Fix all CI jobs: ruff binary, pip-audit venv, gitleaks baseline

- ruff: download standalone binary instead of using python3 -m ruff (runner image lacks the PATH entry for pip-installed bin scripts) - pip-audit: add python3-venv to apt install (pip-audit creates a venv internally to resolve deps; ensurepip was missing) - gitleaks: switch from stopwords allowlist to --baseline-path approach. Stopwords don't suppress findings from git history scans. The baseline records the 4 known-intentional webhook HMAC secrets; CI now only fails on findings NOT in the baseline (i.e. newly introduced secrets) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-20 16:36:59 -04:00
parent 371ed8116f
commit 78d1645f08
3 changed files with 100 additions and 10 deletions
@@ -2,5 +2,10 @@
 useDefault = true

 [[allowlists]]
-description = "Webhook HMAC secrets in hook config files are intentional"
-paths = ['''deploy/hooks-lxc\d+\.json''']
+description = "Gitea webhook HMAC secrets in deploy/hooks-lxc*.json are intentional configuration"
+stopwords = [
+    "76dd5febd1cc3458545ce37537f4bfe26f241a9635b57a2cba183ebc9221230b",
+    "ddea576ef03bff35f0c9d138b626b273d9e9502434e0717899a87677cd5ac267",
+    "0d23fab8743e9ee6b52cbd05a889b04c927ffa2b2b21fe50244f1a534d1a22d0",
+    "38ba0e66763da2096c47645cbf636ce3c2c51232e006b964e57d6bb94a32dcaa",
+]