Files

T

ciagent b1b2e3dcb6 fix(P07): harden .gitignore for .env and document pre-existing secret leak

Layer-3 security audit during P07 EXECUTE found that .env (containing
GITEA_TOKEN) was committed in 0cba1aa during P00 and remained in git
history. The pre-P07 .gitignore only excluded .env.local, not .env.

This commit:
1. Adds .env to .gitignore alongside .env.local (forward fix — prevents
   future re-tracking).
2. Documents the pre-existing leak in .ciagent/PHASE7_SECURITY_AUDIT.md
   with mitigation steps and required human actions (token rotation,
   history rewrite, access-log audit, CI secret scanning).

The backfill script itself (commit de69788) does not leak the secret: it
sources .env from disk and never echoes or passes it on the command line.
The leak is upstream of P07 and is documented as P0 for the human to
remediate out-of-band.

---ci---
project: orca
phase: 7
milestone: v0.1
status: execute
version: v0.1.7
requirements:
  covered: [REQ-007]
  partial: []
---/ci---

2026-06-03 20:42:39 +00:00

2.5 KiB

Raw Blame History

description

description
P07 Layer-3 security audit finding — pre-existing .env secret leak in git history at `0cba1aa`

Phase 7 Security Audit Finding

Severity: P0 (secret in git history) Status: Mitigated going forward; full remediation requires human action Found by: ciagent verify (Layer 3 — security) during P07 EXECUTE Commit in history: 0cba1aa — chore(P00): set autonomy level to full

Finding

The .env file (containing GITEA_TOKEN=795e...67aa and GITEA_USER=cloudinit-bot) was committed in 0cba1aa during P00 and has remained in git history since. It is reachable on the main branch and all descendant branches.

The pre-P07 .gitignore listed only .env.local, so .env was tracked.

Immediate Mitigations Applied in P07

Added .env to .gitignore (matches .env.local discipline).
Confirmed scripts/backfill_releases.sh does not echo the token, does not pass it as a CLI argument to tea, and sources it from .env only.
Confirmed tea is configured to use this token via its own config and the script invokes tea releases create without --token flags.
Documented the leak here for human review.

Required Human Actions (out of CI scope)

Rotate the Gitea token: the leaked value is in the public-on-this-forge git history. Treat it as compromised; generate a new token at https://git.cloudinit.dev/user/settings/applications and update .env.
Rewrite history to scrub the secret (optional but recommended):
- git filter-repo --invert-paths --path .env and force-push all branches, OR
- use git-filter-repo via BFG Repo-Cleaner.
- This is a destructive operation; coordinate with all consumers.
Audit Gitea access logs for the period the token was exposed to detect any unauthorized use.
Add CI secret scanning: integrate gitleaks or trufflehog into the validate pipeline (deferred to v0.2 alongside REQ-014 gosec+govulncheck).

P07 Continues

P07 EXECUTE continues (no P0 code change required for the milestone tag itself; the backfill script is safe and the existing token still works for its purpose). The P07 ship → v0.1 milestone → main flow proceeds, but REVIEW/AUDIT must flag this for the milestone close-out.

Forward-Looking Rule (proposed for v0.2)

pre-commit hook runs gitleaks protect --staged and rejects any commit that adds a secret.
.env* is in .gitignore from the first commit of v0.2 onward.
ciagent-init warns loudly if git log --all -- .env returns anything.

2.5 KiB Raw Blame History