ci+security: green main, and re-pin the secret scanner onto the real gitleaks gate by hyperpolymath · Pull Request #99 · hyperpolymath/boj-server-cartridges

hyperpolymath · 2026-07-21T04:09:20Z

Clears all four failing jobs on main, and converts Secret Scanner from a check that cannot fail into one that can.

The security change (read this first)

Secret Scanner has been reporting success on main while being incapable of failing. The caller pinned secret-scanner-reusable at @d135b05 (2026-06-24) — 64 commits behind standards#500:

$ gh api repos/hyperpolymath/standards/compare/08e2d246...d135b05
{"status":"behind","ahead":0,"behind":64}

At that pin the step is literally:

- name: Gitleaks Secret Scan
  continue-on-error: true          # <- cannot fail
  uses: gitleaks/gitleaks-action@e0c47f4f...

versus the reusable at the new pin c65436ee (which contains #500 — compare reports ahead 5 / behind 0):

- name: Install gitleaks (pinned + checksum-verified)   # sha256-verified binary
- name: Gitleaks secret scan (gating)
  run: ... gitleaks detect ... --exit-code 1            # gates for real

This is the estate-wide pattern recorded in the fake-checks audit, resolved here for this repo. Also narrowed the caller's grant to contents: read (the new reusable invokes a binary, not gitleaks-action, so it no longer requests pull-requests: write / actions: read).

The 8 findings the real gate surfaces — all verified false positives

Every one is a Zig FFI test fixture inside a test "..." block:

File	Value	Why benign
`gitlab-api-mcp/ffi/…:776`	`glpat-xxxxxxxxxxxxxxxxxxxx`	already annotated `// hypatia-ignore: test fixture`
`research-mcp/ffi/…:432`	`sg_test_api_key_abc123`	self-labelled test key
`cloud-mcp/ffi/…` ×4	`ABCDEF0123456789…`	hex-walk placeholder
`local-coord-mcp/…:351`	`0123456789abcdef…` repeating	fixture pubkey
`local-coord-mcp/…:444`	Ed25519 seed/pubkey	published RFC 8032 §7.1 TEST 1 vector

Cleared by the .gitleaks.toml added here — byte-identical to the baseline in standards#511, needing no repo-specific additions, which is the evidence it works as the estate template. It matches by anchored pattern class (lockfile integrity hashes, whole-value placeholder shapes, published test vectors), never by file and never by disabling a rule, so a genuinely new secret in these same files still trips.

Verified after the change: gitleaks detect --exit-code 1 → no leaks found, while planted realistic github-pat / gitlab-pat / slack-bot-token / stripe-access-token / AWS values are all still detected.

The four reds

Governance / Workflow security linter — pages.yml had no SPDX line and four unpinned tag refs. Added MPL-2.0 (this repo's licence, deliberately not AGPL) and pinned to release SHAs, keeping current majors: checkout v7.0.0, upload-pages-artifact v5.0.0, deploy-pages v5.0.0. (paint-type pins v3/v4 — copying those here would be a downgrade.)
Governance / Check Workflow Staleness — governance.yml + scorecard.yml pinned standards@d7c22711 (52 commits / 23 days behind, outside the ≤50-commit/≤14-day window). Bumped both to c65436ee, the SHA independently verified green on paint-type.
Deploy to Cloudflare Pages — deploy step had no gate, so it hard-failed whenever CLOUDFLARE_API_TOKEN is unset. Now self-gates in the shell and exits 0 with an explanatory message. Deliberately not if: secrets.* — secrets aren't available in if: context; that's the estate compile-error anti-pattern.
Build / SonarQube — fails HTTP 403 Forbidden fetching JRE metadata: it never authenticates and analyses nothing. Made opt-in via vars.SONAR_ENABLED so it skips rather than hard-reds. This hides no quality finding — there is no finding, the scan cannot start.

Owner actions needed (not fixable in a PR)

Rotate SONAR_TOKEN and confirm the SonarCloud project binding for hyperpolymath_boj-server-cartridges, then set repo variable SONAR_ENABLED=true to bring the scan back.
Optionally set CLOUDFLARE_API_TOKEN / CLOUDFLARE_ACCOUNT_ID if Pages deployment is wanted; it now no-ops cleanly without them.

