Wave A of P03. Wires the three security tools into the
.coreci.yml pipeline and exposes them via a
local make target.
- .gitleaks.toml (REQ-039) — allowlist for cert PEM blocks
(-----BEGIN CERTIFICATE-----), test data paths, and
self-references. Stopwords suppress the false-positive
on cert headers without disabling the real secret
detection for private keys.
- .gitleaks-baseline.json (REQ-029) — suppresses the v0.1
historical .env leak (rotated forward in 00127ce) so
CI doesn't fail on the existing history. The baseline
format matches gitleaks 8.x.
- .golangci.yml (REQ-040) — unified lint config with
gosec, govet, ineffassign, misspell, gocritic. gosec
severity=high so G101 (hardcoded credentials) is a
build-breaker. Excludes _test.go for G404 (math/rand
is fine in tests) and internal/security/testdata/.
- .githooks/pre-commit — gitleaks protect --staged;
commits are still allowed when gitleaks is not on PATH
(gate, not block; CI catches findings via .coreci.yml).
- scripts/security_scan.sh — wrapper that runs all three
tools, exits non-zero on any unsuppressed finding.
Detects missing tools and SKIPs in dev mode (--strict
flips to FAIL on skip). Used by ./scripts/security_scan.sh
─── gosec ─────────────────────────────────────
⚠ gosec: SKIP (not installed)
─── govulncheck ─────────────────────────────────────
⚠ govulncheck: SKIP (not installed)
─── gitleaks ─────────────────────────────────────
⚠ gitleaks: SKIP (not installed)
─── summary ─────────────────────────────────────
0 pass, 0 fail, 3 skip
✓ security-scan PASSED.
- docs/security-scanning.md — operator-facing doc covering
each tool, the offline mode (REQ-027) for govulncheck
via GOFLAGS=-mod=mod, the pre-mirrored DB mechanism
(GOVULNCHECK_DB), and how to add baseline entries.
- .coreci.yml — validate pipeline gains three new stages
in order gosec, govulncheck, gitleaks. Test pipeline
runs with -race (REQ-031). Release pipeline's tea
invocation now passes --repo coreci/orca (P01 audit
fix; was previously missing).
- Makefile — adds test-race and security-scan targets;
help text updated.
- scripts/release.sh — tea releases create now passes
--repo coreci/orca (P01 audit fix; the missing flag
required manual workaround in P01 + P02 ship).
All builds clean; tests pass with -race; gofmt -l . clean;
go vet ./... clean.
---ci---
project: orca
phase: 10
milestone: v0.2
status: execute
---/ci---
- Fast-forward merge of phase/07-v0.1-backfill into milestone/v0.1-initial
- Annotated tag v0.1.7 created at dc67522
- Gitea release v0.1.7 published with orca-v0.1.7-linux-amd64.tar.gz
- Fix -> typo in release.sh notes block
(unbound variable under set -u; surfaced on first end-to-end run
of release.sh for v0.1.7). Patch is minimal and contained to the
release-notes echo line.
The v0.1 milestone COMPLETE commit (d76ff84) was tagged v0.2.0 and the
per-phase tags v0.1.1..v0.1.6 were created, but the standing rule
'every phase tag produces a Gitea release' was only codified in P06
(RELEASE_POLICY.md) and never applied retroactively.
This commit adds scripts/backfill_releases.sh, an idempotent helper that:
- iterates over v0.1.1..v0.1.6 and v0.2.0
- skips tags that already have a release
- builds the orca binary from the milestone branch HEAD (which includes
the post-COMPLETE entry-point fix and workflow-block commits)
- injects the historical version via -ldflags
- packages a per-tag tarball (orca-<tag>-<os>-<arch>.tar.gz)
- creates a Gitea release with the tarball as an asset, and release
notes that include the phase summary and a v0.2.0 milestone recap
After backfill, the v0.1 milestone is fully released end-to-end and the
discipline carries forward into v0.2.
---ci---
project: orca
phase: 7
milestone: v0.1
status: execute
version: v0.1.7
requirements:
covered: [REQ-007]
partial: []
---/ci---
ciagent
cloudinit-bot