Repository navigation
Conversation
The workflow calls the shared reusable workflow in Positronic-Robotics/secret-scanning. It scans only the commits that a pull request or a push adds, with the default gitleaks rules and four added rules (Nebius IAM tokens, Anthropic OAuth tokens, Tailscale keys, secrets in command-line flags). A finding shows file, line and rule id, never the value. .gitleaks.toml is a copy of the shared file; the check fails if the copy differs. The pre-commit hook runs the same rules on staged changes. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Deploying website with
|
| Latest commit: |
8075122
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://8d3d26da.website-7m7.pages.dev |
| Branch Preview URL: | https://sl-lane-gitleaks-sweep-websi.website-7m7.pages.dev |
gitleaks 8.30.1 reads no changes from git output it colors. With color.ui or color.diff set to always, the hook passed a staged secret. The hook now runs with both set to never through GIT_CONFIG_COUNT; the upstream fix (gitleaks/gitleaks#2284) is not in a release yet. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The rules copy now matches gitleaks.toml at that commit: the lpass allowlist covers only the lpass command itself, curl -u with a shell variable is allowed, and cli-flag-secret also catches quoted values that hold shell punctuation. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8075122eee
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| [[rules.allowlists]] | ||
| regexes = ['''^(?:file:|id=|env=)''', '''^[A-Z][A-Z0-9_]*=[a-z0-9]+(?:-[a-z0-9]+)*$'''] |
There was a problem hiding this comment.
When a command contains one of the documented references, such as --auth-key=file:/tmp/key-material or --env-secret API_TOKEN=my-secret-name, these allowlists do not suppress the finding. With no secretGroup configured, Gitleaks treats the entire CLI-rule match—including --auth-key= or --env-secret —as the secret, while an omitted regexTarget tests allowlist expressions against that secret; consequently, the anchored expressions beginning with file:, id=, env=, or the environment-variable name can never match. Configure the rule so the value is the secret, or make the allowlist target and expressions match the full regex match. See Gitleaks' allowlist behavior.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Not reproduced with gitleaks 8.30.1. When secretGroup is unset and the regex has capture groups, gitleaks uses the first group that matched as the secret, not group 0. Each of the three value alternatives here is a capture group.
Checked with this branch's .gitleaks.toml: --auth-key=file:/run/secrets/service-token, --auth-key=file:/tmp/abcdefghijklmnop, --secret id=my-build-secret-source,src=/tmp/abcdefghijklmnop and --env-secret API_TOKEN=my-secret-name-for-build are not reported. With this allowlist removed, all four are reported, and the reported secret starts at file:, id= or API_TOKEN=, without the flag. A literal such as --password=<random 24 characters> is still reported with the allowlist in place.
What
Every pull request and every push to
mainnow runs agitleakscheck. It scans only the commits being added, with the gitleaks default rules plus four rules for credentials the defaults miss: Nebius IAM tokens, Anthropic OAuth tokens, Tailscale keys, and a literal credential passed as a command-line flag (--token <value>). A finding fails the check and prints file, line, commit and rule id, never the value.The workflow calls the reusable workflow in Positronic-Robotics/secret-scanning, pinned to commit
17271b2. The job runs onubuntu-latestwithcontents: readand no secrets.Files
.github/workflows/gitleaks.yml: the caller, 20 lines..gitleaks.toml: a byte copy of the shared rules. The check fails if the copy differs..pre-commit-config.yaml: the gitleaks hook, which scans staged changes for anyone who runspre-commit install.Checks
A full scan of the current tree with these rules finds nothing. Reverting this PR removes the check and changes nothing else.
For contributors
gitleaks:allowin a comment on that line.file:rule:lineto.gitleaksignore. The job prints every waiver a PR adds, so reviewers see it.🤖 Generated with Claude Code