root
3fe5cc3af1
PR Pipeline — Authorize → Validate → Review → Merge / auth (pull_request) Successful in 13s
PR Pipeline — Authorize → Validate → Review → Merge / validate (pull_request) Successful in 5s
PR Pipeline — Authorize → Validate → Review → Merge / lint (pull_request) Successful in 23s
PR Pipeline — Authorize → Validate → Review → Merge / ai-review (pull_request) Successful in 11s
PR Pipeline — Authorize → Validate → Review → Merge / gate (pull_request) Successful in 1s
The synthetic example 'sk-synthetic-litellm-' in hermes-key-enforcement.prose.md:217 was flagged by the secret-assign rule as a credential-shaped assignment. The existing allowlist entry only covered openai-key, so secret-assign still failed. Fix: Change the rule from openai-key to * (matches any rule) and update the reason to explain why (2026-10-03: secret-assign also matches the credential-shaped assignment). This restores prose-lint on master, which was RED and blocking every open PR's lint job (including PR #149's lint job 2160). Chose option (b) (allowlist) over option (a) (restructure) because: - The existing entry already documented the synthetic example - Changing the rule to * is the minimal, honest fix - Restructuring the command would risk weakening the enforcement check Correlation: corr=7c202734ec6c452a
56 lines
6.2 KiB
Plaintext
56 lines
6.2 KiB
Plaintext
# secret-allowlist.tsv — exceptions for scripts/secret-scan.sh, every entry with a reason.
|
|
#
|
|
# Format: <rule-id|*><TAB><path-glob><TAB><literal-substring><TAB><reason>
|
|
# Blank lines and lines whose first field starts with '#' are ignored.
|
|
# A finding is suppressed only when ALL THREE of rule, path and literal match:
|
|
# * the rule id equals the finding's rule id, or is '*'
|
|
# * the finding's repo-relative path matches <path-glob> (bash glob)
|
|
# * the finding's line contains <literal-substring> verbatim
|
|
# An entry whose reason is empty is a hard error (exit 2) — no silent exceptions.
|
|
#
|
|
# RULE: never allowlist a live credential, and never broaden an entry (rule '*',
|
|
# a wide path glob, or a short generic literal) just to silence a finding.
|
|
# If the finding is real, remove the credential from the file.
|
|
#
|
|
# Entries are one per deliberate synthetic example, so the file reads as an
|
|
# audit trail of reviewed exceptions rather than a list of things to ignore.
|
|
# Rule '*' is used only where the same literal is matched by more than one rule.
|
|
#
|
|
# ── The 2026-09-17 purge placeholders ─────────────────────────────────────
|
|
# PR #112 replaced six live credentials with `«vault: <project>/<env> <SECRET>»`
|
|
# references. Those references are safe by construction (they name where the
|
|
# secret is read from), but they are listed here explicitly rather than being
|
|
# filtered by a general "vault" rule, so a new occurrence still needs a
|
|
# deliberate, reasoned entry.
|
|
secret-assign litellm-api-keys.prose.md MUMUNI_LITELLM_API_KEY=«vault: agents/production LITELLM_API_KEY» 2026-09-17 purge: replaced the live Mumuni LiteLLM key with its vault reference; no literal credential.
|
|
secret-assign litellm-api-keys.prose.md MUMUNI_ZULIP_API_KEY=«vault: agents/production ZULIP_API_KEY» 2026-09-17 purge: replaced the live Mumuni Zulip key with its vault reference; no literal credential.
|
|
* infrastructure-control.prose.md PVEAPIToken=«vault: infrastructure/production PVE_API_TOKEN» 2026-09-17 purge: Proxmox API token is read from the vault; the line only names the vault path.
|
|
cred-prose infrastructure-control.prose.md Admin credentials: 2026-09-17 purge: the Stirling admin user/password are two `«vault: ...»` references; no literal credential.
