Repository navigation
fix(secret-scanner): stage the estate baseline only for repos without a local config - #1297
Conversation
… a local config
The ungated "Fetch/Stage estate gitleaks baseline" steps copied
.gitleaks-estate.toml into every caller's workspace. A repo with its own
.gitleaks.toml scans with that config; if it does not [extend] the baseline,
the staged file sits in the scanned tree with no allowlist for the fixture
values its comments quote, and the gate reports the estate file as the
caller's leak (echidnabot#185: three generic-api-key findings, lines 84-85).
Gate both steps on hashFiles('.gitleaks.toml') == ''. Repos without a local
config are unchanged (CONFIG still resolves to the staged baseline); repos
that [extend] it are still staged by the existing gated block.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 57 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
🟢 conformant · commit
K9 live corpus (L0–L2): 2 finding(s) / scope notes
Scope: DEED syntax and K9 contracts L0–L2. L3 signature verification and routed coordination dialects are not certified. Green is limited to this scope. Orange is missing evidence; grey is an explicit scope exclusion. Logs and report.json are in the dated conformance-evidence artifact on the linked run. |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ff272158cc
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
TOML literal strings are single-quoted, and gitleaks reads extend.path as a plain string, so `path = '.gitleaks-estate.toml'` is a valid reference. The detection matched only the double-quoted spelling. With the ungated staging now skipped for repos that have a .gitleaks.toml, such a repo would have scanned with an [extend] pointing at a file nothing staged. Accept either quote. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3
|
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d5993e3a52
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| set -euo pipefail | ||
| if [ -f .gitleaks.toml ] && \ | ||
| grep -qE '^[[:space:]]*path[[:space:]]*=[[:space:]]*"\.gitleaks-estate\.toml"' .gitleaks.toml; then | ||
| grep -qE "^[[:space:]]*path[[:space:]]*=[[:space:]]*[\"']\.gitleaks-estate\.toml[\"']" .gitleaks.toml; then |
There was a problem hiding this comment.
Although the single-quoted variant is now handled, valid TOML can also express this setting as extend.path = ".gitleaks-estate.toml"; Gitleaks decodes that as the same nested extend.path, but this regex does not match it. For a repository using that form, both newly gated initial staging steps are skipped because .gitleaks.toml exists, this step reports referenced=false, and each scan fails while loading the absent extended file. Parse the TOML or recognize the dotted-key form before suppressing baseline staging.
Useful? React with 👍 / 👎.
2 participants
What
Gates the "Fetch estate gitleaks baseline" and "Stage estate gitleaks baseline" steps on
hashFiles('.gitleaks.toml') == '', and updates the comment above them to match.Why
These steps copied
.gitleaks-estate.tomlinto every caller's workspace. A repo with its own.gitleaks.tomlscans with that config. If that config does not[extend]the baseline, the staged file sits in the scanned tree. Nothing allowlists the fixture values its own comments quote, so the gate reports the estate file as the caller's leak.This surfaced on hyperpolymath/echidnabot#185 as soon as its lock repair let the reusable start: three
generic-api-keyfindings in.gitleaks-estate.toml, at lines 84 and 85.Behaviour by consumer
.gitleaks.toml(most of the estate).gitleaks.tomlthat[extend]s the baseline.gitleaks.tomlthat does not extend itEvery later reference to
.gitleaks-estate.toml(the working-tree pass, the git-history pass and the AsciiDoc mirror) uses it only when no.gitleaks.tomlexists, so no pass is left naming a missing file.Validation
actionlintreports only the two existingjob.workflow_shalines, which are unchanged from main. That field is newer than the local actionlint.Generated by Claude Code