fix(ci): stop gitleaks flagging the estate baseline the scanner stages itself by hyperpolymath · Pull Request #155 · hyperpolymath/boj-server-cartridges

hyperpolymath · 2026-10-02T15:22:01Z

What

Adds a root-anchored self-exclusion ^\.gitleaks-estate\.toml$ to .gitleaks.toml.

Why

The standards secret-scanner-reusable.yml (pinned here at 84355587) copies the estate baseline to .gitleaks-estate.toml in the workspace root unconditionally: metadatastician/standards#888, still open. The baseline documents credential shapes, so generic-api-key fires 3× on it (run 37023024168). scan / gitleaks is this repo's only required context, so main @ e922780 and every PR (e.g. #154) are blocked for reasons no commit here caused.

Same cure as catachresis-colloquium/IDApTIK#127. Remove it once standards#888 lands and the caller pin is bumped past it.

Verified locally (gitleaks 8.16, relative paths, as CI runs it)

config	`.gitleaks-estate.toml` at root	planted fake PAT at `src/.gitleaks-estate.toml`
before	flagged (`generic-api-key`)	—
after	suppressed	still caught (`github-pat`)

Root-only on purpose: an unanchored (^|/) form would also hide a real file of that name at any depth.

Known reds on this PR (not caused by its diff)

scan / gitleaks: the main scan is now clean ("no leaks found"). The AsciiDoc step flags 1 finding in docs/handover/2026-05-26/prompts/earlier-02-cloudflare-token-rotation.adoc (run 37026472236). Until now the main scan died first on standards#888, which masked it. Needs owner triage: rotate and redact if live; anchored allowlist if not.
governance / Actions lockfile verify, actions.lock is in sync with the workflow YAML: inherited from main @ e922780 (red there too). Fixed by build(deps): Bump the actions group across 1 directory with 4 updates #154.
governance / Exemption ratchet: cured by a Ratchet-exception: .gitleaks.toml line on the growing commit (cb9d44d, verified locally rc=0). Pending push.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WPSJ7fBhVAMcpSffCBWUDo

…s itself The standards secret-scanner reusable copies the estate baseline to .gitleaks-estate.toml in the workspace root unconditionally (metadatastician/standards#888). The baseline documents credential shapes, so generic-api-key fires three times on it and the required `scan / gitleaks` context is red on main and on every PR (e.g. #154). Add a root-anchored self-exclusion (^\.gitleaks-estate\.toml$), the same cure as catachresis-colloquium/IDApTIK#127. Root-only on purpose: a planted PAT at src/.gitleaks-estate.toml is still detected (github-pat). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WPSJ7fBhVAMcpSffCBWUDo Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>

coderabbitai · 2026-10-02T15:22:17Z

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 27 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 62abc689-7dbe-4f69-b474-9384b0339cff

📥 Commits

Reviewing files that changed from the base of the PR and between 8546edb and 37e7927.

📒 Files selected for processing (2)

.gitleaks.toml
docs/handover/2026-05-26/prompts/earlier-02-cloudflare-token-rotation.adoc

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 8297e880-a0ab-4a59-9036-7d184e132c23

📥 Commits

Reviewing files that changed from the base of the PR and between e922780 and ccc7c2e.

📒 Files selected for processing (1)

.gitleaks.toml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (20)

GitHub Check: governance / Licence consistency
GitHub Check: governance / Actions lockfile verify
GitHub Check: governance / Trusted-base reduction policy
GitHub Check: governance / Code quality + docs
GitHub Check: governance / Security policy checks
GitHub Check: governance / Live Actions policy (credentialed advisory)
GitHub Check: governance / Well-Known (RFC 9116 + RSR)
GitHub Check: governance / Language / package anti-pattern policy
GitHub Check: governance / Debt ratchet
GitHub Check: governance / Workflow security linter
GitHub Check: governance / Guix packaging policy (Nix retired)
GitHub Check: governance / Exemption ratchet
GitHub Check: governance / Allowlist Preflight
GitHub Check: governance / Check Workflow Staleness
GitHub Check: Detect relevant changes
GitHub Check: scan / gitleaks
GitHub Check: Active orchestration adapter
GitHub Check: validate
GitHub Check: Shim drift check
GitHub Check: semgrep-cloud-platform/scan

