PR-10: gitleaks pack + portable pre-commit fallback (scanner) - #39
Merged
Conversation
- integrations/gitleaks/dsgai.toml: gitleaks pack for the DSGAI credential set
(quote-optional named assignments + raw token prefixes: xoxb-, ghp_,
github_pat_, AIza, AKIA, sk-ant-/sk-proj-, JWT) with an allowlist for
tests/fixtures/**, lockfiles, minified JS, snapshots. Recommended as the
primary pre-commit path in pre-commit-hook.md (entropy-aware, cross-platform).
- Fix the bespoke dsgai-secret-scan.sh fallback for portability:
* mapfile -d '' -> bash-3.2-safe 'while IFS= read -r -d '' loop
* grep -zE (BSD grep lacks -z) -> a case-statement extension filter
* quote-optional value pattern (fixes the unquoted-.env false negative)
* new token-prefix branch so xoxb-/ghp_/etc. are caught by any var name
shellcheck clean; no bash-4 builtins (bash-3.2 / BSD safe).
Verified against the fixture with gitleaks 8.30.1 and the script pattern:
- both flag .env (unquoted key) and js-service/index.js (xoxb- token)
- neither flags good_config.py (Vault retrieval)
- a whole-repo gitleaks scan allowlists tests/fixtures/** (0 fixture leaks)
Acceptance met (the CONTRIBUTING.md fake-example match in a repo-wide scan is
expected — it is a real sk-proj- literal; the fixture detection the acceptance
needs precludes globally allowlisting FAKE values).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Completes Phase 2 → v0.3 release-ready. Depends on PR-04.
What's here
integrations/gitleaks/dsgai.toml— a gitleaks rule pack for the DSGAI credential set: quote-optional named assignments (OpenAI/Anthropic/Cohere/Google/HF/AWS/Azure/GCP/vector-store/LangSmith/Langfuse) and raw token prefixes (xoxb-,ghp_,github_pat_,AIza,AKIA,sk-ant-/sk-proj-, JWT). Allowliststests/fixtures/**, lockfiles, minified JS, snapshots.pre-commit-hook.mdnow recommends gitleaks as the primary path (entropy-aware, cross-platform) with pre-commit-framework and plain-hook snippets; the ripgrep script is documented as the zero-dependency fallback.dsgai-secret-scan.shfixed for portability:mapfile -d ''→ a bash-3.2-safewhile IFS= read -r -d ''loopgrep -zE(BSD grep lacks-z) → acaseextension filter.envfalse negative)xoxb-/ghp_/etc. are caught by any variable nameVerification (with gitleaks 8.30.1 + the script pattern)
.env(unquoted key) andjs-service/index.js(xoxb-token).good_config.py(Vault retrieval).tests/fixtures/**→ 0 fixture leaks.shellcheckclean; no bash-4 builtins (bash-3.2 / BSD safe by review).Note
A repo-wide gitleaks scan flags
CONTRIBUTING.md's fakesk-proj-FAKE…example — that's correct (it's a realsk-proj-literal). I did not globally allowlistFAKEvalues because the fixture detection the acceptance requires depends on those values being detected.