109 lines
6.5 KiB
Markdown
109 lines
6.5 KiB
Markdown
---
|
|
phase: 16-ci-dependency-audit-and-security-checks
|
|
plan: "04"
|
|
subsystem: infra
|
|
tags: [gitleaks, secret-scanning, dockerignore, image-hygiene, security, ci]
|
|
|
|
requires:
|
|
- phase: 16-ci-dependency-audit-and-security-checks
|
|
provides: Phase context, CI workflow, security check baseline strategy
|
|
|
|
provides:
|
|
- .gitleaks.toml — default ruleset + 4 allowlists (VAPID fixture, .env.example, .env.spike, crypto.test.ts AES fixture)
|
|
- scripts/gitleaks-baseline.json — committed empty-array full-history baseline (613 commits, 23 MB, zero findings)
|
|
- .dockerignore — excludes secrets/dev/bulk from Docker build context while preserving apps/api/src and workspace manifests
|
|
|
|
affects:
|
|
- 16-05 (gitleaks PR-diff scan CI job — consumes .gitleaks.toml + --baseline-path scripts/gitleaks-baseline.json)
|
|
- 16-06 (static .dockerignore assertion — greps the exclusion patterns added here)
|
|
|
|
tech-stack:
|
|
added:
|
|
- gitleaks v8.30.1 (secret scanner — used locally to generate baseline; CI binary installed in 16-05)
|
|
patterns:
|
|
- gitleaks allowlist-by-path pattern for known test fixtures (paths regex array in [[allowlists]] blocks)
|
|
- Full-history baseline committed as empty JSON; PR-diff scan uses --baseline-path to ignore pre-existing known-safe history
|
|
|
|
key-files:
|
|
created:
|
|
- .gitleaks.toml
|
|
- scripts/gitleaks-baseline.json
|
|
- .dockerignore
|
|
modified: []
|
|
|
|
key-decisions:
|
|
- "D-04-ALLOWLIST: crypto.test.ts TEST_KEY allowlisted by path — human-verified Vitest beforeAll synthetic AES-256-GCM fixture, not a real credential; 4th [[allowlists]] block added after human approval at the Task 3 checkpoint"
|
|
- "D-04-BASELINE: baseline is empty JSON array after allowlisting; all 613 commits scanned clean; PR-diff scans in 16-05 start from provably clean history"
|
|
|
|
patterns-established:
|
|
- "gitleaks allowlist block structure: [[allowlists]] with description + paths (raw TOML string regex) — match existing block style when adding future fixture paths"
|
|
|
|
requirements-completed: [SEC-01, IMG-02]
|
|
|
|
duration: 45min
|
|
completed: 2026-06-13
|
|
---
|
|
|
|
# Phase 16 Plan 04: Gitleaks Config, Full-History Baseline, and .dockerignore Summary
|
|
|
|
**gitleaks config (4 path allowlists) + committed empty baseline (613 commits clean) + .dockerignore keeping secrets/dev/bulk out of Docker build context**
|
|
|
|
## Performance
|
|
|
|
- **Duration:** ~45 min
|
|
- **Started:** 2026-06-13
|
|
- **Completed:** 2026-06-13
|
|
- **Tasks:** 3 (Tasks 1-2 by prior executor; Task 3 checkpoint + continuation by this executor)
|
|
- **Files modified:** 3 created + 1 extended (.gitleaks.toml 4th allowlist)
|
|
|
|
## Accomplishments
|
|
|
|
- `.gitleaks.toml` authored with `[extend] useDefault = true` inheriting the full default ruleset, plus 4 `[[allowlists]]` blocks covering the VAPID test fixture, .env.example, .env.spike, and the synthetic AES-256-GCM key in crypto.test.ts
|
|
- `scripts/gitleaks-baseline.json` regenerated after allowlisting the crypto.test.ts fixture — 613 commits scanned, ~23 MB of git history, zero findings; baseline is an empty JSON array `[]`, giving 16-05's PR-diff scan a provably clean starting state
|
|
- `.dockerignore` created, excluding `.env`, `node_modules`, `.git`, `.planning/`, `apps/api/tests/`, `apps/pwa/e2e/`, seed scripts, and bulk artifacts while preserving `apps/api/src` (required by the builder stage's `COPY apps/api ./apps/api`), `apps/pwa/src`, workspace manifests, and all `package.json`/`tsconfig.json` files
