fix(P10): verification - 4 layers pass
P03 (Phase 10) security-scan verified across 4 layers per
ciagent-verify workflow.
LAYER 1 — Structural: all P03 must-have files present:
- .gitleaks.toml (REQ-039)
- .gitleaks-baseline.json (REQ-029)
- .golangci.yml (REQ-040)
- scripts/security_scan.sh
- .githooks/pre-commit
- docs/security-scanning.md
- internal/security/testdata/hardcoded_creds.go (fixture)
LAYER 2 — Behavioral: go test -count=1 -race ./... all green
across 8 packages. Coverage:
- security_scan_test: gitleaks config shape, baseline JSON
shape, golangci.yml linter enablement, script shape,
.coreci.yml stages, Makefile targets, pre-commit hook
shape, cert PEM allowlist mentions
- security_gosec_g101_test: G101 fixture presence, gosec
install in CI, govulncheck offline mode env
- All prior security tests from P01 still pass
LAYER 3 — Security:
- gosec: installed in .coreci.yml validate (4 references)
- govulncheck: GOFLAGS=-mod=mod for offline mode (REQ-027)
- gitleaks: detect with config + baseline
- go test -race: wired into the test pipeline (REQ-031)
- scripts/release.sh: --repo coreci/orca flag added
(P01 audit finding closed)
- .golangci.yml: gosec severity=high, G101 is a build-breaker
- Cert PEM blocks allowlisted, not flagged (REQ-039)
- .env historical leak suppressed via baseline (REQ-029)
- Pre-existing .env secret from v0.1 documented in
.ciagent/PHASE7_SECURITY_AUDIT.md for human remediation
LAYER 4 — Quality:
- gofmt -l . clean
- go vet ./... clean
- go.mod unchanged (no new direct or indirect deps)
- Conventional Commits prefix: feat(P10): for both waves
- All ---ci--- blocks parse correctly
- 0 deps added
REQ coverage (P03 plan):
- REQ-014 (gosec+govulncheck in CI): both installed and run
in .coreci.yml ; Makefile target exposed
- REQ-027 (govulncheck offline mode): GOFLAGS=-mod=mod +
GOVULNCHECK_DB mechanism documented
- REQ-029 (gitleaks baseline for pre-existing .env): baseline
file committed; pre-commit hook wired
- REQ-031 (go test -race in CI): wired into .coreci.yml
test pipeline; Makefile target exposed
- REQ-039 (.gitleaks.toml with cert PEM allowlist): cert
blocks allowed, private keys still flagged
- REQ-040 (.golangci.yml unified config): gosec, govet,
ineffassign, misspell, gocritic enabled
---ci---
project: orca
phase: 10
milestone: v0.2
status: verify
requirements:
covered: [REQ-014, REQ-027, REQ-029, REQ-031, REQ-039, REQ-040]
partial: []
---/ci---
This commit is contained in:
ciagent