From 00d3dedb1fe0eb49eff589a63c70c6d583222615 Mon Sep 17 00:00:00 2001 From: Lily Shen <115414357+lilyshen0722@users.noreply.github.com> Date: Wed, 21 Oct 2026 09:57:41 -0700 Subject: [PATCH 1/3] fix(ci): allowlist the fake JWT fixture from #2213; main's Secret Scan has been red since 10-16 generic-api-key matched a test fixture in agentProvisionerServiceK8s.test.js:456, the base64 of {"alg":"RS256"} followed by ".jwt" (no payload, no signature). Because the scan walks main's full history, every push to main has failed Secret Scan since #2213 (f660d6f2d), which hides any real finding behind a known red. The allowlist names that exact literal, so a real JWT still fails. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_015eTFc9yqm2vKZiUyvLuBT4 --- .gitleaks.toml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.gitleaks.toml b/.gitleaks.toml index 80b8f7ffe9..967a926260 100644 --- a/.gitleaks.toml +++ b/.gitleaks.toml @@ -17,6 +17,11 @@ regexes = [ # (shared on the landing page, README, and Discord). Tests pin it as the # REACT_APP_COMMUNITY_INVITE_TOKEN fixture; it is not a secret. '''7b91255f18ae3c0ae3721707a6613731''', + # A fake ChatGPT JWT in agentProvisionerServiceK8s.test.js (#2213): the + # base64 of {"alg":"RS256"} followed by the literal ".jwt", no payload and no + # signature. generic-api-key matched it, and main's Secret Scan was red on + # every push from 2026-10-16. The exact literal only, so a real token still fails. + '''eyJhbGciOiJSUzI1NiJ9\.jwt''', ] paths = [ From c09b7cbf3fd182b2b185fb22d3d32d0dee574d27 Mon Sep 17 00:00:00 2001 From: Lily Shen <115414357+lilyshen0722@users.noreply.github.com> Date: Wed, 21 Oct 2026 10:02:55 -0700 Subject: [PATCH 2/3] fix(ci): PR secret scans covered 0 commits; name the commits instead of a --remotes glob `--remotes=origin/main` is a git glob that becomes origin/main/*, so it matched nothing. On a push the scan still worked, because `--branches` held the checked-out branch, but a pull request checks out a detached merge commit with no local branch, and every PR scan reported "0 commits scanned, no leaks found": #2375, #2368 and #2389 all did. That is how #2213's fixture passed review and only went red on main. Scan HEAD (the PR merge commit, or the pushed branch) plus origin/main and origin/v1.0.x by name. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_015eTFc9yqm2vKZiUyvLuBT4 --- .github/workflows/secret-scan.yml | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml index 5fadda02c3..8b44aa5a9f 100644 --- a/.github/workflows/secret-scan.yml +++ b/.github/workflows/secret-scan.yml @@ -38,6 +38,13 @@ jobs: run: | # Scan the full history of our branches (not --all, which includes # submodule git objects from _external/clawdbot). - # ~500 commits, ~15s. Catches historical leaks in our own code. + # ~2,600 commits, ~20s. Catches historical leaks in our own code. + # + # Name the commits; don't pattern-match them. `--remotes=origin/main` + # is a glob that git extends to origin/main/*, so it matched nothing. + # A push still scanned, through the checked-out branch in --branches, + # but a pull request checks out a detached merge commit with no local + # branch, and every PR scan reported "0 commits scanned" and passed. + # HEAD is that merge commit on a PR, and the pushed branch on a push. gitleaks detect --source . --config .gitleaks.toml --redact -v \ - --log-opts="--branches --remotes=origin/main --remotes=origin/v1.0.x" + --log-opts="HEAD origin/main origin/v1.0.x" From 6270d767b3431818c0e2b1625cdf25f2dc56622c Mon Sep 17 00:00:00 2001 From: Lily Shen <115414357+lilyshen0722@users.noreply.github.com> Date: Wed, 21 Oct 2026 10:13:22 -0700 Subject: [PATCH 3/3] docs(review): rule 56, a scan that found nothing proved nothing until it says what it covered; Secret Scan now fails on 0 commits MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Secret Scan passed every pull request from #84 (2026-04-03) with "0 commits scanned … no leaks found", and nobody noticed because main's push scan was real. Rule 56 makes the coverage line the first thing a reviewer reads and an empty input a failure. The workflow enforces it: it counts the commits it is about to scan and fails on zero. