From 4318481c1fbc18367474e60fa6f089d52df3b11b Mon Sep 17 00:00:00 2001 From: Leo Date: Mon, 13 Jul 2026 12:50:20 -0400 Subject: [PATCH 1/2] ci: allowlist gitleaks false positives blocking secret scan The generic-api-key rule matches the ADR-101 section heading token wasm32-compilable (present on main, so every PR branched from current main fails the scan) and two hex test fixtures in khive-pack-git cache tests. Allowlist the three matched strings; real detection unchanged. Co-Authored-By: Claude Fable 5 --- .gitleaks.toml | 10 ++++++++++ 1 file changed, 10 insertions(+) create mode 100644 .gitleaks.toml diff --git a/.gitleaks.toml b/.gitleaks.toml new file mode 100644 index 000000000..73457e4ae --- /dev/null +++ b/.gitleaks.toml @@ -0,0 +1,10 @@ +[extend] +useDefault = true + +[allowlist] +description = "Known false positives: documentation headings and test fixtures matched by generic-api-key" +regexes = [ + '''wasm32-compilable''', + '''abcdef0123456789''', + '''fedcba9876543210''', +] From a98a3afc034c5b6ade3615e3d1e49aacab14fc00 Mon Sep 17 00:00:00 2001 From: Leo Date: Mon, 13 Jul 2026 15:52:11 -0400 Subject: [PATCH 2/2] ci: replace global allowlist with finding-specific gitleaks fingerprints An unanchored global allowlist regex is tested against the extracted secret, so a real generic-api-key value containing an allowlisted substring would be suppressed repository-wide. Exact fingerprint ignores in .gitleaksignore scope each exception to one commit, path, rule, and line. Full-history scan verified clean locally. --- .gitleaks.toml | 10 ---------- .gitleaksignore | 7 +++++++ 2 files changed, 7 insertions(+), 10 deletions(-) delete mode 100644 .gitleaks.toml create mode 100644 .gitleaksignore diff --git a/.gitleaks.toml b/.gitleaks.toml deleted file mode 100644 index 73457e4ae..000000000 --- a/.gitleaks.toml +++ /dev/null @@ -1,10 +0,0 @@ -[extend] -useDefault = true - -[allowlist] -description = "Known false positives: documentation headings and test fixtures matched by generic-api-key" -regexes = [ - '''wasm32-compilable''', - '''abcdef0123456789''', - '''fedcba9876543210''', -] diff --git a/.gitleaksignore b/.gitleaksignore new file mode 100644 index 000000000..e3603fca9 --- /dev/null +++ b/.gitleaksignore @@ -0,0 +1,7 @@ +# gitleaks finding-specific ignores (exact fingerprints; commit:path:rule:line). +# These four are confirmed non-credentials: two hex cache-lock test fixtures and +# two documentation lines matched by the generic-api-key rule. +498faca9c73bbb3214ca4995dd34c76d699c8544:crates/khive-pack-git/src/cache.rs:generic-api-key:1405 +498faca9c73bbb3214ca4995dd34c76d699c8544:crates/khive-pack-git/src/cache.rs:generic-api-key:1406 +4ce001460f67750796f533b1269c74c90c67eb5c:docs/adr/ADR-101-kg-changeset-model.md:generic-api-key:135 +39fb7052c29916e50f20083f5f6281861bb7ebd9:docs/adr/ADR-101-kg-changeset-model.md:generic-api-key:155