build(deps): bump oxsecurity/megalinter from 10.0.0 to 10.1.0 in the github-actions group

.github/workflows/megalinter.yml

@@ -29,7 +29,7 @@ jobs:
 
       - name: MegaLinter
         id: ml
-        uses: oxsecurity/megalinter@15e5b45552097e318c93de385779ce3b1084052c # v10.0.0
+        uses: oxsecurity/megalinter@9949bad031045f366be2467e00e8371a7328a2e2 # v10.1.0
         env:
           VALIDATE_ALL_CODEBASE: true
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.mega-linter.yml

@@ -58,6 +58,14 @@ DISABLE_LINTERS:
 # release-please-managed output, not hand-authored content.
 FILTER_REGEX_EXCLUDE: (^LICENSE$|^CHANGELOG\.md$|\.git/|megalinter-reports/)
 
+# Kingfisher's GitLab runner-token rule matches this repo's synthetic `glrt-`
+# values: the placeholder gitlab_validate renders into its tmpfs config.toml and
+# the fake tokens the shell tests pin. Each one carries an inline
+# `kingfisher:ignore` directive at the point of use rather than a baseline file,
+# whose fingerprints include byte offsets and so go stale whenever an unrelated
+# edit moves the line. Suppressing per line also keeps a genuinely leaked
+# credential added later in scope.
+
 # .jsonc is used inconsistently across editors (e.g. VS Code config commonly
 # uses .json with comments rather than .jsonc), so allow comments/trailing
 # commas for all JSON rather than relying on file extension.

src/usr/local/emhttp/plugins/ci-runner-farm/include/providers/gitlab.sh

@@ -1710,7 +1710,7 @@ gitlab_validate() {
   # helper to tmpfs. Validate must never write its dummy token/system ID to the
   # persistent flash configuration tree, even if the process is interrupted.
   local CFGDIR="$validation_cfgroot"
-  local GITLAB_RUNNER_TOKEN="glrt-validationtoken000000000000"
+  local GITLAB_RUNNER_TOKEN="glrt-validationtoken000000000000" # kingfisher:ignore synthetic token, not a credential
   gitlab_write_config "$idx" "$name" \
     || { err "validate: could not render GitLab config.toml"; rm -rf -- "$validation_cfgroot"; return 1; }
   gitlab_write_docker_auth "$name" \

tests/gitlab-policy.sh

@@ -17,7 +17,7 @@ fail() { printf 'GITLAB POLICY FAIL: %s\n' "$*" >&2; exit 1; }
 
 CI_PROVIDER=gitlab
 GITLAB_URL='https://gitlab.example.test'
-GITLAB_RUNNER_TOKEN='glrt-policytest000000000000000'
+GITLAB_RUNNER_TOKEN='glrt-policytest000000000000000' # kingfisher:ignore synthetic token, not a credential
 GITLAB_RUNNER_IMAGE='gitlab/gitlab-runner:alpine'
 CACHE_ROOT="$tmp/cache"
 CACHE_MOUNTS=''

tests/gitlab-runner-lint.sh

@@ -19,7 +19,7 @@ CI_PROVIDER=gitlab
 GITLAB_URL=https://gitlab.example.test
 # Synthetic GitLab 18 routable-token shape: URL-safe payload plus the two
 # version/length/CRC separators that originally exposed a stale local parser.
-GITLAB_RUNNER_TOKEN=glrt-AAECAwQFBgcICQoLDA0OD286MQpwOjIKdTozCnQ6Mw8.01.170z6aiyq
+GITLAB_RUNNER_TOKEN=glrt-AAECAwQFBgcICQoLDA0OD286MQpwOjIKdTozCnQ6Mw8.01.170z6aiyq # kingfisher:ignore synthetic token, not a credential
 GITLAB_RUNNER_IMAGE="$(sed -n 's/^GITLAB_RUNNER_IMAGE="\([^"]*\)".*/\1/p' src/usr/local/emhttp/plugins/ci-runner-farm/default.cfg | head -1)"
 [ -n "$GITLAB_RUNNER_IMAGE" ] \
   || { echo "gitlab-runner-lint: could not read GITLAB_RUNNER_IMAGE from default.cfg" >&2; exit 1; }

tests/log-redaction.sh

@@ -19,7 +19,7 @@ redact_access='loaded-access-secret-1234'
 redact_runner='loaded-glrt-runner-secret-1234'
 redact_api='loaded-api-secret-5678'
 redact_registry='reg[]/.*&\punct$token-9012'
-routable='glrt-AAECAwQFBgcICQoLDA0OD286MQpwOjIKdTozCnQ6Mw8.01.170z6aiyq'
+routable='glrt-AAECAwQFBgcICQoLDA0OD286MQpwOjIKdTozCnQ6Mw8.01.170z6aiyq' # kingfisher:ignore synthetic token, not a credential
 payload="${routable#glrt-}"
 
 fixture="$tmp/fixture.log"

