_no_readline
name (inverted boolean making it confusing) but didn't come up with better name yet. Assuming no problems are discovered as feature flag is rolled out, this should be cleaned up from the code.I did run some benchmarks against
netlify-react-ui
build dir (48459
files to scan there) using https://gist.github.com/pieh/a3eccd67cd0c27017acbbf18a87a1c55 and the results are comparable so it should not result in performance regression:Goal of the change was not to improve performance, but rather allow secret scanning to work with less available memory and allow Node's garbage collection to function without causing perf regression.
Tests
For us to review and ship your PR efficiently, please perform the following steps:
we can discuss the changes and get feedback from everyone that should be involved. If you`re fixing a typo or
something that`s on fire 🔥 (e.g. incident related), you can skip this step.
your code follows our style guide and passes our tests.
A picture of a cute animal (not mandatory, but encouraged)