Lucas BergerandClaude Opus 4.8
7354f3ec4f
CI / changes (pull_request) Successful in 3s
CI / fast-checks (pull_request) Successful in 1m56s
CI / api (pull_request) Successful in 1m44s
CI / harness (pull_request) Successful in 6m28s
CI / security (pull_request) Successful in 1m11s
CI / gate (pull_request) Successful in 0s
security/gitleaks: allowlist apps/api/tests/routes/setup.test.ts — synthetic VAPID test pair (verified absent from .env), same class as existing fixture allowlist entries. security/audit: waive GHSA-88fw-hqm2-52qc (hono CORS) — not exploitable, the app uses no hono cors() middleware; newly-published vs pinned hono 4.12.23. harness/e2e: seed app_config.setup_complete='true' + a dev-admin credential in global-setup so the Phase-12 setup gate no longer redirects every spec to /setup (was causing all 95 e2e failures) and no onboarding banner renders. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
29 lines
1.1 KiB
TOML
29 lines
1.1 KiB
TOML
# .gitleaks.toml — gitleaks configuration
|
|
# Repo: familysync
|
|
|
|
title = "FamilySync gitleaks config"
|
|
|
|
[extend]
|
|
# Extend with the default ruleset (all standard secret patterns)
|
|
useDefault = true
|
|
|
|
[[allowlists]]
|
|
description = "Test fixture VAPID keys — documented test-only values, not production keys"
|
|
paths = ['''apps/api/tests/fixtures/vapid\.ts''']
|
|
|
|
[[allowlists]]
|
|
description = ".env.example — intentional placeholder/template values, not live secrets"
|
|
paths = ['''\.env\.example$''']
|
|
|
|
[[allowlists]]
|
|
description = "apps/api/.env.spike — dev/spike values, not production secrets"
|
|
paths = ['''apps/api/\.env\.spike$''']
|
|
|
|
[[allowlists]]
|
|
description = "apps/api/tests/broker/crypto.test.ts — synthetic AES-256-GCM test key assigned to process.env.APP_PASSWORD_ENCRYPTION_KEY in a Vitest beforeAll; not a real credential"
|
|
paths = ['''apps/api/tests/broker/crypto\.test\.ts''']
|
|
|
|
[[allowlists]]
|
|
description = "apps/api/tests/routes/setup.test.ts — synthetic VAPID public/private test pair used to set process.env.VAPID_* in the setup-route tests; not a real credential (verified not present in .env)"
|
|
paths = ['''apps/api/tests/routes/setup\.test\.ts''']
|