Lotus CIandClaude Opus 5.5
ec47d542dd
CI / Build & Quality Checks (pull_request) Successful in 2m9s
CI / Trigger Desktop Build (pull_request) Skipped
CI / Docker image build & smoke test (pull_request) Skipped
CI / Secret scan (gitleaks) (pull_request) Successful in 7s
CI / Playwright smoke (e2e) (pull_request) Successful in 12m38s
utils/updateErrors.ts embeds the public key that verifies Linux downloads (cinny-desktop #36); gitleaks' generic-api-key rule matched it. It is a published public key, not a secret. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5
40 lines
1.5 KiB
TOML
40 lines
1.5 KiB
TOML
title = "gitleaks config for Lotus Chat (cinny fork)"
|
|
|
|
# Gitea #95 — secret scanning was entirely absent. Extend gitleaks' built-in
|
|
# ruleset (don't replace it) and allowlist the known-public infrastructure
|
|
# URLs that show up in tracked config, which are hostnames, not secrets.
|
|
[extend]
|
|
useDefault = true
|
|
|
|
[allowlist]
|
|
description = "Known-public Lotus/Matrix homeserver + npm registry URLs — not secrets"
|
|
regexes = [
|
|
'''https?://matrix\.lotusguild\.org''',
|
|
'''https?://code\.lotusguild\.org/api/packages/LotusGuild/npm/''',
|
|
'''matrix\.lotusguild\.org''',
|
|
# Lotus Chat desktop updater's minisign PUBLIC key (published in the
|
|
# cinny-desktop README); utils/updateErrors.ts verifies Linux downloads with it.
|
|
'''RWRZZdyii05/NUcz337A5SAbiZK\+NPVDWuiL2mM5Jk1p/LfRmNfiZ/6l''',
|
|
]
|
|
paths = [
|
|
'''config\.json''',
|
|
'''\.npmrc''',
|
|
# Build output and vendored bundles are not source — CI scans a fresh
|
|
# checkout, but a local run after `npm run build` would trip on minified
|
|
# matrix-js-sdk crypto identifiers (claimedEd25519Key etc.).
|
|
'''^dist/''',
|
|
'''^node_modules/''',
|
|
'''^public/element-call/''',
|
|
]
|
|
|
|
# localStorage / IndexedDB key NAMES (e.g. `STORAGE_KEY = 'cinny_recent_gifs_v1'`)
|
|
# match generic-api-key purely because the variable is called *_KEY. They are
|
|
# namespaced identifiers, not credentials.
|
|
[[rules]]
|
|
id = "generic-api-key"
|
|
[rules.allowlist]
|
|
regexTarget = "line"
|
|
regexes = [
|
|
'''(STORAGE|CACHE|IDB|DB|LS)_KEY\s*=\s*['"](cinny|lotus)[-_][a-z0-9_-]+['"]''',
|
|
]
|