Pre-commit header and CONTRIBUTING claim gitleaks runs in CI; no workflow runs any secret scanner, so SKIP=gitleaks removes the only scan (CR-A16-017) #423

Wave 1 · theme D1-7: Dependency floors, container and supply chain · highest severity High · 4 finding(s) · effort small

Summary

A contributor commits a real token with SKIP=gitleaks, trusting CONTRIBUTING's 'never bypasses CI'. Nothing in CI scans it.

Primary finding

CR-A16-017 — Pre-commit header and CONTRIBUTING claim gitleaks runs in CI; no workflow runs any secret scanner, so SKIP=gitleaks removes the only scan

severity Medium · reachability default · intent contract-violation · confidence confirmed · independently confirmed · reproduced end to end

What happens. .pre-commit-config.yaml:3-4 states 'ruff and gitleaks already run as separate steps in .github/workflows/ci.yml' and CONTRIBUTING.md:168-171,186-195 says the hooks mirror CI and that skipping a hook 'never bypasses CI', but no file under .github/ invokes gitleaks (docs/standards/code-review.md:265-267 correctly says it is pre-commit-only). Secret scanning is therefore an optional, bypassable local hook misdescribed as a CI-enforced control.

Where.

• .pre-commit-config.yaml:3-5
• .pre-commit-config.yaml:19-28
• .github/workflows/ci.yml:41
• README.md:122
• CONTRIBUTING.md:168-171
• CONTRIBUTING.md:186-194
• docs/standards/code-review.md:265-267
• CONTRIBUTING.md:186-195
• .pre-commit-config.yaml:3-4
• CONTRIBUTING.md:169

Evidence.

• grep -rn gitleaks .github returns nothing.
• rg -i gitleaks .github finds no match. Venv ruff is 0.15.21; no ruff 0.8 was available to diff the formatter output.
• rg -i gitleaks .github/ returns no matches.

Recommended fix. Add a gitleaks job to ci.yml or correct the header. Align the hook's ruff rev with the CI bound.

Other findings with the same root cause

These close with the same fix; update them in the same pull request.

TECH-T12-005 — Supply-chain tooling, network dependencies and vulnerability scanning: gitleaks v8.18.0 pre-commit hook; gitleaks absent from CI (.pre-commit-config.yaml:25-28) (outdated)

severity Next release

Item. gitleaks v8.18.0 pre-commit hook; gitleaks absent from CI (.pre-commit-config.yaml:25-28) · verdict: outdated · urgency: Next release

State in ForgeLM. .pre-commit-config.yaml:25-28 pins gitleaks v8.18.0; its header (:3-4) and CONTRIBUTING.md:168-172,195 say CI runs or enforces gitleaks; no workflow references gitleaks; docs/standards/code-review.md:265-267 correctly says it is pre-commit-only; README.md:122 lists 'gitleaks pre-commit'.

State of the ecosystem on 2026-10-01. v8.18.0 was tagged 2023-08-22; latest is v8.30.1 (tag 2026-02-21, release 2026-03-21). Upstream README: 'Gitleaks is feature complete ... Future releases will be security patches only' (focus moved to Betterleaks). Default rules grew from 160 to 222; v8.18.0 lacks huggingface-access-token, huggingface-organization-api-token, anthropic-api-key and anthropic-admin-api-key, and its openai-api-key regex requires sk- plus exactly 20 alphanumerics, T3BlbkFJ and 20 alphanumerics, so prefixed keys such as sk-proj- do not match.

Impact. The only secret scanner is an optional local hook that misses HF tokens (ForgeLM's central secret) and current LLM-provider keys; two documents misstate CI enforcement.

Recommendation. Bump to v8.30.1 (or evaluate Betterleaks), add a pinned secret-scanning CI job, and fix .pre-commit-config.yaml:3-4 and CONTRIBUTING.md:168-172,195.

Sources.

• gitleaks releases (v8.30.1) (2026-03-21)
• gitleaks README ('feature complete ... security patches only'; Betterleaks) (undated (retrieved 2026-10-01))
• gitleaks v8.18.0 default config (160 rules) (2023-08-22)
• gitleaks v8.30.1 default config (222 rules) (2026-02-21)
• Go module proxy: gitleaks @latest v8.30.1 (2026-02-21)
• Go module proxy: gitleaks v8.18.0 (2023-08-22) (2023-08-22)

DOC-D4B03-001 — CONTRIBUTING.md: false claim — The pre-commit config 'mirrors the CI checks (ruff, ruff-format, gitleaks, ...)', 'CI enforces the same checks on every PR', and 'skipping a hook locally never bypasses…

severity High · already tracked: KNOWN-OPEN OPS-02|OPS-03|OPS-04|OPS-05|OPS-06|OPS-15|OPS-16|OPS-19 docs/roadmap/phase-16-trust-surface-hardening.md:670-671

Where. CONTRIBUTING.md:168-172, 195 · type: false claim

The document says. The pre-commit config 'mirrors the CI checks (ruff, ruff-format, gitleaks, ...)', 'CI enforces the same checks on every PR', and 'skipping a hook locally never bypasses CI' (L188-192 shows SKIP=gitleaks as safe).

What the code does. gitleaks runs in no GitHub Actions workflow. grep -rIi gitleaks .github/ finds nothing, and only ci.yml runs ruff, mypy, guards and bandit. gitleaks exists only in .pre-commit-config.yaml. docs/standards/code-review.md:265-267 says exactly this: 'gitleaks is pre-commit-only ... not wired into any GitHub Actions workflow'. So SKIP=gitleaks git commit does bypass all credential scanning, and CI will not catch a committed secret.

Code references. .github/workflows/ci.yml (no gitleaks step), .github/workflows/nightly.yml, .pre-commit-config.yaml:4-5,22-25, docs/standards/code-review.md:265-267

User impact. A contributor or maintainer believes CI is a backstop for committed credentials and skips or ignores the local hook. The rubric's critical tier (a security control presented as protecting when it does not) is arguable here. High is proposed because code-review.md documents the real state correctly and the audience is contributors, not product users.

Proposed correction. Either state the truth in CONTRIBUTING.md (keep it EN-only): 'The hooks are an optional local convenience. ruff and ruff-format are re-run by CI. gitleaks is local-only and no CI job re-runs it, so skipping it means no credential scan happens before merge.' Or the better fix is in code: add a gitleaks job to ci.yml and keep the sentence. Also correct the same false header comment at .pre-commit-config.yaml:4-5.

DOC-BLEGAL-054 — CONTRIBUTING.md: false claim — [IS-T12-16] 'CI remains the enforcement boundary; skipping a hook locally never bypasses CI.'

severity Medium

Where. CONTRIBUTING.md:195 · type: false claim

The document says. [IS-T12-16] 'CI remains the enforcement boundary; skipping a hook locally never bypasses CI.'

What the code does. gitleaks runs only as a pre-commit hook (.pre-commit-config.yaml:25-28, pinned at v8.18.0) and is absent from CI, so SKIP=gitleaks bypasses the project's only secret scan. v8.18.0 also lacks Hugging Face and Anthropic token rules.

User impact. Contributors skip the secret scan believing CI will catch leaks, but nothing downstream does.

Proposed correction. Note: gitleaks runs only as a local pre-commit hook; CI does not re-run it, so SKIP=gitleaks disables secret scanning for that commit. (Or add a gitleaks job to CI.)

Acceptance criteria

• A regression test reproduces the failure scenario and asserts the corrected behaviour.
• Documentation listed above is corrected in English and in its Turkish mirror in the same PR.
• Every finding in this issue is resolved or explicitly closed with a reason.

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}