From 411e8ee50002359380a6170a01e4bb7a41114698 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 9 Sep 2026 01:26:05 +0000 Subject: [PATCH 1/2] build(deps): bump oxsecurity/megalinter in the github-actions group Bumps the github-actions group with 1 update: [oxsecurity/megalinter](https://github.com/oxsecurity/megalinter). Updates `oxsecurity/megalinter` from 10.0.0 to 10.1.0 - [Release notes](https://github.com/oxsecurity/megalinter/releases) - [Changelog](https://github.com/oxsecurity/megalinter/blob/main/CHANGELOG.md) - [Commits](https://github.com/oxsecurity/megalinter/compare/15e5b45552097e318c93de385779ce3b1084052c...9949bad031045f366be2467e00e8371a7328a2e2) --- updated-dependencies: - dependency-name: oxsecurity/megalinter dependency-version: 10.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] --- .github/workflows/megalinter.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/megalinter.yml b/.github/workflows/megalinter.yml index ea017e0a..31306023 100644 --- a/.github/workflows/megalinter.yml +++ b/.github/workflows/megalinter.yml @@ -29,7 +29,7 @@ jobs: - name: MegaLinter id: ml - uses: oxsecurity/megalinter@15e5b45552097e318c93de385779ce3b1084052c # v10.0.0 + uses: oxsecurity/megalinter@9949bad031045f366be2467e00e8371a7328a2e2 # v10.1.0 env: VALIDATE_ALL_CODEBASE: true GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} From 90b5a757d14b5462f76325ac37566a3f7bcc6d99 Mon Sep 17 00:00:00 2001 From: Eli Bosley Date: Tue, 15 Sep 2026 14:54:11 -0400 Subject: [PATCH 2/2] ci(megalinter): mark synthetic glrt- tokens for kingfisher MegaLinter 10.1.0 upgrades Kingfisher from v1.112.0 to v2.0.0, which adopts the Betterleaks detector catalog. Its new `betterleaks.gitlab-runner-authentication-token` rule matches every synthetic `glrt-` value in this repo: the placeholder gitlab_validate renders into its tmpfs config.toml, and the fake tokens the shell tests pin. All ten are fabricated and none has ever been a live credential, so the scan is a false positive that fails the MegaLinter job on every PR. Suppress each one with an inline `kingfisher:ignore` directive at the point of use rather than a baseline file, whose fingerprints include byte offsets and so go stale whenever an unrelated edit moves the line. Per-line suppression also keeps a genuinely leaked credential added later in scope, which excluding tests/ from the scan would not. The one multi-entry config.toml fixture joins its redirect onto the token line, matching the sibling fixture above it, because a directive cannot sit inside a line continuation. Verified with kingfisher 2.0.0 (the version MegaLinter 10.1.0 pins): 0 findings, down from 7 reported plus 3 more that value-level dedup hid. tests/run-linux-checks.sh passes. --- .mega-linter.yml | 8 ++++++++ .../ci-runner-farm/include/providers/gitlab.sh | 2 +- tests/gitlab-policy.sh | 2 +- tests/gitlab-runner-lint.sh | 2 +- tests/log-redaction.sh | 2 +- tests/provider-mocks.sh | 13 ++++++------- 6 files changed, 18 insertions(+), 11 deletions(-) diff --git a/.mega-linter.yml b/.mega-linter.yml index 6613d710..390f156e 100644 --- a/.mega-linter.yml +++ b/.mega-linter.yml @@ -58,6 +58,14 @@ DISABLE_LINTERS: # release-please-managed output, not hand-authored content. FILTER_REGEX_EXCLUDE: (^LICENSE$|^CHANGELOG\.md$|\.git/|megalinter-reports/) +# Kingfisher's GitLab runner-token rule matches this repo's synthetic `glrt-` +# values: the placeholder gitlab_validate renders into its tmpfs config.toml and +# the fake tokens the shell tests pin. Each one carries an inline +# `kingfisher:ignore` directive at the point of use rather than a baseline file, +# whose fingerprints include byte offsets and so go stale whenever an unrelated +# edit