[pradithya]

Problem

The CI/CD Pipeline badge on the README has been red since the weekly scheduled build was enabled — every schedule run on main has failed (checked back to 2026-05-11).

The culprit is the Secrets Scan job, which fails in ~6s. All other jobs pass.

Root cause

Gitleaks' generic-api-key rule fires on a test fixture:

File:   internal/config/loader_test.go
Line:   65
Commit: 063ffbeb
RuleID: generic-api-key

cfg.Auth.SessionSecret = "f47ac10b58cc4372a5670e02b2c3d479"

That's the canonical RFC 4122 example UUID with the hyphens stripped. TestWarnInsecureConfig_StrongSecret uses it purely to assert that a high-entropy session_secret does not emit an INSECURE CONFIG warning. It is not a live credential and never was — no rotation needed.

Because CI checks out with fetch-depth: 0, gitleaks scans the entire history and the finding is pinned to commit 063ffbeb. Editing the file at HEAD would not clear it; an allowlist is the correct remedy.

Fix

Adds .gitleaks.toml that:

• extends the upstream default ruleset (useDefault = true) — no rules are weakened or dropped
• allowlists exactly one literal string, scoped to the matched secret via regexTarget = "secret"

Verification

Run locally with gitleaks 8.24.3, the exact version gitleaks/gitleaks-action@v2 pins:

	result	exit
before	leaks found: 1	2
after	no leaks found	0

Confirmed the allowlist is not overly broad — planting a fake AWS key (AKIA...) and GitHub PAT (ghp_...) into internal/config/ still trips the scan with exit 2.

Note (out of scope)

Two unrelated things surfaced while debugging, happy to file separately:

1. gitleaks/gitleaks-action@v2 and actions/cache@v4 emit Node 20 deprecation warnings.
2. The Go Report Card badge currently renders "retired" — goreportcard appears to no longer serve a grade, so that badge is cosmetically broken too.

[Copilot]

Pull request overview

This PR aims to fix the failing scheduled CI “Secrets Scan” by adding a Gitleaks configuration that keeps the default ruleset while allowlisting a specific known test-fixture value that was flagged as a false positive in git history.

Changes:

• Adds a repo-level Gitleaks config extending the upstream default ruleset.
• Introduces a narrowly scoped allowlist entry intended to suppress one specific false-positive secret match from a historical commit.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.05%. Comparing base (1c88c6c) to head (8d3af57).

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #85      +/-   ##
==========================================
- Coverage   80.10%   80.05%   -0.06%     
==========================================
  Files          58       58              
  Lines        7686     7686              
==========================================
- Hits         6157     6153       -4     
- Misses       1188     1190       +2     
- Partials      341      343       +2     

Flag	Coverage Δ
unit	80.05% <ø> (-0.06%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[pradithya]

Second issue found & fixed: workflow had been auto-disabled

While verifying, no CI ran on this PR at all. The cause:

CI/CD Pipeline | disabled_inactivity | .github/workflows/ci.yaml

GitHub auto-disables scheduled workflows after 60 days of repo inactivity. So the badge was red for a compounding reason - the last recorded run was the failing one from 2026-07-13, and nothing has been able to run since.

I re-enabled it via gh api -X PUT repos/pradithya/lemuria/actions/workflows/ci.yaml/enable. State is now active, and the pipeline ran on this PR.

Verification: full pipeline green

Run 31891739377 on this branch:

Check Conventional Commits  0:05
Test Frontend               0:24
Lint Frontend               0:22
Test Helm Chart             0:18
Secrets Scan                0:07   <- was failing, now passes
Lint Backend                1:56
Test Backend                3:03
E2E Tests                   6:35
Build Docker (PR)           OK

conclusion: success

Once this merges to main, the badge should flip green on the next push.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.