⚠️ CI failures not shown inline (8)

GitHub Actions: Lock Sync Gate / 0_actions.lock is in sync with the workflow YAML.txt: fix(ci): stop gitleaks flagging the estate baseline the scanner stages itself

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1mtest -x scripts/check-lock-sync.sh \�[0m
 �[36;1m  || { echo "::error::scripts/check-lock-sync.sh missing or not executable"; exit 1; }�[0m

GitHub Actions: Lock Sync Gate / actions.lock is in sync with the workflow YAML: fix(ci): stop gitleaks flagging the estate baseline the scanner stages itself

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1mtest -x scripts/check-lock-sync.sh \�[0m
 �[36;1m  || { echo "::error::scripts/check-lock-sync.sh missing or not executable"; exit 1; }�[0m

GitHub Actions: Secret Scanner / 0_scan _ rust-secrets.txt: fix(ci): stop gitleaks flagging the estate baseline the scanner stages itself

Conclusion: failure

View job details

##[group]Run TODAY="${RUST_TODAY:-$(date -u +%Y-%m-%d)}"
 �[36;1mTODAY="${RUST_TODAY:-$(date -u +%Y-%m-%d)}"�[0m
 �[36;1m�[0m
 �[36;1m# An unparseable cutoff would pick the warn branch forever, silently�[0m
 �[36;1m# disarming the widened scan. Refuse to run instead.�[0m
 �[36;1mrequire_date() {�[0m
 �[36;1m  case "$2" in�[0m
 �[36;1m    [0-9][0-9][0-9][0-9]-[0-1][0-9]-[0-3][0-9]) : ;;�[0m
 �[36;1m    *) echo "::error::rust-secrets: $1='$2' is not YYYY-MM-DD."�[0m

GitHub Actions: Secret Scanner / scan _ rust-secrets: fix(ci): stop gitleaks flagging the estate baseline the scanner stages itself

Conclusion: failure

View job details

##[group]Run TODAY="${RUST_TODAY:-$(date -u +%Y-%m-%d)}"
 �[36;1mTODAY="${RUST_TODAY:-$(date -u +%Y-%m-%d)}"�[0m
 �[36;1m�[0m
 �[36;1m# An unparseable cutoff would pick the warn branch forever, silently�[0m
 �[36;1m# disarming the widened scan. Refuse to run instead.�[0m
 �[36;1mrequire_date() {�[0m
 �[36;1m  case "$2" in�[0m
 �[36;1m    [0-9][0-9][0-9][0-9]-[0-1][0-9]-[0-3][0-9]) : ;;�[0m
 �[36;1m    *) echo "::error::rust-secrets: $1='$2' is not YYYY-MM-DD."�[0m

GitHub Actions: Secret Scanner / 1_scan _ gitleaks.txt: fix(ci): stop gitleaks flagging the estate baseline the scanner stages itself