tests/provider-mocks.sh

@@ -169,7 +169,7 @@ CI_PROVIDER=gitlab
 # encoded-length, and CRC fields separated by two literal dots. Keep one fully
 # synthetic but structurally realistic value throughout config/probe/retirement
 # coverage so every credential parser proves that the complete token survives.
-ROUTABLE_GITLAB_RUNNER_TOKEN='glrt-AAECAwQFBgcICQoLDA0OD286MQpwOjIKdTozCnQ6Mw8.01.170z6aiyq'
+ROUTABLE_GITLAB_RUNNER_TOKEN='glrt-AAECAwQFBgcICQoLDA0OD286MQpwOjIKdTozCnQ6Mw8.01.170z6aiyq' # kingfisher:ignore synthetic token, not a credential
 ROUTABLE_GITLAB_RUNNER_PAYLOAD="${ROUTABLE_GITLAB_RUNNER_TOKEN#glrt-}"
 GITLAB_RUNNER_TOKEN="$ROUTABLE_GITLAB_RUNNER_TOKEN"
 provider_token_ready || fail "routable exact-prefix glrt- token rejected"
@@ -732,7 +732,7 @@ printf '%s' "$security_warning" | grep -qF 'job, helper, and service containers'
 printf '%s' "$security_warning" | grep -qF 'not a security boundary against the Unraid host' \
   || fail "GitLab DinD warning implies privileged DinD is a host boundary"
 gitlab_gen_before="$(crf_confgen)"
-GITLAB_RUNNER_TOKEN='glrt-memory-snapshot-changed-1234567890'
+GITLAB_RUNNER_TOKEN='glrt-memory-snapshot-changed-1234567890' # kingfisher:ignore synthetic token, not a credential
 [ "$(crf_confgen)" != "$gitlab_gen_before" ] || fail "GitLab confgen ignores the in-memory runner token"
 GITLAB_RUNNER_TOKEN="$ROUTABLE_GITLAB_RUNNER_TOKEN"
 gitlab_gen_before="$(crf_confgen)"; REGISTRY_TOKEN='registry-memory-snapshot-changed'
@@ -923,7 +923,7 @@ CFGDIR="$tmp/orphan-cfg"
 orphan_dir="$CFGDIR/gitlab-runners/ci-runner-7"
 mkdir -p "$orphan_dir/docker" "$orphan_dir/certs"
 printf '%s\n' '[[runners]]' '  name = "host-ci-runner-7"' \
-  '  token = "glrt-orphan-manager-token-123456"' > "$orphan_dir/config.toml"
+  '  token = "glrt-orphan-manager-token-123456"' > "$orphan_dir/config.toml" # kingfisher:ignore synthetic token, not a credential
 printf '%s\n' s_c2d22f638c25 > "$orphan_dir/.runner_system_id"
 printf '%s\n' registry-auth > "$orphan_dir/docker/config.json"
 printf '%s\n' saved-ca > "$orphan_dir/certs/gitlab-ca.crt"
@@ -969,7 +969,7 @@ if grep -qF 'github_pat_clear_transaction_secret' "$tmp/clear-github.json"; then
 fi
 
 CI_PROVIDER=gitlab
-GITLAB_RUNNER_TOKEN='glrt-clear-transaction-secret-1234567890'
+GITLAB_RUNNER_TOKEN='glrt-clear-transaction-secret-1234567890' # kingfisher:ignore synthetic token, not a credential
 printf '%s' "$GITLAB_RUNNER_TOKEN" > "$GITLAB_RUNNER_TOKEN_FILE"
 printf '%s' token-bearing-toml > "$CRF_CFGDIR/gitlab-runners/ci-runner-1/config.toml"
 printf '%s' interrupted-toml > "$CRF_CFGDIR/gitlab-runners/ci-runner-1/config.toml.tmp"
@@ -1008,7 +1008,7 @@ grep -q '"slot_configs_removed":true' "$tmp/clear-gitlab-confirmed.json" \
 grep -qx s_c2d22f638c25 "$CRF_CFGDIR/gitlab-runners/ci-runner-1/.runner_system_id" \
   || fail "GitLab clear removed or changed the persistent manager system ID"
 [ -z "$GITLAB_RUNNER_TOKEN" ] || fail "GitLab clear retained the in-memory runner token"
-if grep -qF 'glrt-clear-transaction-secret' "$tmp/clear-gitlab-confirmed.json"; then
+if grep -qF 'glrt-clear-transaction-secret' "$tmp/clear-gitlab-confirmed.json"; then # kingfisher:ignore synthetic token, not a credential
   fail "GitLab runner token leaked into clear response"
 fi
 
@@ -1391,8 +1391,7 @@ mv "$CRF_CFGDIR/gitlab-runners/ci-runner-1/config.toml.swap" "$CRF_CFGDIR/gitlab
 cp "$CRF_CFGDIR/gitlab-runners/ci-runner-1/config.toml" \
   "$CRF_CFGDIR/gitlab-runners/ci-runner-1/config.toml.one"
 printf '%s\n' '[[runners]]' '  name = "unexpected-second-manager"' \
-  '  token = "glrt-zyxwvutsrqponmlkjihgfedcba123456"' \
-  >> "$CRF_CFGDIR/gitlab-runners/ci-runner-1/config.toml"
+  '  token = "glrt-zyxwvutsrqponmlkjihgfedcba123456"' >> "$CRF_CFGDIR/gitlab-runners/ci-runner-1/config.toml" # kingfisher:ignore synthetic token, not a credential
 : > "$LIFECYCLE_LOG"
 if gitlab_unregister_manager ci-runner-1; then fail "multi-entry config reached unregister"; fi
 if grep -q unregister "$LIFECYCLE_LOG"; then fail "multi-entry config invoked GitLab unregister command"; fi