|
|
|
|
## Task Commits
|
|
|
|
1. **Task 1: .gitleaks.toml with default ruleset + fixture/env allowlists** - `2f1592c` (chore)
|
|
2. **Task 2: .dockerignore (secrets/dev/bulk, preserve builder inputs)** - `5819247` (chore)
|
|
3. **Task 3 (post-checkpoint): allowlist crypto.test.ts in .gitleaks.toml** - `fba22b4` (chore)
|
|
4. **Task 3 (post-checkpoint): regenerate clean full-history baseline** - `bc83495` (chore)
|
|
|
|
## Files Created/Modified
|
|
|
|
- `.gitleaks.toml` — gitleaks config: useDefault=true + 4 path-based allowlists (VAPID fixture, .env.example, .env.spike, crypto.test.ts AES fixture)
|
|
- `scripts/gitleaks-baseline.json` — committed full-history baseline: empty `[]` (613 commits clean)
|
|
- `.dockerignore` — Docker build context filter: excludes secrets/dev/bulk, preserves builder-stage inputs
|
|
|
|
## Decisions Made
|
|
|
|
- **D-04-ALLOWLIST:** The Task 3 human-verify checkpoint surfaced one baseline finding: `TEST_KEY` at `apps/api/tests/broker/crypto.test.ts:15`, a synthetic AES-256-GCM key assigned to `process.env.APP_PASSWORD_ENCRYPTION_KEY` in a Vitest `beforeAll`. Human verified it is a test fixture. Operator approved adding a 4th `[[allowlists]]` block for `apps/api/tests/broker/crypto\.test\.ts` so future PR-diff scans also suppress it by path. Allowlist added, baseline regenerated — result is zero findings.
|
|
- **D-04-BASELINE:** Empty baseline `[]` is the correct output when all known fixtures are properly allowlisted. The 16-05 gitleaks workflow will pass `--baseline-path scripts/gitleaks-baseline.json` so PR-diff scans only alert on new findings introduced in the PR, not pre-existing allowlisted history.
|
|
|
|
## Deviations from Plan
|
|
|
|
The original plan had Tasks 1-2 as `type="auto"` and Task 3 as a `type="checkpoint:human-verify"`. The continuation task (adding the 4th allowlist and regenerating the baseline) was triggered by the human-verified finding at the checkpoint — this is expected flow, not a deviation. The 4th allowlist block was added per the operator's "Approve + allowlist it" decision.
|
|
|
|
None - plan executed exactly as specified; the checkpoint and human-directed allowlist addition are the intended workflow.
|
|
|
|
## Issues Encountered
|
|
|
|
None — gitleaks scan completed cleanly in 3 seconds; zero unexpected findings after allowlisting the known test fixture.
|
|
|
|
## Threat Surface Scan
|
|
|
|
No new network endpoints, auth paths, file access patterns, or schema changes introduced by this plan. All changes are static config files (`.gitleaks.toml`, `.dockerignore`) and a JSON report artifact (`scripts/gitleaks-baseline.json`).
|
|
|
|
## User Setup Required
|
|
|
|
None — no external service configuration required. The gitleaks binary is installed in CI via the 16-05 workflow step, not checked in.
|
|
|
|
## Next Phase Readiness
|
|
|
|
- `16-05` (gitleaks PR-diff scan CI job): `.gitleaks.toml` and `scripts/gitleaks-baseline.json` are in place — 16-05 can wire the `gitleaks git --config .gitleaks.toml --baseline-path scripts/gitleaks-baseline.json` CI step immediately
|
|
- `16-06` (static .dockerignore assertion): `.dockerignore` contains all patterns the static assertion greps for; `apps/api/src` exclusion is verified absent
|
|
|
|
---
|
|
*Phase: 16-ci-dependency-audit-and-security-checks*
|
|
*Completed: 2026-06-13*
|