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1m�[0m
 �[36;1mMIRROR="$RUNNER_TEMP/adoc-mirror"�[0m
 �[36;1mREPORT="$RUNNER_TEMP/adoc-report.json"�[0m
 �[36;1mrm -rf "$MIRROR"; mkdir -p "$MIRROR"�[0m
 �[36;1m�[0m
 �[36;1m# -print0/read -d '' so paths with spaces or newlines survive; the�[0m
 �[36;1m# estate has directories with spaces in them.�[0m
 �[36;1mfound=0�[0m
 �[36;1mwhile IFS= read -r -d '' f; do�[0m
 �[36;1m  dest="$MIRROR/$(dirname "$f")"�[0m
 �[36;1m  mkdir -p "$dest"�[0m
 �[36;1m  cp "$f" "$dest/$(basename "$f").txt"�[0m
 �[36;1m  found=$((found + 1))�[0m
 �[36;1mdone < <(find . -path ./.git -prune -o \�[0m
 �[36;1m              \( -name '*.adoc' -o -name '*.asciidoc' \) -type f -print0)�[0m
 �[36;1m�[0m
 �[36;1mif [ "$found" -eq 0 ]; then�[0m
 �[36;1m  echo "No AsciiDoc files present — nothing to scan."�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mecho "Scanning $found AsciiDoc file(s) via mirror."�[0m
 �[36;1m�[0m
 �[36;1m# Honour the caller's own baseline when it has one, so repo-specific�[0m
 �[36;1m# allowlists still apply to docs exactly as they do to code — and�[0m
 �[36;1m# otherwise fall back to the estate baseline, so docs and code are�[0m
 �[36;1m# judged by the SAME rules. Previously this step honoured a repo�[0m
 �[36;1m# config while the code scan above honoured none, which meant an�[0m
 �[36;1m# allowlist entry could suppress a finding in a `.adoc` file and not�[0m
 �[36;1m# in the `.md` file beside it.�[0m
 �[36;1m#�[0m
 �[36;1m# Absolute paths: this scan's --source is the MIRROR directory, so a�[0m
 �[36;1m# relative config path would resolve against the mirror rather than�[0m
 �[36;1m# the repository. `[extend] path = ".gitleaks-estate.toml"` inside a�[0m
 �[36;1m# repo config resolves against the process CWD (still the repo root),�[0m
 �[36;1m# which is why the estate baseline is staged there.�[0m
 �[36;1mconfig_args=(--config "$PWD/.gitleaks-estate.toml")�[0m
 �[36;1mif [ -f .gitleaks.toml ]; then�[0m
 �[36;...

GitHub Actions: Secret Scanner / scan _ gitleaks: fix(ci): stop gitleaks flagging the estate baseline the scanner stages itself

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1m�[0m
 �[36;1mMIRROR="$RUNNER_TEMP/adoc-mirror"�[0m
 �[36;1mREPORT="$RUNNER_TEMP/adoc-report.json"�[0m
 �[36;1mrm -rf "$MIRROR"; mkdir -p "$MIRROR"�[0m
 �[36;1m�[0m
 �[36;1m# -print0/read -d '' so paths with spaces or newlines survive; the�[0m
 �[36;1m# estate has directories with spaces in them.�[0m
 �[36;1mfound=0�[0m
 �[36;1mwhile IFS= read -r -d '' f; do�[0m
 �[36;1m  dest="$MIRROR/$(dirname "$f")"�[0m
 �[36;1m  mkdir -p "$dest"�[0m
 �[36;1m  cp "$f" "$dest/$(basename "$f").txt"�[0m
 �[36;1m  found=$((found + 1))�[0m
 �[36;1mdone < <(find . -path ./.git -prune -o \�[0m
 �[36;1m              \( -name '*.adoc' -o -name '*.asciidoc' \) -type f -print0)�[0m
 �[36;1m�[0m
 �[36;1mif [ "$found" -eq 0 ]; then�[0m
 �[36;1m  echo "No AsciiDoc files present — nothing to scan."�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mecho "Scanning $found AsciiDoc file(s) via mirror."�[0m
 �[36;1m�[0m
 �[36;1m# Honour the caller's own baseline when it has one, so repo-specific�[0m
 �[36;1m# allowlists still apply to docs exactly as they do to code — and�[0m
 �[36;1m# otherwise fall back to the estate baseline, so docs and code are�[0m
 �[36;1m# judged by the SAME rules. Previously this step honoured a repo�[0m
 �[36;1m# config while the code scan above honoured none, which meant an�[0m
 �[36;1m# allowlist entry could suppress a finding in a `.adoc` file and not�[0m
 �[36;1m# in the `.md` file beside it.�[0m
 �[36;1m#�[0m
 �[36;1m# Absolute paths: this scan's --source is the MIRROR directory, so a�[0m
 �[36;1m# relative config path would resolve against the mirror rather than�[0m
 �[36;1m# the repository. `[extend] path = ".gitleaks-estate.toml"` inside a�[0m
 �[36;1m# repo config resolves against the process CWD (still the repo root),�[0m
 �[36;1m# which is why the estate baseline is staged there.�[0m
 �[36;1mconfig_args=(--config "$PWD/.gitleaks-estate.toml")�[0m
 �[36;1mif [ -f .gitleaks.toml ]; then�[0m
 �[36;...