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_015eTFc9yqm2vKZiUyvLuBT4 --- .github/workflows/secret-scan.yml | 6 ++++++ docs/development/review-checklist.md | 4 ++++ 2 files changed, 10 insertions(+) diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml index 8b44aa5a9f..caca2c20ad 100644 --- a/.github/workflows/secret-scan.yml +++ b/.github/workflows/secret-scan.yml @@ -46,5 +46,11 @@ jobs: # but a pull request checks out a detached merge commit with no local # branch, and every PR scan reported "0 commits scanned" and passed. # HEAD is that merge commit on a PR, and the pushed branch on a push. + # + # A scan of nothing still prints "no leaks found", so an empty input + # fails here instead (review checklist rule 56). + n=$(git rev-list --count HEAD origin/main origin/v1.0.x) + echo "commits to scan: $n" + [ "$n" -gt 0 ] || { echo "::error::Secret Scan has 0 commits to scan"; exit 1; } gitleaks detect --source . --config .gitleaks.toml --redact -v \ --log-opts="HEAD origin/main origin/v1.0.x" diff --git a/docs/development/review-checklist.md b/docs/development/review-checklist.md index 2f1c21fa53..2c3b182842 100644 --- a/docs/development/review-checklist.md +++ b/docs/development/review-checklist.md @@ -237,3 +237,7 @@ And then note where the fix landed. Someone hit the audience gap, felt it, and b ## Which database ran the SQL 55. **A SQL change tested only on pg-mem is not tested.** pg-mem is an in-memory imitation of Postgres. Its parser and type inference are its own, so it accepts queries real Postgres refuses, and refuses some real Postgres runs (it has no `EXISTS`, for one). A green pg-mem arm proves the query does what you meant *in pg-mem*. Any change to a query's text, parameters or casts needs an arm in the tier-1 suite (`backend/__tests__/service`, real Postgres in CI), run locally against a real server before the head is cited. A plain write is one of the cases: a guard added for an edge case runs on every row. *(Earned: #2272, 2026-10-16. The INSERT's new same-pod guard was written `$1 IN (SELECT target.pod_id …)`, with `$1` also a value in the select list. pg-mem accepted it, and all six unit arms and six mutations were green. Real Postgres refused **every** write with `42P08 inconsistent types deduced for parameter $1`: plain posts, same-pod replies and cross-pod replies alike. Merged, it would have stopped every chat write. Cofounder's security read ran it on postgres:17.10 with the production pool. The PR's own tier-1 job failed the same way, after the author had already asked for gates. Fixed with `$1::varchar`, and tier-1 arms added for a plain post, a same-pod reply, a cross-pod reply and a root named in another pod.)* + +## What a scan covered + +56. **A scan that reports nothing found has proved nothing until it reports what it covered, and a count of zero is a failure, not a pass.** "No leaks found", "0 findings" and a green tick read the same whether the scanner read 2,581 commits or none, so the result a reviewer sees cannot tell a clean input from an empty one. Read the coverage line (commits scanned, files checked, rows matched) before the result. When you own the check, make an empty input fail it. The usual shape is a scan that works on one trigger and not another: the trigger you watch is real, and it vouches for the one you don't. *(Earned: #2389, 2026-10-21. Secret Scan passed every pull request from its first day, #84 on 2026-04-03, with "0 commits scanned … no leaks found". Its `--remotes=origin/main` is a git glob for `origin/main/*` and matched nothing, and a pull request checks out a detached merge commit with no local branch for `--branches` to find. Pushes to main scanned through the checked-out branch, so main's scan was real and nobody read the pull-request one. #2213's fake-JWT fixture passed its pull request and then kept main red for five days. A one-time scan of every branch and pull-request head, 8,883 commits in #2390, found no real secret. The workflow now names its commits and fails before scanning when there are none.)*