mirror of
https://github.com/JamesTurland/JimsGarage.git
synced 2026-07-26 18:38:14 +00:00
d5dadb5f4b
Add a GitHub Actions workflow that runs the project's pre-commit hooks against the files changed in each PR, plus a gitleaks secret scan over the PR's commits. Both block on findings. Enrich the existing .pre-commit-config.yaml with general hygiene checks and four linters (shellcheck, yamllint, actionlint, gitleaks), add a lenient yamllint config tuned for the repo's existing YAML, and add a gitleaks config that keeps the full default ruleset while baselining the repo's pre-existing intentional dummy credentials. Linting is scoped to changed files, so the checks pass on the current tree and only hold new or edited files to standard. - .github/workflows/lint.yml: pull_request workflow, read-only token, two jobs (pre-commit on changed files + gitleaks on the commit range) - .pre-commit-config.yaml: keep existing hooks; add hygiene checks, shellcheck (--severity=warning), yamllint, actionlint, gitleaks - .yamllint.yaml: lenient ruleset - .gitleaks.toml: default rules + allowlist for .env/example placeholders - .gitleaksignore: baseline of pre-existing intentional dummy credentials
50 lines
1.9 KiB
TOML
50 lines
1.9 KiB
TOML
# Gitleaks configuration for JimsGarage.
|
|
#
|
|
# These are homelab tutorial configs: many directories intentionally ship
|
|
# throwaway/dummy credentials so viewers can copy a working example (see
|
|
# issue #127). This config keeps the full default secret-detection ruleset
|
|
# but allowlists the paths and placeholder values that are dummy *by
|
|
# convention*, so the scanner only fires on something that looks like a
|
|
# genuine accidental leak.
|
|
#
|
|
# Tradeoff worth knowing: because `.env` files here are demo placeholders by
|
|
# design, they are allowlisted wholesale — gitleaks will NOT catch a real
|
|
# secret accidentally dropped into a `.env`. The scanner's value in this repo
|
|
# is catching real secrets pasted into scripts, compose files, and manifests.
|
|
|
|
title = "JimsGarage gitleaks config"
|
|
|
|
[extend]
|
|
# Inherit all of gitleaks' built-in rules (AWS keys, JWTs, private keys,
|
|
# provider tokens, high-entropy strings, etc.).
|
|
useDefault = true
|
|
|
|
[[allowlists]]
|
|
description = "Intentional throwaway credentials in example/placeholder files"
|
|
# `paths` is matched against the file path of the candidate finding.
|
|
paths = [
|
|
# Tracked .env files are demo placeholders by convention in this repo.
|
|
'''(^|/)\.env$''',
|
|
'''\.env$''',
|
|
# Files that are explicitly named as examples/samples/templates.
|
|
'''(^|/)[^/]*example[^/]*''',
|
|
'''(^|/)[^/]*sample[^/]*''',
|
|
'''\.(example|sample|dist|template|tmpl)$''',
|
|
]
|
|
|
|
[[allowlists]]
|
|
description = "Common placeholder secret values"
|
|
# `regexes` is matched against the detected secret value itself, so a
|
|
# realistic-looking value anywhere still gets flagged — only obvious
|
|
# placeholders are exempted.
|
|
regexTarget = "match"
|
|
regexes = [
|
|
'''(?i)changeme''',
|
|
'''(?i)your[-_].*(key|token|secret|password)''',
|
|
'''(?i)example[-_.]?(key|token|secret|password|value)?''',
|
|
'''(?i)supersecret''',
|
|
'''(?i)redacted''',
|
|
'''(?i)<[^>]+>''', # angle-bracket placeholders like <your-token>
|
|
'''(?i)^(test|dummy|placeholder|password|secret)$''',
|
|
]
|