agentic-forges/forgejo-mcp

Watch

Fork 0

ci: gitleaks allowlist for placeholder tokens in demo docs #147

Merged

goern merged 0 commits from refs/pull/147/head into main

2026-05-25 07:45:33 +00:00

goern commented

2026-05-25 07:29:38 +00:00

(Migrated from codeberg.org)

Summary

pre-commit run gitleaks / Tekton code-scans flag the line
Authorization: token invalid_token in the forthcoming
demos/multi-tenant-http.md
(fork branch byteflavour/stateless-token). The token is intentional test data — request 4 in the demo illustrates what an invalid token does.

Add a tightly-scoped per-rule allowlist on curl-auth-header so the placeholder-shaped strings get skipped only in demos/*.md, leaving every other secret-detection signal intact.

Allowlist scope

Rule: curl-auth-header (the default rule that fired)
Path: demos/.*\.md$
Secret regex (case-insensitive, anchored):
- ^invalid[-_]?token$
- ^placeholder[-_]?token$
- ^changeme$
- ^your[-_](api[-_])?token[-_]here$

Real tokens are not bypassed — verified locally by appending
Authorization: token ghp_abcdef…ABCD to the same demo file: the github-pat
rule still flagged it.

Local verification

# With the offending demo file present (cherry-picked from fork branch)
$ podman run --rm -v "$(pwd):/scan:Z" ghcr.io/gitleaks/gitleaks:v8.30.1 \
    detect --no-git --config /scan/.gitleaks.toml --source /scan
INF no leaks found

# With a real-looking GitHub PAT appended to the same file
$ ...
RuleID:      github-pat
WRN leaks found: 1

Gotcha worth knowing

gitleaks v8.30.x ignores user-added [[rules]] blocks that appear after any top-level [[allowlists]] block in the same TOML file. Per-rule allowlists must come first. Discovered while iterating on this PR; documented in the inline comment near the new block so the next maintainer doesn't waste time.

Related: gitleaks v8.30.x also does not propagate top-level [[allowlists]] (plural) to default rules — only the deprecated [allowlist] (singular) does, and that one can't coexist with [[allowlists]]. Per-rule is the only working path here.

Test plan

Tekton code-scans PipelineRun on this PR passes (no leaks)
Tekton run on the merging fork PR (byteflavour/stateless-token) passes after this merges to main
pre-commit run gitleaks --all-files clean post-merge

Refs forgejo-mcp-dhd. Unblocks the multi-tenant-http demo PR.

## Summary `pre-commit run gitleaks` / Tekton `code-scans` flag the line `Authorization: token invalid_token` in the forthcoming [`demos/multi-tenant-http.md`](https://codeberg.org/goern/forgejo-mcp/src/commit/bd08d6147dd23e25215ba832728e008e32ba04fd/demos/multi-tenant-http.md?display=source#L109-L112) (fork branch `byteflavour/stateless-token`). The token is intentional test data — request 4 in the demo illustrates what an invalid token does. Add a tightly-scoped per-rule allowlist on `curl-auth-header` so the placeholder-shaped strings get skipped only in `demos/*.md`, leaving every other secret-detection signal intact. ## Allowlist scope - **Rule**: `curl-auth-header` (the default rule that fired) - **Path**: `demos/.*\.md$` - **Secret regex** (case-insensitive, anchored): - `^invalid[-_]?token$` - `^placeholder[-_]?token$` - `^changeme$` - `^your[-_](api[-_])?token[-_]here$` Real tokens are not bypassed — verified locally by appending `Authorization: token ghp_abcdef…ABCD` to the same demo file: the `github-pat` rule still flagged it. ## Local verification ```text # With the offending demo file present (cherry-picked from fork branch) $ podman run --rm -v "$(pwd):/scan:Z" ghcr.io/gitleaks/gitleaks:v8.30.1 \ detect --no-git --config /scan/.gitleaks.toml --source /scan INF no leaks found # With a real-looking GitHub PAT appended to the same file $ ... RuleID: github-pat WRN leaks found: 1 ``` ## Gotcha worth knowing gitleaks v8.30.x **ignores** user-added `[[rules]]` blocks that appear *after* any top-level `[[allowlists]]` block in the same TOML file. Per-rule allowlists must come first. Discovered while iterating on this PR; documented in the inline comment near the new block so the next maintainer doesn't waste time. Related: gitleaks v8.30.x also does not propagate top-level `[[allowlists]]` (plural) to default rules — only the deprecated `[allowlist]` (singular) does, and that one can't coexist with `[[allowlists]]`. Per-rule is the only working path here. ## Test plan - [x] Tekton `code-scans` PipelineRun on this PR passes (no leaks) - [ ] Tekton run on the merging fork PR (`byteflavour/stateless-token`) passes after this merges to main - [ ] `pre-commit run gitleaks --all-files` clean post-merge Refs forgejo-mcp-dhd. Unblocks the multi-tenant-http demo PR.

