Skip to content

fix(ci): stop gitleaks flagging the estate baseline the scanner stages itself #155

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hyperpolymath merged 4 commits into from
Oct 3, 2026
Merged

fix(ci): stop gitleaks flagging the estate baseline the scanner stages itself #155

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
ccc7c2e
fix(ci): stop gitleaks flagging the estate baseline the scanner stage…
hyperpolymath Oct 2, 2026
8546edb
docs: redact leaked Cloudflare token from rotation handover prompt
coderabbitai[bot] Oct 2, 2026
fd068d7
Merge branch 'main' into fix/gitleaks-self-exclude-estate-baseline
hyperpolymath Oct 2, 2026
37e7927
chore(ci): record the Ratchet-exception for the gitleaks self-exclusion
hyperpolymath Oct 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 19 additions & 0 deletions .gitleaks.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,25 @@ paths = [
# registry, which trip the generic-api-key entropy heuristic.
'''(^|/)Project\.toml$''',
'''(^|/)Manifest\.toml$''',

# The SCANNER'S OWN STAGED ARTEFACT -- not an exemption for a file that
# "is fine", which the DESIGN RULE above forbids, but the one file the
# scanner writes into its own scan target.
#
# The standards secret-scanner reusable copies
# `config/gitleaks/estate-baseline.toml` to `.gitleaks-estate.toml` in the
# workspace root UNCONDITIONALLY, before the step that decides whether this
# repo references it (hyperpolymath/standards#888). That baseline documents
# worked examples of credential SHAPES, so `generic-api-key` fires on it and
# the required `scan / gitleaks` gate goes red for reasons no commit here
# caused (3 findings on `.gitleaks-estate.toml`, run 37023024168).
#
# Anchored `^...$` -- ROOT ONLY. A path regex matches a BASENAME AT ANY
# DEPTH unless anchored, so `(^|/)` would also blind the scanner to a real
# `src/.gitleaks-estate.toml`. The reusable only ever writes the file at the
# root, so root-only is exact. Same cure as metadatastician/IDApTIK#127;
# remove once standards#888 lands and the caller pin is bumped past it.
'''^\.gitleaks-estate\.toml$''',
]

regexes = [
Expand Down
4 changes: 2 additions & 2 deletions docs/handover/2026-05-26/prompts/earlier-02-cloudflare-token-rotation.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ confirmation.

== Context

* Token ID: `689fa59a165c47cc61095d984c453205`
* Token value: [REDACTED — see the incident references below; rotation remains unverified].
* Leak location: `standards/avow-protocol/deploy-repos.sh:5` commit `5f2f8b2`
* Token status: **UNVERIFIED** at Cloudflare as of session-end 2026-05-26.
* Code fix PR `standards#161` MERGED 2026-05-26 — removed the literal token from the file.
Expand All @@ -21,7 +21,7 @@ Memory: `project_cloudflare_token_leak_2026_05_21.md`.

== Concrete steps

. **ASK** the user explicitly: "Was Cloudflare token `689fa59a...` rotated?"
. **ASK** the user explicitly: "Was the leaked Cloudflare token referenced below rotated?"
Do not proceed without an unambiguous yes.
. If yes:
.. Confirm the new token works for whatever workflow depended on the old one.
Expand Down
Loading