Jon Chery
df58bc25a3
---ci--- project: orca phase: 3 milestone: v0.3 status: complete requirements: covered: [REQ-022, REQ-030, REQ-032] partial: [] ---/ci--- v0.3 milestone merged to main. Includes all v0.2 work (P08-P10) that was previously on the milestone branch but not yet merged to main, plus the v0.3 completion work (iter.Seq streaming + doctor network/db). v0.2 phases included: P08 (mTLS), P09 (scheduling), P10 (security scan). v0.3 phases: P0 (pre-execution), P1 (iter.Seq streaming), P2 (doctor), P3 (final review+ship). Total: 40 requirements, all complete. No new go.mod dependencies. Full test suite passes under -race. gofmt + go vet clean.
42 lines
1.3 KiB
TOML
42 lines
1.3 KiB
TOML
# gitleaks config for orca (v0.2 P03, REQ-039)
|
|
#
|
|
# Allowlist CA cert PEM blocks (-----BEGIN CERTIFICATE-----) and test
|
|
# data paths under internal/security/testdata/. Stopwords for both
|
|
# the v0.1 historical `.env` leak (mitigated forward; baseline file
|
|
# .gitleaks-baseline.json handles the historical case) and the
|
|
# `.gitleaks-baseline.json` file itself.
|
|
|
|
title = "orca gitleaks config"
|
|
|
|
[extend]
|
|
useDefault = true
|
|
|
|
[allowlist]
|
|
description = "Global allowlist for orca repo"
|
|
paths = [
|
|
'''\.gitleaks-baseline\.json$''',
|
|
'''\.gitleaks\.toml$''',
|
|
'''\.golangci\.yml$''',
|
|
'''\.coreci\.yml$''',
|
|
'''\.ciagent/.*\.md$''',
|
|
'''CHANGELOG\.md$''',
|
|
'''internal/security/testdata/.*''',
|
|
'''docs/security-scanning\.md$''',
|
|
]
|
|
|
|
# Stopwords for cert PEM blocks (REQ-039): allow the cert headers,
|
|
# but not the private-key headers. We rely on gitleaks' built-in
|
|
# private-key detector for the latter; the allowlist here suppresses
|
|
# the cert-PEM false-positive on `-----BEGIN CERTIFICATE-----`.
|
|
stopwords = [
|
|
'''-----BEGIN CERTIFICATE-----''',
|
|
'''-----END CERTIFICATE-----''',
|
|
]
|
|
|
|
[[rules]]
|
|
id = "orca-cert-pem"
|
|
description = "CA and leaf cert PEM blocks (allowlisted, not flagged)"
|
|
regex = '''-----BEGIN (?:RSA |EC |DSA |)CERTIFICATE-----'''
|
|
keywords = ["-----BEGIN CERTIFICATE-----"]
|
|
allowlist = true
|