Repository navigation
Scan the full tree for secrets with exact, reviewed exceptions - #333
Merged
Merged
Conversation
Add a root .gitleaksignore of exact Gitleaks fingerprints for the two existing credential-negative fixtures, passed explicitly to every scan. The wrapper rejects non-exact entries and scans that supply their own config, exception list or overrides. The secret lane now also scans all tracked files at HEAD, so existing fixtures pass only via the list, and its control proves an exempted finding is skipped while the same token elsewhere or under another rule is rejected. Refs #130 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Covers #130 criterion 2: deliberate credential-like test fixtures now pass through explicit, narrow exceptions instead of never being scanned.
.gitleaksignorelists exact gitleaks fingerprints (path:rule:line), natively supported by the pinned v8.30.1. Only the two current fixtures are listed.tools/scan-secrets.py:.gitleaks.toml, another ignore file, config/baseline flags orGITLEAKS_CONFIG*environment variables;--ignore-gitleaks-allowstays, so inlinegitleaks:allowcomments cannot bypass review.scripts/ci-secrets.sh:git archive HEADalongside the existing base..HEAD and package scans;docs/development/ci.mdexplains how to add, replace or remove an exception.Validation:
tools/test_ci_security.pypasses, including new tests for entry format and refused overrides. A real scan with v8.30.1 finds nothing in the full tree with the exceptions and 2 findings without them. The control reports exactly the three expected findings.Limitation: exceptions are line-bound, so a moved fixture fails CI until its entry is updated, which fails safe. A stale entry is not detected automatically. Criterion 3 (scanning release artifacts before promotion) depends on the release workflow (#308), so this is related to, not closing, #130.
🤖 Generated with Claude Code