Repository navigation
Gates: no credential in the project (M10.2 secret scan) - #107
Merged
Merged
Conversation
…e final gate the whole tree (M10.2) New plugin/bin/secrets scans for private key blocks and fixed-prefix tokens (AWS, GitHub, GitLab, Slack, Stripe, Google, Anthropic, OpenAI) and reports path:line:kind, never the text. `aloop: allow-secret` exempts a fixture line. Test: scripts/test/supply-chain.test.py cases 3-4. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015QxyVf3NgwsgRyYpBgDDTC
adeelahmad
marked this pull request as ready for review
October 20, 2026 12:50
adeelahmad
pushed a commit
that referenced
this pull request
Oct 20, 2026
…gate branch Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WBVFNrEg85XAnSfHQidCXN
adeelahmad
pushed a commit
that referenced
this pull request
Oct 20, 2026
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AiLhAWTRtwbgMCDQNJUbea
adeelahmad
pushed a commit
that referenced
this pull request
Oct 20, 2026
…er and rule fixes The merge follows the #86 thread's recipe for _shellread.py (Word.body ours, Cmd keeps end plus loop/pipe, their heredoc registration, `for NAME do`), and doors.py skips the reader's compound markers and keeps a pipeline element's cd in the element. Round 4 (the verifiers of round 3): the scope gate walks every state a command may leave the shell in. A cd inside an if/case/loop body, group or function, or after && / ||, may or may not have run, so the rest is judged from each dir (a compound's own `} > f` from where it started); a loop body once per item; unquoted $VAR splits; eval and source /dev/stdin run in the calling shell; a background job's cd stays in it; nesting past 8 levels, more than 1024 walks or 50 000 judged commands blocks. find's -name tests bound a removal through -o alternatives and negations; -fprint/-fls write; wget --spider -O, npm -g --prefix, --global=false, os.environ.__setitem__/ update, xargs -i/-I{}, runuser options and `command -p export` are read. Residuals are ROADMAP M9.54. mission-scope-bash.test.py: 718 commands. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0197nSutKR1QAAqgJhFZ8fPj
adeelahmad
pushed a commit
that referenced
this pull request
Oct 20, 2026
…ch; docs for M9.31 Conflicts: the OpenCode plugin's header comment (gate-dispatch on task from master, the door gate last from this branch) and codex-hooks.test.py (both blocks kept). ROADMAP: M9.31 done, new items M9.48, M9.49, M9.54-M9.59, and the M9 row of section 0 brought up to date; TRACKING, CHANGELOG, OVERVIEW. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012rsDo9GYzNx8tXucywZHnA
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by Adeel · project thread
Before: a worker could paste a live API key into code and every gate would pass, because acceptance proves behaviour only.
After: GREEN blocks a private key or fixed-prefix token (AWS, GitHub, GitLab, Slack, Stripe, Google, Anthropic, OpenAI) in the lines its task adds, and
gate-finalblocks one anywhere in the project. The block namespath:line: kindand never prints the secret. A fixture line can carryaloop: allow-secret.How: new stdlib-only
plugin/bin/secrets scan [--base REF];_gatelib.shgainsassert_no_secrets. It is built in rather than a matrix line so it runs on every stack with nothing to install, and it only matches shapes that are near-certain (no genericpassword=guessing). Personas for GREEN and the final gate state the rule. Evidence:scripts/test/supply-chain.test.py4/4 (new cases 3 and 4 build fake keys at run time so the repo holds none), the scan is clean on this repo, andmake cipassed 78/78 locally. The dependency audit half of M10.2 is still open on the ROADMAP.Generated by Claude Code