moves the line. Suppressing per line also keeps a genuinely leaked +# credential added later in scope. + # .jsonc is used inconsistently across editors (e.g. VS Code config commonly # uses .json with comments rather than .jsonc), so allow comments/trailing # commas for all JSON rather than relying on file extension. diff --git a/src/usr/local/emhttp/plugins/ci-runner-farm/include/providers/gitlab.sh b/src/usr/local/emhttp/plugins/ci-runner-farm/include/providers/gitlab.sh index a441a1e1..242f1856 100644 --- a/src/usr/local/emhttp/plugins/ci-runner-farm/include/providers/gitlab.sh +++ b/src/usr/local/emhttp/plugins/ci-runner-farm/include/providers/gitlab.sh @@ -1710,7 +1710,7 @@ gitlab_validate() { # helper to tmpfs. Validate must never write its dummy token/system ID to the # persistent flash configuration tree, even if the process is interrupted. local CFGDIR="$validation_cfgroot" - local GITLAB_RUNNER_TOKEN="glrt-validationtoken000000000000" + local GITLAB_RUNNER_TOKEN="glrt-validationtoken000000000000" # kingfisher:ignore synthetic token, not a credential gitlab_write_config "$idx" "$name" \ || { err "validate: could not render GitLab config.toml"; rm -rf -- "$validation_cfgroot"; return 1; } gitlab_write_docker_auth "$name" \ diff --git a/tests/gitlab-policy.sh b/tests/gitlab-policy.sh index 1f448ef9..af2fbcba 100755 --- a/tests/gitlab-policy.sh +++ b/tests/gitlab-policy.sh @@ -17,7 +17,7 @@ fail() { printf 'GITLAB POLICY FAIL: %s\n' "$*" >&2; exit 1; } CI_PROVIDER=gitlab GITLAB_URL='https://gitlab.example.test' -GITLAB_RUNNER_TOKEN='glrt-policytest000000000000000' +GITLAB_RUNNER_TOKEN='glrt-policytest000000000000000' # kingfisher:ignore synthetic token, not a credential GITLAB_RUNNER_IMAGE='gitlab/gitlab-runner:alpine' CACHE_ROOT="$tmp/cache" CACHE_MOUNTS='' diff --git a/tests/gitlab-runner-lint.sh b/tests/gitlab-runner-lint.sh index 845824f9..445fcd9b 100644 --- a/tests/gitlab-runner-lint.sh +++ b/tests/gitlab-runner-lint.sh @@ -19,7 +19,7 @@ CI_PROVIDER=gitlab GITLAB_URL=https://gitlab.example.test # Synthetic GitLab 18 routable-token shape: URL-safe payload plus the two # version/length/CRC separators that originally exposed a stale local parser. -GITLAB_RUNNER_TOKEN=glrt-AAECAwQFBgcICQoLDA0OD286MQpwOjIKdTozCnQ6Mw8.01.170z6aiyq +GITLAB_RUNNER_TOKEN=glrt-AAECAwQFBgcICQoLDA0OD286MQpwOjIKdTozCnQ6Mw8.01.170z6aiyq # kingfisher:ignore synthetic token, not a credential GITLAB_RUNNER_IMAGE="$(sed -n 's/^GITLAB_RUNNER_IMAGE="\([^"]*\)".*/\1/p' src/usr/local/emhttp/plugins/ci-runner-farm/default.cfg | head -1)" [ -n "$GITLAB_RUNNER_IMAGE" ] \ || { echo "gitlab-runner-lint: could not read GITLAB_RUNNER_IMAGE from default.cfg" >&2; exit 1; } diff --git a/tests/log-redaction.sh b/tests/log-redaction.sh index a6d9f51d..4a81d980 100644 --- a/tests/log-redaction.sh +++ b/tests/log-redaction.sh @@ -19,7 +19,7 @@ redact_access='loaded-access-secret-1234' redact_runner='loaded-glrt-runner-secret-1234' redact_api='loaded-api-secret-5678' redact_registry='reg[]/.*&\punct$token-9012' -routable='glrt-AAECAwQFBgcICQoLDA0OD286MQpwOjIKdTozCnQ6Mw8.01.170z6aiyq' +routable='glrt-AAECAwQFBgcICQoLDA0OD286MQpwOjIKdTozCnQ6Mw8.01.170z6aiyq' # kingfisher:ignore synthetic token, not a credential payload="${routable#glrt-}" fixture="$tmp/fixture.log" diff --git a/tests/provider-mocks.sh b/tests/provider-mocks.sh index 92c835e0..1ad4167e 100644 --- a/tests/provider-mocks.sh +++ b/tests/provider-mocks.sh @@ -169,7 +169,7 @@ CI_PROVIDER=gitlab # encoded-length, and CRC fields separated by two literal dots. Keep one fully # synthetic but structurally realistic value throughout config/probe/retirement # coverage so every credential parser proves that the complete token