Wave A of P03. Wires the three security tools into the
.coreci.yml pipeline and exposes them via a
local make target.
- .gitleaks.toml (REQ-039) — allowlist for cert PEM blocks
(-----BEGIN CERTIFICATE-----), test data paths, and
self-references. Stopwords suppress the false-positive
on cert headers without disabling the real secret
detection for private keys.
- .gitleaks-baseline.json (REQ-029) — suppresses the v0.1
historical .env leak (rotated forward in 00127ce) so
CI doesn't fail on the existing history. The baseline
format matches gitleaks 8.x.
- .golangci.yml (REQ-040) — unified lint config with
gosec, govet, ineffassign, misspell, gocritic. gosec
severity=high so G101 (hardcoded credentials) is a
build-breaker. Excludes _test.go for G404 (math/rand
is fine in tests) and internal/security/testdata/.
- .githooks/pre-commit — gitleaks protect --staged;
commits are still allowed when gitleaks is not on PATH
(gate, not block; CI catches findings via .coreci.yml).
- scripts/security_scan.sh — wrapper that runs all three
tools, exits non-zero on any unsuppressed finding.
Detects missing tools and SKIPs in dev mode (--strict
flips to FAIL on skip). Used by ./scripts/security_scan.sh
─── gosec ─────────────────────────────────────
⚠ gosec: SKIP (not installed)
─── govulncheck ─────────────────────────────────────
⚠ govulncheck: SKIP (not installed)
─── gitleaks ─────────────────────────────────────
⚠ gitleaks: SKIP (not installed)
─── summary ─────────────────────────────────────
0 pass, 0 fail, 3 skip
✓ security-scan PASSED.
- docs/security-scanning.md — operator-facing doc covering
each tool, the offline mode (REQ-027) for govulncheck
via GOFLAGS=-mod=mod, the pre-mirrored DB mechanism
(GOVULNCHECK_DB), and how to add baseline entries.
- .coreci.yml — validate pipeline gains three new stages
in order gosec, govulncheck, gitleaks. Test pipeline
runs with -race (REQ-031). Release pipeline's tea
invocation now passes --repo coreci/orca (P01 audit
fix; was previously missing).
- Makefile — adds test-race and security-scan targets;
help text updated.
- scripts/release.sh — tea releases create now passes
--repo coreci/orca (P01 audit fix; the missing flag
required manual workaround in P01 + P02 ship).
All builds clean; tests pass with -race; gofmt -l . clean;
go vet ./... clean.
---ci---
project: orca
phase: 10
milestone: v0.2
status: execute
---/ci---
ciagent