Latte
1a039e32ab
Replace lint/test/docker workflows with ci.yml (gitleaks, lint, test-unit, test-integration, test-mcp, build-and-push, docs-check, security). Rebuild the Dockerfile as a digest-pinned multi-stage uv build running as uid 1000, add .dockerignore, a hardened compose file and a gitleaks config. The integration harness now falls back to /etc/hostname and /proc/self to find its own container.
38 lines
1.4 KiB
TOML
38 lines
1.4 KiB
TOML
# Gitleaks configuration. Extends the default ruleset; only the findings below
|
|
# are allowlisted. Every one of them was reviewed and is a fake or a placeholder
|
|
# (documentation examples, test fixtures, and a variable name that matched the
|
|
# generic key rule). Real credential rules (cloud keys, private keys, provider
|
|
# token formats) stay active everywhere.
|
|
title = "AegisGitea-MCP gitleaks config"
|
|
|
|
[extend]
|
|
useDefault = true
|
|
|
|
# Fake tokens in tests and placeholder values in docs. Only the two noisy
|
|
# generic rules are silenced, and only in these directories.
|
|
[[allowlists]]
|
|
description = "fake fixtures in tests and placeholder examples in docs"
|
|
targetRules = ["generic-api-key", "curl-auth-header"]
|
|
paths = [
|
|
'''^tests/''',
|
|
'''^docs/''',
|
|
]
|
|
|
|
# Legacy top-level guides that no longer exist in the tree (they live only in
|
|
# history). They contained placeholder keys such as YOUR_API_KEY and
|
|
# a1b2c3d4e5f6....
|
|
[[allowlists]]
|
|
description = "removed legacy docs with placeholder keys"
|
|
targetRules = ["generic-api-key", "curl-auth-header"]
|
|
paths = [
|
|
'''^(AUTH_SETUP|AUTHENTICATION_IMPLEMENTATION_SUMMARY|CHATGPT_SETUP|DEPLOYMENT|KEY_ROTATION|TESTING)\.md$''',
|
|
]
|
|
|
|
# Removed module: a cache-size constant name matched the generic key rule.
|
|
[[allowlists]]
|
|
description = "false positive in a removed source file"
|
|
targetRules = ["generic-api-key"]
|
|
paths = [
|
|
'''^src/aegis_gitea_mcp/server\.py$''',
|
|
]
|