op1st-gitops commented

2026-05-25 07:29:46 +00:00

(Migrated from codeberg.org)

op1st Pipelines as Code/code-scans-z2f8m is running.

Starting Pipelinerun code-scans-z2f8m in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines code-scans-z2f8m -f

op1st Pipelines as Code/code-scans-z2f8m is running. Starting Pipelinerun <b>[code-scans-z2f8m](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-z2f8m)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-z2f8m) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines code-scans-z2f8m -f</code>

op1st-gitops commented

2026-05-25 07:29:46 +00:00

(Migrated from codeberg.org)

op1st Pipelines as Code/on-pull-request-mk6q5 is running.

Starting Pipelinerun on-pull-request-mk6q5 in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines on-pull-request-mk6q5 -f

op1st Pipelines as Code/on-pull-request-mk6q5 is running. Starting Pipelinerun <b>[on-pull-request-mk6q5](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-mk6q5)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-mk6q5) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines on-pull-request-mk6q5 -f</code>

op1st-gitops commented

2026-05-25 07:30:07 +00:00

(Migrated from codeberg.org)

op1st Pipelines as Code/code-scans-z2f8m has successfully validated your commit.

Namespace: op1st-pipelines
PipelineRun: code-scans-z2f8m

Task Statuses:

Status	Duration	Name
Succeeded	13 seconds	fetch-source
Succeeded	10 seconds	gitleaks-version
Succeeded	8 seconds	gitleaks

op1st Pipelines as Code/code-scans-z2f8m has <b>successfully</b> validated your commit. <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-z2f8m">code-scans-z2f8m</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>13 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-z2f8m/logs/fetch-source) </td></tr> <tr> <td>Succeeded</td> <td>10 seconds</td><td> [gitleaks-version](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-z2f8m/logs/gitleaks-version) </td></tr> <tr> <td>Succeeded</td> <td>8 seconds</td><td> [gitleaks](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-z2f8m/logs/gitleaks) </td></tr> </table>

op1st-gitops commented

2026-05-25 07:31:31 +00:00

(Migrated from codeberg.org)

op1st Pipelines as Code/on-pull-request-mk6q5 has successfully validated your commit.

Namespace: op1st-pipelines
PipelineRun: on-pull-request-mk6q5

Task Statuses:

Status	Duration	Name
Succeeded	11 seconds	fetch-source
Succeeded	1 minute	build-and-test

op1st Pipelines as Code/on-pull-request-mk6q5 has <b>successfully</b> validated your commit. <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-mk6q5">on-pull-request-mk6q5</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>11 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-mk6q5/logs/fetch-source) </td></tr> <tr> <td>Succeeded</td> <td>1 minute</td><td> [build-and-test](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-mk6q5/logs/build-and-test) </td></tr> </table>

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

agentic-forges/forgejo-mcp!147

No description provided.

Rows
Columns