chore(gitleaks): 放行 vault 单测占位凭据的历史误报 - #18
Merged
Merged
Conversation
fetch-depth: 0 令 gitleaks 在扫描任意分支时都会拉到全仓库历史提交 （含其它分支专属的 commit），feat/state-inspect-delete 上的占位凭据 vault-secret-C0FFEE-99（非真实密钥，用于验证 state.write/state.delete/ redaction 生命周期）因而会在其它 PR 的 gitleaks 检查里被重复命中。 按 fingerprint 放行，覆盖所有以 main 为基础拉取历史的 CI 运行。 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
…ult-fixture # Conflicts: # .gitleaksignore
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
问题
CI 的 gitleaks 任务用
fetch-depth: 0拉全仓库历史（"全历史"扫描是既有设计意图），但副作用是：扫描任意分支时都会连带拉到其它分支专属的历史 commit。
feat/state-inspect-delete（#17）新增的内核单测里有一个占位凭据vault-secret-C0FFEE-99（crates/scootlens-kernel/tests/dispatch_p3.rs，用于验证
state.write/state.delete/redaction 生命周期，非真实密钥），命中 gitleaks 的
generic-api-key规则。该分支自身已经用.gitleaksignore放行，但由于 fetch-depth:0 的连带效应，其它 PR（如 #15）在这之后重新触发 CI 时也会扫到同一个 commit 并失败——即使
那些 PR 自己的分支上从未出现过这个字符串。
修复
在
main上也加同一条.gitleaksignore（按 commit+file+rule+line 的fingerprint 精确匹配，不放宽其它扫描覆盖）。任何以 main 为基础重新拉取
历史的 CI 运行都能读到这条放行记录，避免被这个已核实无害的历史 commit
连累。
Co-authored-by: Copilot App 223556219+Copilot@users.noreply.github.com