From 76a03a4051af5bcd66d9eb6ece13fe2e5295763f Mon Sep 17 00:00:00 2001 From: John Osumi <931193+sumitake@users.noreply.github.com> Date: Mon, 27 Jul 2026 23:32:23 -0700 Subject: [PATCH] ci: allowlist the synthetic fixture token by content, not commit SHA The weekly full-history secret scan has been failing since the 4.2.0 clean-slate history rewrite. `.gitleaksignore` fingerprints are bound to a commit SHA (`:::`), and the rewrite re-parented every tracked file into a single squash commit, so all three entries still named the pre-rewrite SHA `eec4c7a7` -- a commit that no longer exists in this repository. The exemption was dead and gitleaks reported 3 leaks. The failure was invisible on push and pull_request because gitleaks-action scans only the commits in the event range there; it surfaced only on the weekly schedule, which scans full history and re-reads the squash commit. Replace the SHA-bound fingerprints with a `.gitleaks.toml` allowlist scoped by path AND line content, so the exemption survives any future rebase, squash, or history rewrite. Scoping with condition = "AND" keeps coverage: only this one literal synthetic value in this one fixture is exempt. Co-Authored-By: Claude Opus 5 --- .gitleaks.toml | 45 +++++++++++++++++++++++++++++++++++++++++++++ .gitleaksignore | 4 ---- 2 files changed, 45 insertions(+), 4 deletions(-) create mode 100644 .gitleaks.toml delete mode 100644 .gitleaksignore diff --git a/.gitleaks.toml b/.gitleaks.toml new file mode 100644 index 0000000..d2764af --- /dev/null +++ b/.gitleaks.toml @@ -0,0 +1,45 @@ +# Gitleaks configuration for agent-collab. +# +# Why this file exists rather than `.gitleaksignore`: +# +# `.gitleaksignore` entries are fingerprints of the form +# `:::`, so every entry is bound to a specific commit +# SHA. The 4.2.0 clean-slate history rewrite re-parented every tracked file into +# a single squash commit, which silently invalidated the fingerprints covering +# the synthetic protocol fixture below -- they still named the pre-rewrite SHA +# `eec4c7a7`, a commit that no longer exists in this repository. +# +# The dead exemption was invisible on `push` and `pull_request`, because +# gitleaks-action scans only the commits in the event range there. It surfaced +# only on the weekly `schedule` run, which scans full history and therefore +# re-reads the squash commit. +# +# Allowlisting by content instead of by SHA keeps the exemption correct across +# any future rebase, squash, or history rewrite. + +[extend] +useDefault = true + +# Top-level allowlist is the singular `[allowlist]` table. The plural +# `[[allowlists]]` form with `condition` is parsed only inside `[[rules]]` +# (gitleaks 8.24 config/config.go); at top level it is silently ignored, which +# is a quiet way to disable your own exemption. +# +# `paths` is deliberately NOT used here: top-level `paths` and `regexes` are +# OR'd (no `condition` at this level), so adding a path entry would exempt the +# whole fixture file. Matching `regexTarget = "line"` against a regex that pins +# both the key and the literal value keeps the exemption to exactly one line +# shape -- any other secret added to that fixture is still reported. +[allowlist] +description = """ +Synthetic dispatcher lane token in the cross-repository protocol fixture. + +The value is deterministically derived from fixed all-'a'/all-'b' digests by +runtime_client._dispatcher_lane_token, and is pinned byte-for-byte by +tests/test_agent_collab_runtime_client.py:: +test_dispatcher_protocol_matches_the_cross_repository_fixture, which holds the +wire protocol in parity with the workspace-side counterpart. It is not a +credential and grants access to nothing. +""" +regexTarget = "line" +regexes = ['''"lane_token": "3b73a0ffbe3426ef5761f5c09b756ef6"'''] diff --git a/.gitleaksignore b/.gitleaksignore deleted file mode 100644 index 66954cb..0000000 --- a/.gitleaksignore +++ /dev/null @@ -1,4 +0,0 @@ -# Deterministic, nonsecret lane-token derivation in the cross-repository protocol fixture. -eec4c7a7d9940b9122fa255694ec8cb6a754388b:tests/fixtures/provider_dispatcher_protocol_v1.json:generic-api-key:9 -eec4c7a7d9940b9122fa255694ec8cb6a754388b:tests/fixtures/provider_dispatcher_protocol_v1.json:generic-api-key:23 -eec4c7a7d9940b9122fa255694ec8cb6a754388b:tests/fixtures/provider_dispatcher_protocol_v1.json:generic-api-key:36