From 3f2d8c23bb654300b9f1a6aabcbdeb857a407c3b Mon Sep 17 00:00:00 2001 From: Neil Galvin Date: Tue, 8 Sep 2026 18:52:12 +0100 Subject: [PATCH] fix(secret-scan): allowlist the plaintext-scan test fixtures MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit tests/plaintext-scan.test.sh is a corpus of deliberately secret-shaped strings — it feeds fixtures to the sops-audit plaintext scanner and asserts which are caught, so half are true-positives by design. The default rules flagged three of them (generic-password x2, generic-api-key, all low confidence) on every full-history scan. That blocked the pre-push betterleaks hook for everyone, from a clean tree, on branches that had touched nothing related. The only way past it was --no-verify, which disarms the hook entirely for that push. Adds a root .betterleaks.toml, auto-discovered by both the lefthook hooks and secret-scan.yml (config-path defaults to empty). Two deliberate choices: - Scoped to the single path, not tests/**. The rest of the tree, other test files included, stays covered. - [extend] useDefault = true. Without it the file REPLACES the built-in rules rather than adding to them, disarming the scan while it continues to report success — the same fail-quiet direction the sops-audit allowlist guards against. Verified: full-history scan clean; config check reports 417 rules, matching the default set; a probe secret in a non-allowlisted path is still caught (stripe-access-token and generic-password both fire); plaintext-scan tests still 21/21. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_016vhsMyme4mZsF49j38WXQB --- .betterleaks.toml | 28 ++++++++++++++++++++++++++++ CHANGELOG.md | 14 ++++++++++++++ 2 files changed, 42 insertions(+) create mode 100644 .betterleaks.toml diff --git a/.betterleaks.toml b/.betterleaks.toml new file mode 100644 index 0000000..cb32a04 --- /dev/null +++ b/.betterleaks.toml @@ -0,0 +1,28 @@ +# betterleaks configuration for this repository's own scans. +# +# secret-scan.yml auto-discovers this file (config-path defaults to empty), +# and so do the lefthook betterleaks hooks. It governs THIS repo only — +# consumers of the reusable workflow bring their own config. + +title = "nkg/github-actions" + +# Keep the full default ruleset. Without this the file would REPLACE the +# built-in rules rather than add to them, silently disarming the scan — +# the same fail-quiet direction the sops-audit allowlist guards against. +[extend] +useDefault = true + +[[allowlists]] +description = """ +tests/plaintext-scan.test.sh is a corpus of deliberately secret-shaped +strings: it feeds fixtures to the sops-audit plaintext scanner and asserts +which ones are caught. Half of them are true-positives by design, so the +default rules flag them on every full-history scan (generic-password and +generic-api-key, all low confidence). + +Scoped to this one path rather than tests/** — the rest of the tree, test +files included, stays covered. +""" +paths = [ + '''^tests/plaintext-scan\.test\.sh$''', +] diff --git a/CHANGELOG.md b/CHANGELOG.md index 99de1df..8788e16 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -25,6 +25,20 @@ project uses [SemVer](https://semver.org/) for the `vMAJOR.MINOR.PATCH` tags. would let an annotation bind across arbitrary text to an unrelated `default:` further down the file. +- Added `.betterleaks.toml` so this repo's own secret scan runs clean. + `tests/plaintext-scan.test.sh` is a corpus of deliberately secret-shaped + fixtures — half of them true-positives by design, feeding the sops-audit + plaintext scanner — so the default rules flagged three of them on every + full-history scan. That blocked the `pre-push` betterleaks hook for + everyone, from a clean tree, on a branch that had touched nothing related. + + The allowlist is scoped to that single path rather than `tests/**`, and + `[extend] useDefault = true` keeps the full 417-rule default set. Both + matter: a config file without `extend` *replaces* the built-in rules + instead of adding to them, which would disarm the scan while continuing + to report success — the same fail-quiet direction the sops-audit + allowlist guards against. + ## [3.2.1] - 2026-09-01 ### Fixed