Wave B of P03. Adds Go-level tests that verify the security
configuration files have the expected shape. We don't run
gosec/govulncheck/gitleaks here (they're external binaries
installed by .coreci.yml ); instead, the tests
catch configuration drift by asserting the right tokens
are present in the config files.
- internal/security/security_scan_test.go — covers the
shape of .gitleaks.toml (cert PEM allowlist present),
.gitleaks-baseline.json (valid JSON, skip entries with
Commit/File), .golangci.yml (gosec/govet/ineffassign/
misspell enabled), scripts/security_scan.sh
(executable, references all three tools + GOFLAGS), and
.coreci.yml (gosec/govulncheck/gitleaks stages present,
GOFLAGS env, go test -race wired).
- internal/security/security_gosec_g101_test.go — meta-
tests: the .coreci.yml pipeline installs
gosec and runs it; GOFLAGS=-mod=mod is set for offline
mode (REQ-027). The fixture file in testdata/ carries
a literal G101 pattern that any future CI run will flag
if the allowlist is misconfigured.
- internal/security/testdata/hardcoded_creds.go — the
G101 fixture. The value is intentionally a sentinel
prefix (GOSEC_G101_FIXTURE_VALUE_*) that does not match
real-secret patterns; gitleaks allowlist for the path
keeps it from being a false positive on the secret
scanner while still triggering gosec's G101 rule.
All builds clean; tests pass with -race; gofmt -l . clean.
---ci---
project: orca
phase: 10
milestone: v0.2
status: execute
---/ci---
Wave A of P03. Wires the three security tools into the
.coreci.yml pipeline and exposes them via a
local make target.
- .gitleaks.toml (REQ-039) — allowlist for cert PEM blocks
(-----BEGIN CERTIFICATE-----), test data paths, and
self-references. Stopwords suppress the false-positive
on cert headers without disabling the real secret
detection for private keys.
- .gitleaks-baseline.json (REQ-029) — suppresses the v0.1
historical .env leak (rotated forward in 00127ce) so
CI doesn't fail on the existing history. The baseline
format matches gitleaks 8.x.
- .golangci.yml (REQ-040) — unified lint config with
gosec, govet, ineffassign, misspell, gocritic. gosec
severity=high so G101 (hardcoded credentials) is a
build-breaker. Excludes _test.go for G404 (math/rand
is fine in tests) and internal/security/testdata/.
- .githooks/pre-commit — gitleaks protect --staged;
commits are still allowed when gitleaks is not on PATH
(gate, not block; CI catches findings via .coreci.yml).
- scripts/security_scan.sh — wrapper that runs all three
tools, exits non-zero on any unsuppressed finding.
Detects missing tools and SKIPs in dev mode (--strict
flips to FAIL on skip). Used by ./scripts/security_scan.sh
─── gosec ─────────────────────────────────────
⚠ gosec: SKIP (not installed)
─── govulncheck ─────────────────────────────────────
⚠ govulncheck: SKIP (not installed)
─── gitleaks ─────────────────────────────────────
⚠ gitleaks: SKIP (not installed)
─── summary ─────────────────────────────────────
0 pass, 0 fail, 3 skip
✓ security-scan PASSED.
- docs/security-scanning.md — operator-facing doc covering
each tool, the offline mode (REQ-027) for govulncheck
via GOFLAGS=-mod=mod, the pre-mirrored DB mechanism
(GOVULNCHECK_DB), and how to add baseline entries.
- .coreci.yml — validate pipeline gains three new stages
in order gosec, govulncheck, gitleaks. Test pipeline
runs with -race (REQ-031). Release pipeline's tea
invocation now passes --repo coreci/orca (P01 audit
fix; was previously missing).
- Makefile — adds test-race and security-scan targets;
help text updated.
- scripts/release.sh — tea releases create now passes
--repo coreci/orca (P01 audit fix; the missing flag
required manual workaround in P01 + P02 ship).
All builds clean; tests pass with -race; gofmt -l . clean;
go vet ./... clean.
---ci---
project: orca
phase: 10
milestone: v0.2
status: execute
---/ci---
Wave B of P02. Wires the data + engine + transport layers into the
daemon HTTP surface and the CLI.
- internal/engine/executor.go — adds Submit(specBytes) and
Status(jobID) entry points to satisfy engine.LocalExecutor
(used by the dispatcher). Submit parses a minimal JSON wire
spec with name/command/args/env fields; Status reads from
store.JobRepo and returns the stringified model.JobStatus.
- internal/engine/dispatcher.go — Dispatcher struct with
LocalExecutor + capacity repo + peer registry + idempotency
dedupe store. Submit(target, spec, idempotencyKey) does the
local-fit-check then bin-packing pick; if no local capacity
and target is empty, falls through to a peer. dispatchTo /
dispatchToPeer open mTLS clients (no cert presented by the
client in P02; the server uses RequireAndVerifyClientCert
but P02 ships with the cert-pool wiring without enforcing
client certs on the dispatch endpoint — P03 hardening).
LocalSubmit/LocalStatus satisfy transport.Dispatcher.
- internal/transport/dispatch.go — SubmitHandler and
StatusHandler (http.Handler). SubmitHandler honors
X-Orca-Idempotency-Key for dedupe replay. Submit/Status
Request/Response wire structs. DispatchClient wraps
mTLS HTTP client with the retry loop. The retry Submit
is implemented as a direct loop (not via Do[T]) because
the response-decode path doesn't fit the generic shape
cleanly.
- internal/daemon/dispatch_handler.go — DispatchHandlers
groups Submit+Status; Mount(mux) attaches both routes.
- internal/daemon/server.go — Server gets a dispatch field;
RegisterDispatch(h) attaches the handlers; mux() mounts
them at /orca.v1.Dispatch/{Submit,Status}.
- internal/daemon/dispatch_test.go — round-trip, idempotency
dedupe, and validation (empty spec=400, GET=405) coverage.
- internal/cli/daemon.go — wires the dispatch service into
the daemon: executor + peer registry + dispatcher +
RegisterDispatch. Adds /orca.v1.Dispatch/* to the startup
banner.
- internal/cli/job.go — adds --target and --idempotency-key
to 'orca job run'; routes through the dispatcher when set.
- internal/cli/node_capacity.go — 'orca node capacity
{show,set,list}' for REQ-028. --set takes --cpu, --memory,
--disk, --node. Positivity check on all three numerics.
All tests pass with -race; gofmt -l . clean; go vet ./...
clean. P02 verification commit follows.
---ci---
project: orca
phase: 9
milestone: v0.2
status: execute
---/ci---
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Jon Chery