fix(ci): restore the real build/test/integration gate -- secret-scan was scanning unrelated orphan branches - #585
Merged
Conversation
…n the remote gitleaks defaults to scanning every ref reachable in the local clone, and the checkout step's fetch-depth: 0 fetches ALL branches on the remote (its documented behavior), not just this ref's history. This repo carries ~150 branches; one of them (head commits 67fa8e6/1e7ce4fd) has NO common ancestor with alpha at all (confirmed via the GitHub compare API) -- a disconnected, orphaned history from something unrelated ever pushed here. It contains a vendored, minified JS bundle whose libsodium export-name strings (crypto_kdf_*, crypto_aead_*, ...) pattern-match generic-api-key. That branch has nothing to do with alpha or any PR into it, but every secret-scan run scanned it anyway and always failed. Because every real build/test job declares needs: [.., secret-scan], that failure has been silently skipping the entire build and test graph -- unit-tests, build-emulator, build-arm-firmware, python-integration-tests, python-dylib-tests -- on every single PR into alpha, evidenced by nothing but lint/static-analysis/crypto-tests since. See #583. --log-opts="HEAD" restricts gitleaks to the checked-out ref's own ancestry, matching what the job is actually meant to check. Verified locally: gitleaks against this repo's real HEAD history (7816-8299 commits depending on branch) finds zero leaks; adding a local ref to the orphaned commit reproduces the 4 findings, and --log-opts="HEAD" makes them disappear again without touching the orphan branch itself.
Owner
Author
|
Independent audit: the revision scoping fixes the all-ref false positive, but this head still leaves a supply-chain/pinning defect in the same job. |
…his PR Points deps/python-keepkey at BitHighlander/python-keepkey@6420001, which removes the dead Binance Chain signing test and fixes the EOS test_updateauth golden hash for the #568/0f4dafcca waits_count loop-bound fix -- both discovered by this PR's own CI run once the secret-scan fix above let the real build/test graph run for the first time. See BitHighlander/python-keepkey#57.
This was referenced Aug 25, 2026
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this fixes
Every merge into
alpha(at least PR #543, #557, #573, and #582-in-flight) has gone in with the aggregate `CI gate` job red and every real build/test/integration job (`unit-tests`, `build-emulator`, `build-arm-firmware`, `python-integration-tests`, `python-dylib-tests`) skipped -- see #583. Only lint-format, static-analysis, crypto-tests, and check-submodules have ever actually run.Root cause
`gitleaks detect` with no `--log-opts` scans every ref reachable in the local clone, not just the checked-out commit's own history. The `secret-scan` job's checkout step uses `fetch-depth: 0`, which (per actions/checkout's documented behavior) fetches all branches and tags on the remote, not just this ref's ancestry.
This repo carries roughly 150 branches. One of them -- head commits `67fa8e60`/`1e7ce4fd` -- has no common ancestor with `alpha` at all (verified via `gh api repos/.../compare/alpha...67fa8e6` → 404, "No common ancestor"). It's a disconnected, orphaned history, unrelated to this repository's real content, that contains a vendored/minified JS bundle. Its libsodium export-name strings (`crypto_kdf_CONTEXTBYTES`, `crypto_aead_chacha20poly1305_ietf_keygen`, etc.) pattern-match gitleaks' `generic-api-key` rule.
That branch has nothing to do with `alpha` or any PR into it, but `secret-scan` scanned it anyway on every run and always failed. Because every real build/test job declares `needs: [.., secret-scan]`, GitHub Actions skipped the entire build and test graph every time -- silently, with no failure signal beyond the aggregate `CI gate` (which does correctly fail, but was not being checked).
Verification
Local, with gitleaks 8.30.0 (same pin as CI):
Fix
One line: scope the scan to `HEAD`'s own ancestry via `--log-opts="HEAD"`. Matches what the job is actually supposed to check -- this PR's own code and history -- nothing else on the remote.
Once this merges, secret-scan should pass for real, unblocking the full build/test/integration matrix for every future PR (including the in-flight round-4 PR #582, which will be rebased and re-verified against real CI once this lands).
Related: #583, #544.