LearningCircuit 0fa151a4eb fix: resolve gitleaks false positives with explicit config and baseline ...

The gitleaks action was still flagging placeholder API key examples
despite having them in the allowlist. This fix addresses the root causes:

1. Add explicit GITLEAKS_CONFIG environment variable to workflow to
   ensure the config file is loaded by gitleaks-action v2

2. Add GITLEAKS_BASELINE_PATH to use the baseline ignore file

3. Add secretGroup = 2 to the generic-secret rule to extract just the
   secret value (not the full match including KEY=), allowing the
   existing allowlist regexes like 'your-.*-key-here' to work properly

4. Create .gitleaksignore baseline file with specific fingerprints for
   known false positives in historical commits

5. Update .gitignore to track .gitleaksignore file

6. Add .gitleaksignore to file-whitelist-check scripts in both
   .github/scripts/ and .pre-commit-hooks/

2026-01-25 12:24:23 +01:00

..

check-file-writes.sh

fix: resolve CI check failures in GitHub Actions workflows (#1197)

2025-12-01 08:21:36 -05:00

file-whitelist-check.sh

fix: resolve gitleaks false positives with explicit config and baseline

2026-01-25 12:24:23 +01:00

validate-docker-compose-images.sh

feat: add CI validation for Docker image SHA digest pinning

2025-12-03 12:35:09 +01:00

validate-workflow-images.py

feat: add CI validation for Docker image SHA digest pinning

2025-12-03 12:35:09 +01:00