luckberg/familysync
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(12): unblock CI security + harness jobs
CI / changes (pull_request) Successful in 3s
Details
CI / fast-checks (pull_request) Successful in 1m56s
Details
CI / api (pull_request) Successful in 1m44s
Details
CI / harness (pull_request) Successful in 6m28s
Details
CI / security (pull_request) Successful in 1m11s
Details
CI / gate (pull_request) Successful in 0s
Details

Browse Source 
security/gitleaks: allowlist apps/api/tests/routes/setup.test.ts — synthetic
  VAPID test pair (verified absent from .env), same class as existing fixture
  allowlist entries.
security/audit: waive GHSA-88fw-hqm2-52qc (hono CORS) — not exploitable, the
  app uses no hono cors() middleware; newly-published vs pinned hono 4.12.23.
harness/e2e: seed app_config.setup_complete='true' + a dev-admin credential in
  global-setup so the Phase-12 setup gate no longer redirects every spec to
  /setup (was causing all 95 e2e failures) and no onboarding banner renders.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Lucas Berger
2026-06-16 18:24:10 -04:00
co-authored by Claude Opus 4.8
parent 717c859f3c
commit 7354f3ec4f
3 changed files with 27 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitleaks.toml
+4
View File
@@ -22,3 +22,7 @@ paths = ['''apps/api/\.env\.spike$''']
[[allowlists]]
description = "apps/api/tests/broker/crypto.test.ts — synthetic AES-256-GCM test key assigned to process.env.APP_PASSWORD_ENCRYPTION_KEY in a Vitest beforeAll; not a real credential"
paths = ['''apps/api/tests/broker/crypto\.test\.ts''']
[[allowlists]]
description = "apps/api/tests/routes/setup.test.ts — synthetic VAPID public/private test pair used to set process.env.VAPID_* in the setup-route tests; not a real credential (verified not present in .env)"
paths = ['''apps/api/tests/routes/setup\.test\.ts''']