Lucas BergerandClaude Opus 4.8
b6490feff4
CI / changes (pull_request) Successful in 9s
CI / api (pull_request) Successful in 3m2s
CI / fast-checks (pull_request) Successful in 4m20s
CI / security (pull_request) Successful in 1m14s
CI / harness (pull_request) Successful in 6m56s
CI / gate (pull_request) Successful in 2s
Lint (eslint --max-warnings 0): - index.ts: disable no-unsafe-argument on the type-only Context mismatch when delegating to the OIDC handler inside the local-session skip wrapper - localAuth.ts: handleLogout is sync (no await) — drop async (require-await) - devBypass.ts: disable detect-possible-timing-attacks on the public well-known dev-placeholder string compare (not a secret comparison) - remove dead code / unused bindings flagged by no-unused-vars: makeTestApp (localSession.test), makeUnauthContext + BrowserContext import (login.spec), unused memberId (admin.test), unused txSelectCount counter (me.test) - localAuthMiddleware.test / me.test: fix unused + reflow-detached eslint-disable directives Format: prettier --write across the 20 Phase-19 files that were never formatted. Secret scan (gitleaks): allowlist two false positives — the synthetic >=32-char TEST_SECRET in localSession.test.ts, and .planning/ design prose (a generic-api-key regex hit on "credential atomically, 409-equivalent"). Neither is a real secret. Verified locally: format:check, lint, typecheck, md:lint, gitleaks (no leaks), PWA 266/266, API 452/452. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
37 lines
1.7 KiB
TOML
37 lines
1.7 KiB
TOML
# .gitleaks.toml — gitleaks configuration
|
|
# Repo: familysync
|
|
|
|
title = "FamilySync gitleaks config"
|
|
|
|
[extend]
|
|
# Extend with the default ruleset (all standard secret patterns)
|
|
useDefault = true
|
|
|
|
[[allowlists]]
|
|
description = "Test fixture VAPID keys — documented test-only values, not production keys"
|
|
paths = ['''apps/api/tests/fixtures/vapid\.ts''']
|
|
|
|
[[allowlists]]
|
|
description = ".env.example — intentional placeholder/template values, not live secrets"
|
|
paths = ['''\.env\.example$''']
|
|
|
|
[[allowlists]]
|
|
description = "apps/api/.env.spike — dev/spike values, not production secrets"
|
|
paths = ['''apps/api/\.env\.spike$''']
|
|
|
|
[[allowlists]]
|
|
description = "apps/api/tests/broker/crypto.test.ts — synthetic AES-256-GCM test key assigned to process.env.APP_PASSWORD_ENCRYPTION_KEY in a Vitest beforeAll; not a real credential"
|
|
paths = ['''apps/api/tests/broker/crypto\.test\.ts''']
|
|
|
|
[[allowlists]]
|
|
description = "apps/api/tests/routes/setup.test.ts — synthetic VAPID public/private test pair used to set process.env.VAPID_* in the setup-route tests; not a real credential (verified not present in .env)"
|
|
paths = ['''apps/api/tests/routes/setup\.test\.ts''']
|
|
|
|
[[allowlists]]
|
|
description = "apps/api/tests/auth/localSession.test.ts — TEST_SECRET is a synthetic >=32-char JWT signing secret used only to exercise issue/verify cookie round-trips under Vitest; not a real credential (Phase 19)"
|
|
paths = ['''apps/api/tests/auth/localSession\.test\.ts''']
|
|
|
|
[[allowlists]]
|
|
description = ".planning/ design docs are internal planning prose (PLAN/SUMMARY/SECURITY/etc.) that frequently discuss credentials, tokens, and auth — they trip generic regex rules (e.g. 'credential atomically, 409-equivalent') but never carry production secrets; not shipped in any image"
|
|
paths = ['''\.planning/''']
|