|
|
* scripts/daily-infra-report.py PVEAPIToken=«vault: infrastructure/production PVE_API_TOKEN» 2026-09-17 purge: Proxmox API token is read from the vault; the line only names the vault path.
|
|
secret-assign stirling-pdf-agent-access.prose.md «vault: infrastructure/production STIRLING_API_KEY» 2026-09-17 purge: Stirling PDF API key is read from the vault; the curl example only names the vault path.
|
|
bearer-token agent-zero-fix-summary.md «vault: agents/production OPENROUTER_API_KEY» 2026-09-17 purge: OpenRouter key is read from the vault; the example curl only names the vault path.
|
|
# ── Deliberate synthetic examples in contracts (not from the purge) ───────
|
|
# These exist to teach the rule they illustrate. They are listed here so the
|
|
# guard is never taught to skip the words "synthetic"/"example" — a fabricated
|
|
# example is always an explicit exception, never a pattern-level exemption.
|
|
* hermes-key-enforcement.prose.md sk-synthetic-external-example Rule 15 illustration of a hardcoded external key that is tolerated; fabricated, never a live key.
|
|
* hermes-key-enforcement.prose.md sk-synthetic-example-12345 Rule 15 illustration of a forbidden hardcoded key; fabricated, never a live key.
|
|
* hermes-key-enforcement.prose.md sk-synthetic-litellm- Fabricated key name inside a `grep 'LITELLM_API_KEY=...'` example; not a live key. (2026-10-03: changed rule from openai-key to * because secret-assign also matches the credential-shaped assignment)
|
|
secret-assign hermes-key-enforcement.prose.md sk-NEW_KEY Placeholder standing for the rotated key in an `infisical secrets set` command; not a literal key.
|
|
openrouter-key agent-zero-openrouter-key.prose.md sk-or-v1-synthetic Synthetic key prefix in the contract's example response; the real key is read from the vault.
|
|
openai-key litellm-api-keys.prose.md sk-synthetic-tanko-example Fabricated key name in migration history prose; not a live key.
|
|
openai-key litellm-self-heal.prose.md sk-syslog-local-master-key Deprecated local LiteLLM master key name documented as no-live-usage; kept for history, not a usable credential.
|
|
# ── Redacted evidence, not a credential ──────────────────────────────────
|
|
secret-assign docs/probe-drift-round2-evidence.md =sk-... Probe evidence records redacted key trailers (`sk-...x6uw`); the usable part of the key is not present.
|
|
# ── tests/test_secret_scan.sh fixtures ───────────────────────────────────
|
|
# The self-test plants these fabricated values into a TEMP tree, whose path no
|
|
# entry here covers, so each still fails the guard when planted (see the test's
|
|
# "... fails the guard" cases). They are listed only so the repo-wide scan of
|
|
# the test file itself stays quiet.
|
|
* tests/test_secret_scan.sh sk-or-v1-00000000000000000000000000000000000000000000000000000000deadbeef Self-test fixture: fabricated OpenRouter-shaped key written to a temp tree; the guard must fail on it there.
|
|
bearer-token tests/test_secret_scan.sh Bearer aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabbbbbbbb Self-test fixture: fabricated Bearer token written to a temp tree; the guard must fail on it there.
|
|
proxmox-token tests/test_secret_scan.sh PVEAPIToken=root@pam!monitor=11111111-2222-3333-4444-555555555555 Self-test fixture: fabricated Proxmox token written to a temp tree; the guard must fail on it there.
|
|
private-key tests/test_secret_scan.sh -----BEGIN OPENSSH PRIVATE KEY----- Self-test fixture: fabricated PEM banner written to a temp tree; the guard must fail on it there.
|
|
cred-prose tests/test_secret_scan.sh Admin credentials: Self-test fixture: fabricated prose credential line written to a temp tree; the guard must fail on it there.
|
|
secret-assign tests/test_secret_scan.sh DB_PASSWORD=correct-horse-battery-staple Self-test fixture: fabricated password assignment written to a temp tree; the guard must fail on it there.
|