[prekshivyas]

Outcome

Add a root nSpect allowlist entry for the read-only Algolia key in the checksum-pinned Hermes source. The rule matches only the reported image path, detector, and redacted value.

Reason

Hermes intentionally publishes this key in its documentation site configuration. nSpect support directed NemoClaw to use the secret-scan allowlist for this finding. An Algolia permission read returned only search, browse, listIndexes, and settings; none permit mutation.

Changes

• Add .nspect-allowlist.toml with one pulse-trufflehog entry for /opt/hermes/website/docusaurus.config.ts.

Verification

• nSpect allowlist validator — passed, as confirmed by the requester.
• Python tomllib parse and exact-scope assertions — passed.
• Normal commit hooks — passed, including TOML validation, gitleaks, repository checks, and commitlint.
• Hermes v2026.8.27 archive checksum — matched the pinned SHA-256 value.
• Algolia key permission read — returned read-only ACLs and no mutation ACLs.
• Diff inspection — contains only the redacted nSpect value; no secret, API key, or credential is present.
• Public documentation — not required because this scan configuration does not change user behavior.

Review notes

nSpect support directed the NemoClaw team to allowlist this false positive. The literal AlgoliaAdminKey value is the nSpect detector identifier; it does not describe the key's effective ACLs.

---

Signed-off-by: Prekshi Vyas prekshiv@nvidia.com

Summary by CodeRabbit

• Chores
  • Added configuration to allowlist the Algolia admin key pattern in the Docusaurus configuration.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: b4ecce8c-6569-45e1-bbab-e0d7c276f3bf

📥 Commits

Reviewing files that changed from the base of the PR and between 3d7bcbf and 5df0d6e.

📒 Files selected for processing (1)

• .nspect-allowlist.toml

Included review availability: Your plan provides up to 12 included reviews per hour; 10 remain after this review.

---

📝 Walkthrough

Walkthrough

The PR adds .nspect-allowlist.toml with SPDX metadata, version 1.0.0, a Docusaurus configuration target, and an AlgoliaAdminKey allowlist entry.

Changes

Allowlist configuration

Layer / File(s)	Summary
Algolia admin key allowlist .nspect-allowlist.toml	Adds SPDX metadata, version 1.0.0, the /opt/hermes/website/docusaurus.config.ts target, and an AlgoliaAdminKey allowlist value.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Suggested reviewers: apurvvkumaria

Merge Risk: ⚪ Minimal · up to 5df0d

This configuration-only change adds a targeted exception with no established merge-blocking risk.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the security allowlist change for the Hermes documentation key. It matches the main change in the pull request.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/chore-nspect-hermes-allowlist

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall line coverage in commit 5df0d6e in the codex/chore-nspect-h... branch remains at 96%, unchanged from commit 3d7bcbf in the main branch.

TypeScript / code-coverage/cli

The overall line coverage in commit 5df0d6e in the codex/chore-nspect-h... branch remains at 83%, unchanged from commit 3d7bcbf in the main branch.

Show a line coverage summary of the most impacted files.

File	main 3d7bcbf	codex/chore-nspect-h... 5df0d6e	+/-
src/lib/onboard...uter-command.ts	65%	52%	-13%
src/lib/onboard...outer-python.ts	96%	84%	-12%
src/lib/sandbox...rce-identity.ts	82%	82%	0%
src/lib/onboard...uild-context.ts	74%	75%	+1%

---

_{Updated September 14, 2026 17:43 UTC}

[github-actions]

PR Review Advisor finished for commit 5df0d6e. Include the Advisor findings in the complete PR feedback collection. Verify and group valid findings before repair.

All previous runs