generated from mathias/template-go-web
mathias
e1169e2c80
CD / Lint / Test / Vet (push) Successful in 10s
infra#344. gitleaks ORs the clauses of a GLOBAL `[[allowlists]]` block and does not honour `condition = "AND"` there, so the `paths` entry suppressed EVERY finding in the named file — not only the false positive the `regexes` line describes. The regex alone is what was meant, and it works regardless of which file the value turns up in (infra#256). Verified rather than assumed, with a control for the probe itself: a live-shaped credential planted in the formerly-exempt file scans clean before this change and fires after it, and the same shape fires in a neutral path both ways (so "not detected" cannot be mistaken for "immune"). The intended false positive is still suppressed — the tree scans clean. Refs: mathias/infra#344, mathias/infra#256, mathias/infra#317
28 lines
1.3 KiB
TOML
28 lines
1.3 KiB
TOML
# gitleaks config for the jepa-fx-risk repo (infra#317).
|
|
#
|
|
# Runs gitleaks' full default ruleset and allowlists one non-credential
|
|
# constant, scoped by BOTH path and pattern (condition = "AND") so a different
|
|
# secret in the same files still fires. Allowlist by shape, not by filename.
|
|
|
|
title = "jepa-fx-risk gitleaks config"
|
|
|
|
[extend]
|
|
useDefault = true
|
|
|
|
# METRIC_KEY is the metrics-pipeline identifier
|
|
# ("VaR_breach_rate_99_oos_regime_cond") that train.py's VaR eval block writes
|
|
# into metrics.json -- documented in var_breach.py's own comment. It trips
|
|
# generic-api-key purely because the variable name ends in _KEY and the value
|
|
# is long and mixed-case enough to pass the entropy heuristic. It is not a
|
|
# credential and has no secret analogue.
|
|
[[allowlists]]
|
|
description = "infra#317 — METRIC_KEY is a metrics identifier, not a credential"
|
|
# infra#344: `paths` removed. gitleaks ORs the clauses of a GLOBAL allowlist and
|
|
# does not honour `condition = "AND"` there, so the path matched on its own and
|
|
# granted the whole file immunity — every finding in it, not just this one.
|
|
# Verified: a live-shaped credential planted in that file scanned clean before
|
|
# this change and fires after it. The regex below is what was meant and works
|
|
# regardless of which file the value appears in (infra#256).
|
|
regexTarget = "line"
|
|
regexes = ['''METRIC_KEY''']
|