Repository navigation
ci(gates): remove the stale copy of the gitleaks baseline - #202
Conversation
The secret scanner (proven-cicd at 03e858b) puts its own baseline into the tree as `.gitleaks-estate.toml`. When a repository has a `.gitleaks.toml`, the scanner uses that file as the config. The `.gitleaks.toml` of this repository was a full copy of an earlier estate baseline. It did not extend `.gitleaks-estate.toml`, so the path entry that exempts the baseline file was not in effect. On `main` at a045184 (run 42877094785) the scan fails on 1 job, `scan / gitleaks`: the tree pass finds 3 lines of fixture text in a comment of the scanner's own baseline (rule `generic-api-key`). The history pass, the Rust rule and the shell rule pass. Each of the 14 allowlist entries of the removed file is in the baseline (18 entries). The file had no entry of its own. No other file in this repository names it. With no `.gitleaks.toml`, the scanner uses the baseline directly, so the scan follows the estate rule. Not verified by a gitleaks run: the session has no gitleaks binary. On a pull request the scanner takes the config from the base, so the check on the pull request still uses the old file. The first proof is the scan on `main` after the merge. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0136P7ZmiFSCoB3UR9Kk56rK
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 25 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
|
|
Generated by Claude Code |
|
Generated by Claude Code |
Codex Review Summary: ❌ FailedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Result after the merge, as promised above.
The scan before the merge (
Generated by Claude Code |
Summary
The secret scan on
mainfails on 1 job,scan / gitleaks(run 42877094785 ata045184). This pull request removes the cause:.gitleaks.toml, a stale full copy of the estate baseline.This is the follow-up that #201 named ("Not in this change:
.gitleaks.toml"). The owner decided to remove the copy. #201 merged before the change was in it, so the change is here.Cause
hyperpolymath/proven-cicdat03e858b) puts its own baseline into the tree with the name.gitleaks-estate.toml..gitleaks.toml, the scanner uses that file as the config..gitleaks.tomlhere was a full copy of an earlier estate baseline. It did not extend.gitleaks-estate.toml, so the path entry that exempts the baseline file was not in effect..gitleaks-estate.toml(lines 88 and 89, rulegeneric-api-key). The lines are fixture text in a comment of the scanner's baseline. They are not secrets, and the file is not a file of this repository.State of the scan on
mainata045184: history pass 0 leaks (350 commits), Rust rule 0, shell rule 0, tree pass 3 findings.Changes
.gitleaks.tomlis removed (105 lines).With no
.gitleaks.toml, the scanner uses the baseline directly. The scan then follows the estate rule and cannot be weaker than it.Why removal and not a file that extends the baseline: the copy has no entry of its own. Each of its 14 allowlist entries is in the baseline (18 entries). A file with
[extend] path = ".gitleaks-estate.toml"is correct on the day that this repository needs a local exemption. gitbot-fleet has that form.No other file in this repository names
.gitleaks.toml.What to expect in CI
scan / gitleaksstays red on this pull request. On a pull request, the scanner takes the config from the base and not from the head (check.shof the scanner, lines 27 to 49 and 82). The base still has the copy. So this check cannot show the repair before the merge. This is the design of the scanner: a pull request cannot change the rules of its own scan.The proof is the first scan on
mainafter the merge. Expected: all 3scan / ...jobs pass.Testing
03e858b.grepforgitleaks.tomlin the tree after the change: 0 files.main.If the scan on
mainis not clean after the mergeA new finding then comes from an entry that the baseline has and the copy did not have, or from a rule of the baseline. The repair is a
.gitleaks.tomlthat extends the baseline with 1 justified entry. The repair is not this file again.Generated by Claude Code