GitHub Actions: Secret Scanner / 2_scan _ shell-secrets.txt: fix(ci): stop gitleaks flagging the estate baseline the scanner stages itself

Conclusion: failure

View job details

##[group]Run # Patterns: an `export FOO=` or `FOO=` with a quoted literal of meaningful length.
 �[36;1m# Patterns: an `export FOO=` or `FOO=` with a quoted literal of meaningful length.�[0m
 �[36;1m# Restricted to *_TOKEN / *_KEY / *_SECRET / PASSWORD to keep false-positives low.�[0m
 �[36;1mPATTERNS=(�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*TOKEN[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{20,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*API_KEY[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{20,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*SECRET[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{16,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?***"'"'"'][^"'"'"']{6,}["'"'"']'�[0m
 �[36;1m)�[0m
 �[36;1m�[0m
 �[36;1m# Inline pragma patterns — suppress a hit when found on the same or�[0m
 �[36;1m# immediately preceding line.�[0m
 �[36;1mPRAGMA_RE='(scanner-allow:[[:space:]]*shell-secrets|hypatia:[[:space:]]*allow[[:space:]]+security_errors/secret_detected)'�[0m
 �[36;1m�[0m
 �[36;1m# Param-expansion RHS pattern — assignments whose value is a variable�[0m
 �[36;1m# reference rather than a literal are never real secrets.�[0m
 �[36;1m# Matches: ="$VAR"  ="${VAR}"  ="${VAR:-…}"  ="${VAR:?…}"  ='${VAR}'  =$VAR�[0m
 �[36;1mPARAM_EXPANSION_RE='=['"'"'"'"'"']?\$\{?[A-Za-z_][A-Za-z0-9_]*(:[?-][^}]*)?\}?['"'"'"'"'"']?[[:space:]]*(#.*)?$'�[0m
 �[36;1m�[0m
 �[36;1m# Load per-repo ignore globs from .shell-secrets-ignore if present.�[0m
 �[36;1mIGNORE_GLOBS=()�[0m
 �[36;1mif [[ -f .shell-secrets-ignore ]]; then�[0m
 �[36;1m  while IFS= read -r line || [[ -n "$line" ]]; do�[0m
 �[36;1m    # Skip blank lines and comments�[0m
 �[36;1m    [[ -z "$line" || "$line" == \#* ]] && continue�[0m
 �[36;1m    IGNORE_GLOBS+=("$line")�[0m
 �[36;1m  done < .shell-secrets-ignore�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1m# is_ignored <filepath> — returns 0 (true) if path matches any ignore glob.�[0m
 �[36;1mis_ignored() {�[0m
 �[36;1m  local path="$1"�[0m
 �[36;1m  for glob in "${IGNORE_GLOBS[@]}"; do�[0m
 �[36;1m    #...

GitHub Actions: Secret Scanner / scan _ shell-secrets: fix(ci): stop gitleaks flagging the estate baseline the scanner stages itself

