Repository navigation
Conversation
The workflow calls the shared reusable workflow in Positronic-Robotics/secret-scanning. It scans only the commits that a pull request or a push adds, with the default gitleaks rules and four added rules (Nebius IAM tokens, Anthropic OAuth tokens, Tailscale keys, secrets in command-line flags). A finding shows file, line and rule id, never the value. .gitleaks.toml is a copy of the shared file; the check fails if the copy differs. The pre-commit hook runs the same rules on staged changes, with git color off because gitleaks 8.30.1 scans nothing from colored git output. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
The rules copy now matches gitleaks.toml at that commit: the lpass allowlist covers only the lpass command itself, curl -u with a shell variable is allowed, and cli-flag-secret also catches quoted values that hold shell punctuation. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0e8b3bcfce
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # A value starting with $ < { / . ~ or a quote is a variable, placeholder or path, not a literal. | ||
| # Inside quotes the rest of the value may hold any punctuation up to a space or the closing quote, | ||
| # except $ inside double quotes, where the shell expands it. The secret is the first group that matched. | ||
| regex = '''(?i)--(?:[a-z0-9]+[-_])*(?:token|api[-_]?key|password|passwd|secret|secret[-_]key|access[-_]key|auth[-_]?key)(?:=|[ \t]+)(?:'([^\s'$<{/.~][^\s']{15,})|"([^\s"$<{/.~][^\s"$]{15,})|([A-Za-z0-9_\-+=!@#%^&*:,][A-Za-z0-9_\-+/=.!@#%^&*~:,]{15,}))''' |
There was a problem hiding this comment.
Gitleaks uses capture group 0 (the entire --flag=value match) when secretGroup is unset, and an allowlist without regexTarget tests that extracted secret. Consequently, the value-anchored allowlists below can never match: intended exemptions such as --auth-key=file:/tmp/abcdefghijklmnop and --secret id=my-build-secret-source exceed the entropy threshold and fail both pre-commit and CI. The entropy check likewise measures the flag plus value rather than the credential. Restructure the alternatives around one capture group and set secretGroup, or target the full match explicitly.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Not reproduced with gitleaks 8.30.1. When secretGroup is unset and the regex has capture groups, gitleaks uses the first group that matched as the secret, not group 0. Each of the three value alternatives here is a capture group.
Checked with this branch's .gitleaks.toml: --auth-key=file:/run/secrets/service-token, --auth-key=file:/tmp/abcdefghijklmnop, --secret id=my-build-secret-source,src=/tmp/abcdefghijklmnop and --env-secret API_TOKEN=my-secret-name-for-build are not reported. With this allowlist removed, all four are reported, and the reported secret starts at file:, id= or API_TOKEN=, without the flag. A literal such as --password=<random 24 characters> is still reported with the allowlist in place.
What
Every pull request and every push to
mainnow runs agitleakscheck. It scans only the commits being added, with the gitleaks default rules plus four rules for credentials the defaults miss: Nebius IAM tokens, Anthropic OAuth tokens, Tailscale keys, and a literal credential passed as a command-line flag (--token <value>). A finding fails the check and prints file, line, commit and rule id, never the value.The workflow calls the reusable workflow in Positronic-Robotics/secret-scanning, pinned to commit
17271b2. The job runs onubuntu-latestwithcontents: readand no secrets.Files
.github/workflows/gitleaks.yml: the caller, 20 lines..gitleaks.toml: a byte copy of the shared rules. The check fails if the copy differs..pre-commit-config.yaml: the gitleaks hook, which scans staged changes for anyone who runspre-commit install. It runs with git color off: gitleaks 8.30.1 reads no changes from colored git output, so withcolor.ui=alwaysit passed a staged secret (fix: force --no-color on git diff/log so forced color config doesn't break parsing gitleaks/gitleaks#2284, not yet released).Checks
A full scan of the current tree with these rules finds nothing. Reverting this PR removes the check and changes nothing else.
For contributors
gitleaks:allowin a comment on that line.file:rule:lineto.gitleaksignore. The job prints every waiver a PR adds, so reviewers see it.🤖 Generated with Claude Code