chore(ci): sync secret gate to runpod/secret_detector@5d504ba7aa42

Source: runpod/secret_detector@5d504ba

Author: erinavllazagaj-eng

.github/security/ai_security_review.py

@@ -58,6 +58,9 @@
 REVIEW_CONTACTS = ("runpod/security",)
 
 MAX_OUTPUT_TOKENS = 8192
+# Socket timeout for the model call. A full prompt on a busy pod can take over
+# a minute to stream its first byte; the pod proxy drops an idle response at ~100s.
+MODEL_TIMEOUT_S = 95
 
 # Context lines either side of a detection.
 WINDOW_LINES = 20
@@ -454,7 +457,8 @@ def call_kimi(prompt_system: str, prompt_user: str, api_key: str) -> str | None:
 
     # `raw` buffers the whole event stream; the proxy stays open while events arrive.
     status, raw = request(f"{LITELLM_BASE}/v1/chat/completions", headers,
-                          data=json.dumps(body).encode(), raw=True)
+                          data=json.dumps(body).encode(), raw=True,
+                          timeout=MODEL_TIMEOUT_S)
     if status == 400:
         # Bounded: the server may echo the request back.
         log(f"::warning::model rejected the request (400): {str(raw)[:200]}")

.github/security/ghapi.py

@@ -24,13 +24,14 @@ def log(msg: str) -> None:
 
 
 def request(url: str, headers: dict, data: bytes | None = None,
-            raw: bool = False, method: str | None = None):
+            raw: bool = False, method: str | None = None,
+            timeout: float = HTTP_TIMEOUT_S):
     """Minimal HTTP helper. Returns (status, body) and never raises on 4xx/5xx."""
     req = urllib.request.Request(url, data=data, headers=headers, method=method)
     if data is not None:
         req.add_header("Content-Type", "application/json")
     try:
-        with urllib.request.urlopen(req, timeout=HTTP_TIMEOUT_S) as resp:
+        with urllib.request.urlopen(req, timeout=timeout) as resp:
             body = resp.read()
             return resp.status, (body if raw else json.loads(body or b"{}"))
     except urllib.error.HTTPError as exc:

.github/security/test_secret_gate.py

@@ -342,7 +342,7 @@ def _stub_stream(monkeypatch, events):
     urls = []
 
     def fake_request(url, *a, **k):
-        urls.append(url)
+        urls.append((url, k.get("timeout")))
         return 200, b"".join(b"data: " + e + b"\n\n" for e in events)
 
     monkeypatch.setattr(air, "request", fake_request)
@@ -361,7 +361,7 @@ def test_streamed_reply_is_reassembled_from_litellm(monkeypatch):
         _delta('{"verdicts":'), _delta(" []}", "stop"), b"[DONE]"])
 
     assert air.call_kimi("sys", "user", "key") == '{"verdicts": []}'
-    assert urls == [f"{air.LITELLM_BASE}/v1/chat/completions"]
+    assert urls == [(f"{air.LITELLM_BASE}/v1/chat/completions", air.MODEL_TIMEOUT_S)]
 
 
 @pytest.mark.parametrize("bad", [b'{"error": {"message": "overloaded"}}',