Conclusion: failure

View job details

##[group]Run # Patterns: an `export FOO=` or `FOO=` with a quoted literal of meaningful length.
 �[36;1m# Patterns: an `export FOO=` or `FOO=` with a quoted literal of meaningful length.�[0m
 �[36;1m# Restricted to *_TOKEN / *_KEY / *_SECRET / PASSWORD to keep false-positives low.�[0m
 �[36;1mPATTERNS=(�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*TOKEN[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{20,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*API_KEY[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{20,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*SECRET[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{16,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?***"'"'"'][^"'"'"']{6,}["'"'"']'�[0m
 �[36;1m)�[0m
 �[36;1m�[0m
 �[36;1m# Inline pragma patterns — suppress a hit when found on the same or�[0m
 �[36;1m# immediately preceding line.�[0m
 �[36;1mPRAGMA_RE='(scanner-allow:[[:space:]]*shell-secrets|hypatia:[[:space:]]*allow[[:space:]]+security_errors/secret_detected)'�[0m
 �[36;1m�[0m
 �[36;1m# Param-expansion RHS pattern — assignments whose value is a variable�[0m
 �[36;1m# reference rather than a literal are never real secrets.�[0m
 �[36;1m# Matches: ="$VAR"  ="${VAR}"  ="${VAR:-…}"  ="${VAR:?…}"  ='${VAR}'  =$VAR�[0m
 �[36;1mPARAM_EXPANSION_RE='=['"'"'"'"'"']?\$\{?[A-Za-z_][A-Za-z0-9_]*(:[?-][^}]*)?\}?['"'"'"'"'"']?[[:space:]]*(#.*)?$'�[0m
 �[36;1m�[0m
 �[36;1m# Load per-repo ignore globs from .shell-secrets-ignore if present.�[0m
 �[36;1mIGNORE_GLOBS=()�[0m
 �[36;1mif [[ -f .shell-secrets-ignore ]]; then�[0m
 �[36;1m  while IFS= read -r line || [[ -n "$line" ]]; do�[0m
 �[36;1m    # Skip blank lines and comments�[0m
 �[36;1m    [[ -z "$line" || "$line" == \#* ]] && continue�[0m
 �[36;1m    IGNORE_GLOBS+=("$line")�[0m
 �[36;1m  done < .shell-secrets-ignore�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1m# is_ignored <filepath> — returns 0 (true) if path matches any ignore glob.�[0m
 �[36;1mis_ignored() {�[0m
 �[36;1m  local path="$1"�[0m
 �[36;1m  for glob in "${IGNORE_GLOBS[@]}"; do�[0m
 �[36;1m    #...

🔇 Additional comments (1)

.gitleaks.toml (1)

55-73: LGTM!

📝 Summary

Summary by CodeRabbit

Chores
- Updated the configured path exclusions so the root-level .gitleaks-estate.toml file is excluded. Files with the same name in subdirectories remain in scope. This change affects the root-level file only; no other paths or application behaviour are changed.

Walkthrough

The Gitleaks path allowlist now excludes the root-level .gitleaks-estate.toml file. The anchored pattern does not match files with the same basename in subdirectories.

Changes

Gitleaks allowlist

Layer / File(s)	Summary
Add root-level path exception `.gitleaks.toml`	The path allowlist adds an anchored exception for the root-level `.gitleaks-estate.toml`. Files with the same basename in subdirectories do not match this pattern. Comments describe the staged file and the exception’s scope.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to ccc7c

The change adds a root-only Gitleaks exception, but the identified scanner workflow cannot resolve its configured revision. No regression from this diff is established.

Architecture Summary

Architecture risk: 🔵 Low · up to ccc7c

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

observed — Modified behavior in .gitleaks.toml: Adds an anchored path allowlist entry for the root-level .gitleaks-estate.toml; files with the same basename at other depths remain outside this pattern. The accompanying comments describe the scanner’s staged file and the exception’s scope.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the primary change: preventing Gitleaks from flagging the staged estate baseline. It is concise and specific.
Description check	✅ Passed	The description explains what changed, why it changed, the verification performed, the intended root-only scope, and known CI findings. It does not use the template headings or include the required sc…

✨ Finishing Touches

🛠️ Fix failing CI checks

Commit to this branch
Create a new PR

Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{A rabbit checks the scanner’s list,
One root file joins the allowlist.
The nested files stay in their place,
The pattern marks the root’s small space.
I nibble clover, pleased and bright,
Then hop along into the night.}

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai · 2026-10-02T16:40:08Z

Autopilot could not be updated. Open Coding to check access and billing.

coderabbitai · 2026-10-02T16:40:26Z

ℹ️ No failing CI checks found.

