Bound artifact scans to shareable evidence

Exclude reconstructed environments, caches, and source clones so security
scans finish predictably without implying that runtime state is shareable.

Author: Horde

tools/perf_bisection/README.md

@@ -160,6 +160,10 @@ Important outputs include:
 - `security_scan.json`: value-free credential finding locations; a `blocked`
   status prohibits sharing until reviewed and remediated.
 
+The security scan excludes `env-cache/`, `jit-cache/`, `kit-cache/`, and
+`sources/` because they are large, non-shareable runtime state. Do not include
+those directories when packaging evidence for another person or system.
+
 Setup and tooling incompatibilities are structured skips, not performance
 verdicts. See [the compatibility policy](docs/compatibility.md).
 

tools/perf_bisection/SECURITY.md

@@ -58,6 +58,10 @@ credential is rotated. Re-run the scan explicitly with:
 isaaclab-bisect-scan-artifacts <OUTPUT_DIR>
 ```
 
+The scan excludes `env-cache/`, `jit-cache/`, `kit-cache/`, and `sources/`.
+These directories are runtime state, not evidence, and must not be included in
+anything shared or uploaded.
+
 ## Shared resources and releases
 
 The agent does not merge pull requests, push protected branches, publish

tools/perf_bisection/docs/development.md

@@ -32,6 +32,8 @@ uv run --no-project python tools/skills/cli.py check
 Unit and synthetic tests must not require Isaac Sim, a GPU, or Docker.
 Scan any generated run directory with
 `isaaclab-bisect-scan-artifacts <OUTPUT_DIR>` before sharing it.
+The scanner excludes reconstructed environments, caches, and source clones;
+never include those excluded directories in a shared evidence archive.
 
 ## Container
 

tools/perf_bisection/src/isaaclab_bisection/artifact_security.py

@@ -9,12 +9,14 @@
 
 import argparse
 import json
+import os
 import re
 from collections.abc import Iterator
 from pathlib import Path
 from typing import Any
 
 _MAX_FILE_SIZE = 10 * 1024 * 1024
+_EXCLUDED_DIRECTORY_NAMES = frozenset({"env-cache", "jit-cache", "kit-cache", "sources"})
 _PATTERNS = (
     ("private_key", re.compile(r"-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----")),
     ("authorization_bearer", re.compile(r"(?i)\bauthorization\s*:\s*bearer\s+\S+")),
@@ -53,20 +55,28 @@ def scan_artifacts(root: Path) -> dict[str, Any]:
         "status": "blocked" if findings else "passed",
         "finding_count": len(findings),
         "findings": findings,
-        "note": "Potential secret values are intentionally omitted. Review findings before sharing artifacts.",
+        "excluded_directory_names": sorted(_EXCLUDED_DIRECTORY_NAMES),
+        "note": (
+            "Potential secret values are intentionally omitted. Review findings before sharing artifacts. "
+            "Reconstructed environments, caches, and source clones are excluded and must not be shared."
+        ),
     }
 
 
 def _iter_text_files(root: Path) -> Iterator[Path]:
-    """Yield bounded regular files while excluding this scanner's own report."""
-    for path in root.rglob("*"):
-        if path.name == "security_scan.json" or not path.is_file():
-            continue
-        try:
-            if path.stat().st_size <= _MAX_FILE_SIZE:
-                yield path
-        except OSError:
-            continue
+    """Yield bounded evidence files without traversing non-shareable run caches."""
+    for directory, names, filenames in os.walk(root):
+        names[:] = [name for name in names if name not in _EXCLUDED_DIRECTORY_NAMES]
+        directory_path = Path(directory)
+        for filename in filenames:
+            if filename == "security_scan.json":
+                continue
+            path = directory_path / filename
+            try:
+                if path.is_file() and path.stat().st_size <= _MAX_FILE_SIZE:
+                    yield path
+            except OSError:
+                continue
 
 
 def _parse_args(argv: list[str] | None = None) -> argparse.Namespace:

tools/perf_bisection/tests/test_artifact_security.py

@@ -30,3 +30,18 @@ def test_scan_artifacts_cli_passes_clean_directory(tmp_path: Path) -> None:
     assert main([str(tmp_path)]) == 0
     report = json.loads((tmp_path / "security_scan.json").read_text(encoding="utf-8"))
     assert report["status"] == "passed"
+
+
+def test_scan_artifacts_excludes_non_shareable_run_caches(tmp_path: Path) -> None:
+    secret = "sk-" + "abcdefghijklmnopqrstuvwxyz123456"
+    for name in ("env-cache", "jit-cache", "kit-cache", "sources"):
+        directory = tmp_path / name
+        directory.mkdir()
+        (directory / "credential.txt").write_text(secret, encoding="utf-8")
+    (tmp_path / "report.md").write_text("Canonical evidence.\n", encoding="utf-8")
+
+    report = scan_artifacts(tmp_path)
+
+    assert report["status"] == "passed"
+    assert report["finding_count"] == 0
+    assert report["excluded_directory_names"] == ["env-cache", "jit-cache", "kit-cache", "sources"]