Repository navigation
fix(security): scope the scheduled secret sweep to a real finding - #150
Closed
shroominic wants to merge 2 commits into
Closed
shroominic wants to merge 2 commits into
shroominic wants to merge 2 commits into
Conversation
The scheduled `Security` run on `main` fails with one gitleaks `generic-api-key` finding: `const testKey = 'ct5.macos.selftest.v1'` in the macOS self-test entry of the yuwell debug path. The value is a local keychain label, not a credential, and the commit that carries it is only reachable from another branch, so the full-clone sweep reddens `main` for content `main` never shipped. Adds a narrow `.gitleaks.toml`: the default rule set still applies and no path or rule is exempt, only that exact value, matched against the flagged line. Verified with gitleaks 8.24.3 on the real file content from the commit the scheduled sweep flags: one leak without the config, no leaks with it.
This was referenced Sep 18, 2026
Open
The scheduled run reports on the whole clone, so `main` was red for one non-secret value on another lane. Reproducing the run with the scanner version the workflow resolves to (gitleaks 8.24.3) finds four distinct classes, not one: the macOS self-test keychain label, an App Store Connect issuer identifier, two test-only fixture defaults, and one key-derived masking vector that the sensor lane published. The single allowlist now names each of them, anchored to the exact line, so the default rule set stays in force and no path is exempt. The key-derived binding is recorded rather than dismissed: it is material, it is already public, and `security/gitleaks-vendor-material.toml` is what rejects it and any successor at every tip. Also records one superseded commit. The sensor lane's first redaction commit carried a synthetic, key-shaped fixture; that commit has been rewritten and the tip is clean, but `release/v0.4.0-lane-append` merged it and then reverted the merge, so it stays reachable from the aggregate. Refs #149, #147.
This was referenced Sep 18, 2026
Owner
Author
|
Carried by the GS1 consolidation in PR #209 (branch feature/cbio-gs1, head 3eca4f4). This PR is contained in the consolidated line; the merge that carries it is 3eca4f4. Closing as subsumed by the consolidation - not as won't fix. The per-defect evidence stays in this thread, and the carrying commit above is where the change now lives. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #149. Base is
main.What was wrong
The scheduled run has no commit range, so it sweeps the whole clone, including
commits that are only reachable from other branches. That made
mainred forvalues that are not credentials.
Reproducing the run with the scanner version the workflow resolves to
(
gitleaks-actionpins gitleaks 8.24.3), instead of trusting the single findingin the issue, gives four classes:
openhealth/lib/yuwell_macos_debug_main.dartopenhealth/scripts/testflight.sh.p8key that is not in the repository.openhealth/test/sqflite_health_repository_test.dartpackages/cgm_cbio/test/cbio_crypto_test.dartThe fourth class is the one that changes the shape of this fix. It cannot be
made honest by re-encoding the fixture, and a scanner setting cannot un-publish
a value that is already in public history.
What this changes
[allowlist]with the default rule set extended, never replaced. No ruleis disabled and no path is exempt.
anywhere else still fails the sweep.
reason recorded in the file, and is not treated as a false positive.
carried a synthetic, key-shaped fixture. That commit was rewritten and is no
longer a tip, but
release/v0.4.0-lane-appendmerged it and then reverted themerge, so it is still reachable from the aggregate. A later rebuild of that
aggregate will make this entry dead.
No key byte, key-derived vector, or device address is restated in the policy.
Verification
gitleaks detect --config .gitleaks.toml(default scope)gitleaks detect --config .gitleaks.toml --log-opts=--allgitleaks detect --config .gitleaks.toml --log-opts=--remotesgitleaks detect --config .gitleaks.toml, tree w 8000 ith a deliberate canary secret committedgitleaks detect --no-git --source . --config .gitleaks.tomlAll runs with gitleaks 8.24.3, the version the pinned action resolves to.
Decisions taken
mainwouldalso make it green, but it would stop reporting history that is reachable from
the released aggregates. The scope stays as it is and the values are named
individually instead.
useDefault = true, no disabled rule, no exemptpath.
it is and points at the compensating control; it does not claim to be a false
positive. The tip guard in
security/gitleaks-vendor-material.tomlrejectsthat binding, and any successor, on every tip.
narrowly here so the gate is actionable now; moving those values out of source
belongs to their own lanes.
Decision request
The vendor stream key and the key-derived vector are already in this
repository's public history and reachable from the
0.4.0aggregate. Whetherthat material may ship at all, and whether to purge it (a rewrite of the
unmerged sensor branches and their open pull requests) or rotate it, is an owner
decision. Until it is made, the sweep stays honest about what it is exempting
and the tip guard keeps new commits clean.