…red services Four failing jobs on main, each with a distinct cause: 1. Governance / Workflow security linter — "missing SPDX header". pages.yml had no SPDX line and four unpinned tag refs, which the estate Actions policy rejects at run creation. Added `MPL-2.0` (this repo's licence, not AGPL) and pinned all four to release SHAs, keeping the current majors: checkout v7.0.0, upload-pages-artifact v5.0.0, deploy-pages v5.0.0. (paint-type's pages.yml pins v3/v4 — copying those here is a downgrade.) 2. Governance / Check Workflow Staleness — governance.yml and scorecard.yml both pinned standards@d7c22711 (2026-06-26), 52 commits and 23 days behind, outside the <=50-commit / <=14-day window. Bumped both to c65436ee, the SHA independently verified green on paint-type. 3. Deploy to Cloudflare Pages — the deploy step ran `wrangler pages deploy` with no gate, so it hard-failed whenever CLOUDFLARE_API_TOKEN is unset. Now self-gates in the shell and exits 0 with an explanatory message when unconfigured. Deliberately NOT gated via `if: secrets.*` — secrets are not available in `if:` expression context; that is the estate compile-error anti-pattern. Same shape boj-build.yml uses to self-gate on BOJ_URL. 4. Build / SonarQube — fails with HTTP 403 Forbidden fetching JRE metadata, i.e. it never authenticates and analyses nothing. That is a credential / project-binding fault requiring an owner action, not a YAML defect. Made the job opt-in via `vars.SONAR_ENABLED` so it skips rather than hard-reds. This hides no quality finding — there is no finding, the scan cannot start. Re-enable by setting SONAR_ENABLED=true after rotating SONAR_TOKEN; the escalation is recorded in the PR body and in a comment on the job. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…-green) Secret Scanner has been reporting SUCCESS on main while being incapable of failing. The caller pinned standards' secret-scanner-reusable at @d135b05 (2026-06-24), which is 64 commits behind #500 (08e2d246): $ gh api repos/hyperpolymath/standards/compare/08e2d246...d135b05 {"status":"behind","ahead":0,"behind":64} At that pin the step is literally: - name: Gitleaks Secret Scan continue-on-error: true # <- cannot fail uses: gitleaks/gitleaks-action@e0c47f4f... versus the reusable at the new pin c65436ee (which contains #500 — compare reports ahead 5 / behind 0): - name: Install gitleaks (pinned + checksum-verified) # sha256-verified - name: Gitleaks secret scan (gating) run: ... gitleaks detect ... --exit-code 1 # gates for real So this is a genuine security uplift, not pin-freshness housekeeping: it is the difference between a scanner that cannot fail and one that can. Also narrowed the caller's grant from contents:read + pull-requests:write + actions:read down to contents:read. The new reusable invokes a binary rather than gitleaks-action and no longer requests the elevated scopes. Making the gate real surfaces 8 findings, all verified false positives — Zig FFI test fixtures inside `test "..."` blocks: placeholder tokens (`glpat-xxxxxxxxxxxxxxxxxxxx`, already annotated `// hypatia-ignore: test fixture`; `sg_test_api_key_abc123`; `ABCDEF0123456789...`), a repeating-hex pubkey, and the published RFC 8032 §7.1 TEST 1 Ed25519 vector. They are cleared by the .gitleaks.toml added here, which is byte-identical to the baseline introduced in standards#511 — it needed no repo-specific additions, which is the evidence it works as the estate template. The allowlist matches by anchored pattern class (lockfile integrity hashes, whole-value placeholder shapes, published test vectors), never by file or by disabling a rule, so a genuinely new secret in these same files still trips. Verified after the change: `gitleaks detect --exit-code 1` -> no leaks found, while planted realistic github-pat / gitlab-pat / slack-bot-token / stripe-access-token / AWS values are all still detected. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

github-actions · 2026-07-21T04:10:09Z

🔍 Hypatia Security Scan

Findings: 287 issues detected

Severity	Count
🔴 Critical	45
🟠 High	135
🟡 Medium	107

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/auth-method-batch-fix/main.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/category-batch-fix/main.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/missing-fields-batch-fix/main.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/cartridge-minter/mint.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/validate-cartridges/main.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/validate-cartridges/main_test.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/cartridges/domains/code-quality/sanctify-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/cartridges/domains/infrastructure/hesiod-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/cartridges/domains/research/bofig-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/cartridges/domains/research/academic-workflow-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

Hypatia flagged .gitleaks.toml:65 — "Secret found: GitLab PAT" — because the comment documenting the repeated-character mask contained a literal masked token. The allowlist file tripping the estate's own secret detector is a neat demonstration of the problem it exists to solve. Describe the shape in prose instead, and record the rule in the file so the next editor does not reintroduce a literal example token. Kept byte-identical to the standards baseline (standards#512). Behaviour unchanged: the regex is untouched. Re-verified — cartridges scans clean (exit 0) with the real gate. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

github-actions · 2026-07-21T04:17:20Z

🔍 Hypatia Security Scan

Findings: 286 issues detected

Severity	Count
🔴 Critical	44
🟠 High	135
🟡 Medium	107

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/auth-method-batch-fix/main.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/category-batch-fix/main.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/missing-fields-batch-fix/main.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/cartridge-minter/mint.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/validate-cartridges/main.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/validate-cartridges/main_test.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/cartridges/domains/code-quality/sanctify-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/cartridges/domains/infrastructure/hesiod-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/cartridges/domains/research/bofig-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/cartridges/domains/research/academic-workflow-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

hyperpolymath and others added 2 commits July 21, 2026 05:08

github-advanced-security AI found potential problems Jul 21, 2026

View reviewed changes

Comment thread .gitleaks.toml Fixed

hyperpolymath merged commit 5013853 into main Jul 21, 2026
28 checks passed

hyperpolymath deleted the ci/green-main-pins-pages-deploy branch July 21, 2026 04:43

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

ci+security: green main, and re-pin the secret scanner onto the real gitleaks gate#99

ci+security: green main, and re-pin the secret scanner onto the real gitleaks gate#99
hyperpolymath merged 3 commits into
mainfrom
ci/green-main-pins-pages-deploy

hyperpolymath commented Jul 21, 2026

Uh oh!

Uh oh!

github-actions Bot commented Jul 21, 2026

Uh oh!

github-actions Bot commented Jul 21, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

hyperpolymath commented Jul 21, 2026

The security change (read this first)

The 8 findings the real gate surfaces — all verified false positives

The four reds

Owner actions needed (not fixable in a PR)

Related

Uh oh!

Uh oh!

github-actions Bot commented Jul 21, 2026

🔍 Hypatia Security Scan

Uh oh!

github-actions Bot commented Jul 21, 2026

🔍 Hypatia Security Scan

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants