fix(security): allowlist the #131 test fixture in gitleaks history - #160
Merged
Conversation
The Secret history scan has failed on main since dd8f0a8. Cause: merging #131 with -s ours recorded the branch in history without applying its tree, and gitleaks scans history, not the working tree. The finding is a fixture, not a credential — the literal "sk-secret123456" inside a RuntimeError message, asserting that error text is redacted before it reaches the UI. Its file, tests/ui_session_resume_test.py, does not exist on main, so the finding cannot be fixed by editing it; a fingerprint entry is the only route. Verified: gitleaks over origin/main now reports no leaks across 240 commits. Note for future -s ours merges: they bring the branch's full history under the secret scan. Two branches deliberately left unmerged (#133, #143) carry findings of their own, and #133's is a real key — merging them for attribution alone would have put it in main's history permanently. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The Secret history scan has failed on
mainsincedd8f0a8. The step is named "Install pinned Gitleaks", but its last line is the scan itself:./gitleaks git --redact --no-banner --exit-code 1so an install-shaped failure was actually
leaks found: 1. The download and checksum were fine (gitleaks.tar.gz: OK).Cause
dd8f0a8merged ten stale pull requests with-s oursto record their authors as contributors. That strategy leaves the tree untouched — but it does make each branch's commits ancestors ofmain, and gitleaks scans history, not the working tree.One of them, #131, contains a finding.
The finding
tests/ui_session_resume_test.py:87, from commit6421db9a:A fixture, not a credential: the literal
sk-secret123456exists to assert that error text is redacted before it reaches the UI. Nothing to rotate.The file does not exist on
main— the-s oursmerge never applied its tree — so the finding cannot be fixed by editing it. A fingerprint entry is the only route.Verification
Worth recording for next time
-s oursmerges bring the branch's whole history under the secret scan. Two branches deliberately left unmerged carry findings of their own — and #133's is a real key, not a fixture. Merging those for attribution alone would have put a live credential inmain's history permanently, where only a rewrite could remove it.