jared
371ed8116f
- All Python jobs now install python3-pip via apt first (runner image has no pip by default) - Added secret-scan job: gitleaks v8.21.2 scans full git history on every push/PR with --redact to avoid leaking found secrets in logs - Added .gitleaks.toml allowlisting deploy/hooks-lxc*.json files (webhook HMAC secrets are intentional config, not leaks) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
7 lines
159 B
TOML
7 lines
159 B
TOML
[extend]
|
|
useDefault = true
|
|
|
|
[[allowlists]]
|
|
description = "Webhook HMAC secrets in hook config files are intentional"
|
|
paths = ['''deploy/hooks-lxc\d+\.json''']
|