No CI/CD pipeline failures were detected for the current commit. If other checks (security scans, code quality, etc.) are failing, those require separate attention.

github-actions · 2026-10-02T17:02:49Z

🔍 Hypatia Security Scan

Findings: 259 issues detected

Severity	Count
🔴 Critical	6
🟠 High	27
🟡 Medium	226

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Job `triage` in label-triage.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": ".github/workflows/label-triage.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "triage"
  },
  {
    "reason": "Job `sync` in labels.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": ".github/workflows/labels.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "sync"
  },
  {
    "line": 39,
    "reason": "job in .github/workflows/labels.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/labels.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "medium"
  },
  {
    "line": 46,
    "reason": "job in .github/workflows/push-email-notify.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/push-email-notify.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "medium"
  },
  {
    "line": 51,
    "reason": "job in .github/workflows/build.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/build.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "medium"
  },
  {
    "line": 78,
    "reason": "job in .github/workflows/hypatia-scan.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/hypatia-scan.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "medium"
  },
  {
    "line": 43,
    "reason": "job in .github/workflows/pages-deploy.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/pages-deploy.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "medium"
  },
  {
    "line": 53,
    "reason": "job in .github/workflows/label-triage.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/label-triage.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "medium"
  },
  {
    "line": 41,
    "reason": "workflow .github/workflows/build.yml:41 gates on `github.actor == 'dependabot[bot]'` — `github.actor` is the run-triggering user, which an attacker controls on `pull_request_target` from a fork",
    "type": "RE008",
    "file": ".github/workflows/build.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "critical"
  },
  {
    "line": 34,
    "reason": "workflow .github/workflows/labels.yml:34 job `sync` has no `timeout-minutes:` — defaults to 360 min on hang",
    "type": "WH006",
    "file": ".github/workflows/labels.yml",
    "action": "report",
    "rule_module": "workflow_hardening",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

The Exemption ratchet reads .gitleaks.toml 14 -> 15. The one new entry is the root-anchored path the reusable stages the estate baseline to; without it gitleaks flags its own config (standards#888). Ratchet-exception: .gitleaks.toml +1 path entry (^\.gitleaks-estate\.toml$), the scanner's own staged artefact; standards#888; remove when the caller pin passes the fix Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WPSJ7fBhVAMcpSffCBWUDo

github-actions · 2026-10-02T17:21:16Z

🔍 Hypatia Security Scan

Findings: 259 issues detected

Severity	Count
🔴 Critical	6
🟠 High	27
🟡 Medium	226

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Job `triage` in label-triage.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": ".github/workflows/label-triage.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "triage"
  },
  {
    "reason": "Job `sync` in labels.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": ".github/workflows/labels.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "sync"
  },
  {
    "line": 39,
    "reason": "job in .github/workflows/labels.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/labels.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "medium"
  },
  {
    "line": 46,
    "reason": "job in .github/workflows/push-email-notify.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/push-email-notify.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "medium"
  },
  {
    "line": 51,
    "reason": "job in .github/workflows/build.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/build.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "medium"
  },
  {
    "line": 78,
    "reason": "job in .github/workflows/hypatia-scan.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/hypatia-scan.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "medium"
  },
  {
    "line": 43,
    "reason": "job in .github/workflows/pages-deploy.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/pages-deploy.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "medium"
  },
  {
    "line": 53,
    "reason": "job in .github/workflows/label-triage.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/label-triage.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "medium"
  },
  {
    "line": 41,
    "reason": "workflow .github/workflows/build.yml:41 gates on `github.actor == 'dependabot[bot]'` — `github.actor` is the run-triggering user, which an attacker controls on `pull_request_target` from a fork",
    "type": "RE008",
    "file": ".github/workflows/build.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "critical"
  },
  {
    "line": 34,
    "reason": "workflow .github/workflows/labels.yml:34 job `sync` has no `timeout-minutes:` — defaults to 360 min on hang",
    "type": "WH006",
    "file": ".github/workflows/labels.yml",
    "action": "report",
    "rule_module": "workflow_hardening",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

