jaredandClaude Opus 5
2f47fa32ee
CI / Build & Quality Checks (push) Successful in 1m39s
CI / Docker image build & smoke test (push) Skipped
CI / Secret scan (gitleaks) (push) Successful in 8s
CI / Trigger Desktop Build (push) Successful in 12s
CI / Playwright smoke (e2e) (push) Successful in 1m59s
- gitleaks flagged `STORAGE_KEY = 'cinny_recent_gifs_v1'` (a localStorage key name) as a generic API key. Allowlist namespaced cinny_/lotus- key names on *_KEY assignment lines, and skip dist/, node_modules/ and the vendored Element Call bundle (minified matrix-js-sdk crypto identifiers trip the same rule locally after a build). Verified: 0 findings on this tree with and without dist/ present. - The runner has no `docker` binary and Gitea ignores job-level continue-on-error for the run conclusion, so the docker job painted the run red. It now runs only when the Actions variable CI_HAS_DOCKER is "true"; the weekly renovate job likewise only when RENOVATE_ENABLED is "true" (set alongside the RENOVATE_TOKEN secret). - The Playwright e2e job passed on the runner, so it's a hard gate now. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA
37 lines
1.2 KiB
TOML
37 lines
1.2 KiB
TOML
title = "gitleaks config for Lotus Chat (cinny fork)"
|
|
|
|
# Gitea #95 — secret scanning was entirely absent. Extend gitleaks' built-in
|
|
# ruleset (don't replace it) and allowlist the known-public infrastructure
|
|
# URLs that show up in tracked config, which are hostnames, not secrets.
|
|
[extend]
|
|
useDefault = true
|
|
|
|
[allowlist]
|
|
description = "Known-public Lotus/Matrix homeserver + npm registry URLs — not secrets"
|
|
regexes = [
|
|
'''https?://matrix\.lotusguild\.org''',
|
|
'''https?://code\.lotusguild\.org/api/packages/LotusGuild/npm/''',
|
|
'''matrix\.lotusguild\.org''',
|
|
]
|
|
paths = [
|
|
'''config\.json''',
|
|
'''\.npmrc''',
|
|
# Build output and vendored bundles are not source — CI scans a fresh
|
|
# checkout, but a local run after `npm run build` would trip on minified
|
|
# matrix-js-sdk crypto identifiers (claimedEd25519Key etc.).
|
|
'''^dist/''',
|
|
'''^node_modules/''',
|
|
'''^public/element-call/''',
|
|
]
|
|
|
|
# localStorage / IndexedDB key NAMES (e.g. `STORAGE_KEY = 'cinny_recent_gifs_v1'`)
|
|
# match generic-api-key purely because the variable is called *_KEY. They are
|
|
# namespaced identifiers, not credentials.
|
|
[[rules]]
|
|
id = "generic-api-key"
|
|
[rules.allowlist]
|
|
regexTarget = "line"
|
|
regexes = [
|
|
'''(STORAGE|CACHE|IDB|DB|LS)_KEY\s*=\s*['"](cinny|lotus)[-_][a-z0-9_-]+['"]''',
|
|
]
|