[mirooon]

Which Linear task belongs to this PR?

None — repository chore: the husky pre-commit secret scanner blocked unrelated branch commits because of false positives. No Linear ticket; happy to open one if preferred.

Why did I implement it this way?

The .husky/pre-commit hook already supports an opt-out marker: lines containing pre-commit-checker: not a secret (on the line itself or the line immediately above) are skipped by both the .env-secret check and the Ethereum-private-key regex check. See is_known_false_positive_match and DISABLE_WITH_COMMENT in .husky/pre-commit.

Several long-standing constants in the repo match those patterns but are not credentials. Rather than weakening the scanner, I annotated each false positive with the documented marker, placed adjacent to (or directly above) the matching line so the hook's PREV/CURR window sees it.

Annotated false positives:

• .github/workflows/deploy-smoke-test.yml
  • mongo:7@sha256:… image digest pin (supply-chain integrity)
  • EXPECTED_SHA256=fd1a34… gum release checksum (publisher-published)
  • ETH_NODE_URI_LOCALANVIL=http://localhost:8545 (local anvil URL written into CI .env)
  • second http://localhost:8545 use inside the anvil readiness probe
• script/demoScripts/demoPatcher.ts
  • public arbiscan example transaction hash in JSDoc
  • 0xff…ff max-uint256 used as approval amount
• script/demoScripts/utils/cowSwapHelpers.ts
  • zero bytes32 sentinel for non-EVM receiver (bridging disabled)
  • 0xff…ff max-uint256 used as approval amount
• script/deploy/safe/timelock-queue.test.ts
  • zero bytes32 test fixture (ZERO_BYTES32)
• test/solidity/Periphery/Patcher.t.sol
  • three occurrences of the 0x1234…CDEF test fixture marker used to locate the patched word

No runtime behavior changes. The hook now exits with "Secret check passed" (no warnings) and all downstream pre-commit checks (forge build, typechain, tsc, lint-staged) pass.

Checklist before requesting a review

• I have performed a self-review of my code
• This pull request is as small as possible and only tackles one problem
• I have added tests that cover the functionality / test the bug
• For new facets: I have checked all points from this list: https://www.notion.so/lifi/New-Facet-Contract-Checklist-157f0ff14ac78095a2b8f999d655622e
• I have updated any required documentation

Checklist for reviewer (DO NOT DEPLOY and contracts BEFORE CHECKING THIS!!!)

• I have checked that any arbitrary calls to external contracts are validated and or restricted
• I have checked that any privileged calls (i.e. storage modifications) are validated and or restricted
• I have ensured that any new contracts have had AT A MINIMUM 1 preliminary audit conducted on by <company/auditor>

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: e1b39e7e-0eac-4b32-8923-a3c882fef5f3

📥 Commits

Reviewing files that changed from the base of the PR and between 61ef8dc and 936ccec.

📒 Files selected for processing (5)

• .github/workflows/deploy-smoke-test.yml
• script/demoScripts/demoPatcher.ts
• script/demoScripts/utils/cowSwapHelpers.ts
• script/deploy/safe/timelock-queue.test.ts
• test/solidity/Periphery/Patcher.t.sol

---

Walkthrough

This PR adds nine inline pre-commit-checker clarification comments across the codebase to prevent false secret detection. Comments are inserted in workflow configuration, deployment scripts, and test files to explicitly mark SHA-256 digests, sentinel values, max constants, and test fixtures as non-credentials.

Changes

Pre-commit Checker Clarification Comments

Layer / File(s)	Summary
Pre-commit checker clarification comments .github/workflows/deploy-smoke-test.yml, script/demoScripts/demoPatcher.ts, script/demoScripts/utils/cowSwapHelpers.ts, script/deploy/safe/timelock-queue.test.ts, test/solidity/Periphery/Patcher.t.sol	Adds inline pre-commit-checker comments to clarify that SHA-256 digests, checksums, zero-byte sentinels, max-value constants, transaction hashes, and test fixtures are not secrets.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

• lifinance/contracts#1747: Introduces the smoke-test workflow with SHA-256/checksum handling that this PR adds pre-commit-checker comments to.
• lifinance/contracts#1343: Introduces the .husky/pre-commit hook mechanism that the pre-commit-checker comment markers bypass.
• lifinance/contracts#1759: Modifies the same Solidity test file sections where this PR inserts fixture marker comments.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: adding annotations for false positives to allow the pre-commit secret scanner to pass.
Description check	✅ Passed	The description fully completes the repository template with all required sections, clearly explains the rationale and implementation approach, and provides comprehensive details about the changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/pre-commit-false-positive-markers

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[lifi-action-bot]

Test Coverage Report

Line Coverage: 89.97% (3240 / 3601 lines)
Function Coverage: 93.65% ( 502 / 536 functions)
Branch Coverage: 72.18% ( 597 / 827 branches)
Test coverage (89.97%) is above min threshold (83%). Check passed.