hyperpolymath enabled auto-merge (squash) October 2, 2026 15:22

coderabbitai Bot approved these changes Oct 2, 2026

View reviewed changes

coderabbitai Bot and others added 2 commits October 2, 2026 16:46

docs: redact leaked Cloudflare token from rotation handover prompt

8546edb

Merge branch 'main' into fix/gitleaks-self-exclude-estate-baseline

fd068d7

hyperpolymath disabled auto-merge October 2, 2026 17:01

hyperpolymath enabled auto-merge (squash) October 2, 2026 17:04

hyperpolymath disabled auto-merge October 2, 2026 18:15

hyperpolymath enabled auto-merge (squash) October 2, 2026 18:15

hyperpolymath disabled auto-merge October 2, 2026 18:25

hyperpolymath enabled auto-merge (squash) October 2, 2026 18:25

hyperpolymath disabled auto-merge October 2, 2026 18:40

hyperpolymath enabled auto-merge (squash) October 2, 2026 18:41

hyperpolymath disabled auto-merge October 2, 2026 18:41

hyperpolymath enabled auto-merge (squash) October 2, 2026 18:41

hyperpolymath disabled auto-merge October 2, 2026 18:52

hyperpolymath enabled auto-merge (squash) October 2, 2026 18:52

hyperpolymath disabled auto-merge October 2, 2026 23:24

hyperpolymath enabled auto-merge (squash) October 2, 2026 23:24

hyperpolymath disabled auto-merge October 3, 2026 05:07

hyperpolymath enabled auto-merge (squash) October 3, 2026 05:07

hyperpolymath disabled auto-merge October 3, 2026 05:09

hyperpolymath enabled auto-merge (squash) October 3, 2026 05:09

hyperpolymath disabled auto-merge October 3, 2026 05:39

hyperpolymath enabled auto-merge (squash) October 3, 2026 05:39

hyperpolymath disabled auto-merge October 3, 2026 09:34

hyperpolymath enabled auto-merge (squash) October 3, 2026 09:34

hyperpolymath merged commit 4acc637 into main Oct 3, 2026
41 checks passed

hyperpolymath deleted the fix/gitleaks-self-exclude-estate-baseline branch October 3, 2026 09:35

hyperpolymath mentioned this pull request Oct 6, 2026

fix(ci): stop gitleaks flagging the estate baseline the scanner stages itself hyperpolymath/boj-server#337

Merged

6 of 16 tasks

Navigation Menu

Repository navigation

fix(ci): stop gitleaks flagging the estate baseline the scanner stages itself - #155

fix(ci): stop gitleaks flagging the estate baseline the scanner stages itself#155
hyperpolymath merged 4 commits into
mainfrom
fix/gitleaks-self-exclude-estate-baseline

hyperpolymath commented Oct 2, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 2, 2026 •

edited

Loading

Review limit reached

Summary by CodeRabbit

Walkthrough

Changes

Uh oh!

coderabbitai Bot commented Oct 2, 2026

Uh oh!

coderabbitai Bot commented Oct 2, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 2, 2026

Uh oh!

github-actions Bot commented Oct 2, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

hyperpolymath commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

Why

Verified locally (gitleaks 8.16, relative paths, as CI runs it)

Known reds on this PR (not caused by its diff)

Uh oh!

coderabbitai Bot commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Summary by CodeRabbit

Walkthrough

Changes

Architecture Summary

Uh oh!

coderabbitai Bot commented Oct 2, 2026

Uh oh!

coderabbitai Bot commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 2, 2026

🔍 Hypatia Security Scan

Uh oh!

github-actions Bot commented Oct 2, 2026

🔍 Hypatia Security Scan

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

hyperpolymath commented Oct 2, 2026 •

edited

Loading

coderabbitai Bot commented Oct 2, 2026 •

edited

Loading

coderabbitai Bot commented Oct 2, 2026 •

edited

Loading