survives. -ROUTABLE_GITLAB_RUNNER_TOKEN='glrt-AAECAwQFBgcICQoLDA0OD286MQpwOjIKdTozCnQ6Mw8.01.170z6aiyq' +ROUTABLE_GITLAB_RUNNER_TOKEN='glrt-AAECAwQFBgcICQoLDA0OD286MQpwOjIKdTozCnQ6Mw8.01.170z6aiyq' # kingfisher:ignore synthetic token, not a credential ROUTABLE_GITLAB_RUNNER_PAYLOAD="${ROUTABLE_GITLAB_RUNNER_TOKEN#glrt-}" GITLAB_RUNNER_TOKEN="$ROUTABLE_GITLAB_RUNNER_TOKEN" provider_token_ready || fail "routable exact-prefix glrt- token rejected" @@ -732,7 +732,7 @@ printf '%s' "$security_warning" | grep -qF 'job, helper, and service containers' printf '%s' "$security_warning" | grep -qF 'not a security boundary against the Unraid host' \ || fail "GitLab DinD warning implies privileged DinD is a host boundary" gitlab_gen_before="$(crf_confgen)" -GITLAB_RUNNER_TOKEN='glrt-memory-snapshot-changed-1234567890' +GITLAB_RUNNER_TOKEN='glrt-memory-snapshot-changed-1234567890' # kingfisher:ignore synthetic token, not a credential [ "$(crf_confgen)" != "$gitlab_gen_before" ] || fail "GitLab confgen ignores the in-memory runner token" GITLAB_RUNNER_TOKEN="$ROUTABLE_GITLAB_RUNNER_TOKEN" gitlab_gen_before="$(crf_confgen)"; REGISTRY_TOKEN='registry-memory-snapshot-changed' @@ -923,7 +923,7 @@ CFGDIR="$tmp/orphan-cfg" orphan_dir="$CFGDIR/gitlab-runners/ci-runner-7" mkdir -p "$orphan_dir/docker" "$orphan_dir/certs" printf '%s\n' '[[runners]]' ' name = "host-ci-runner-7"' \ - ' token = "glrt-orphan-manager-token-123456"' > "$orphan_dir/config.toml" + ' token = "glrt-orphan-manager-token-123456"' > "$orphan_dir/config.toml" # kingfisher:ignore synthetic token, not a credential printf '%s\n' s_c2d22f638c25 > "$orphan_dir/.runner_system_id" printf '%s\n' registry-auth > "$orphan_dir/docker/config.json" printf '%s\n' saved-ca > "$orphan_dir/certs/gitlab-ca.crt" @@ -969,7 +969,7 @@ if grep -qF 'github_pat_clear_transaction_secret' "$tmp/clear-github.json"; then fi CI_PROVIDER=gitlab -GITLAB_RUNNER_TOKEN='glrt-clear-transaction-secret-1234567890' +GITLAB_RUNNER_TOKEN='glrt-clear-transaction-secret-1234567890' # kingfisher:ignore synthetic token, not a credential printf '%s' "$GITLAB_RUNNER_TOKEN" > "$GITLAB_RUNNER_TOKEN_FILE" printf '%s' token-bearing-toml > "$CRF_CFGDIR/gitlab-runners/ci-runner-1/config.toml" printf '%s' interrupted-toml > "$CRF_CFGDIR/gitlab-runners/ci-runner-1/config.toml.tmp" @@ -1008,7 +1008,7 @@ grep -q '"slot_configs_removed":true' "$tmp/clear-gitlab-confirmed.json" \ grep -qx s_c2d22f638c25 "$CRF_CFGDIR/gitlab-runners/ci-runner-1/.runner_system_id" \ || fail "GitLab clear removed or changed the persistent manager system ID" [ -z "$GITLAB_RUNNER_TOKEN" ] || fail "GitLab clear retained the in-memory runner token" -if grep -qF 'glrt-clear-transaction-secret' "$tmp/clear-gitlab-confirmed.json"; then +if grep -qF 'glrt-clear-transaction-secret' "$tmp/clear-gitlab-confirmed.json"; then # kingfisher:ignore synthetic token, not a credential fail "GitLab runner token leaked into clear response" fi @@ -1391,8 +1391,7 @@ mv "$CRF_CFGDIR/gitlab-runners/ci-runner-1/config.toml.swap" "$CRF_CFGDIR/gitlab cp "$CRF_CFGDIR/gitlab-runners/ci-runner-1/config.toml" \ "$CRF_CFGDIR/gitlab-runners/ci-runner-1/config.toml.one" printf '%s\n' '[[runners]]' ' name = "unexpected-second-manager"' \ - ' token = "glrt-zyxwvutsrqponmlkjihgfedcba123456"' \ - >> "$CRF_CFGDIR/gitlab-runners/ci-runner-1/config.toml" + ' token = "glrt-zyxwvutsrqponmlkjihgfedcba123456"' >> "$CRF_CFGDIR/gitlab-runners/ci-runner-1/config.toml" # kingfisher:ignore synthetic token, not a credential : > "$LIFECYCLE_LOG" if gitlab_unregister_manager ci-runner-1; then fail "multi-entry config reached unregister"; fi if grep -q unregister "$LIFECYCLE_LOG"; then fail "multi-entry config invoked GitLab unregister command"; fi