From e13ab7c0820f2117656767cce5448d315ffe04d1 Mon Sep 17 00:00:00 2001 From: AG <288536783+codegiveness@users.noreply.github.com> Date: Sat, 10 Oct 2026 21:23:42 +0700 Subject: [PATCH] chore: allow exact disposable privilege/TLS warning fixture values in secret scanning --- .gitleaks.toml | 4 ++-- CHANGELOG.md | 1 + 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/.gitleaks.toml b/.gitleaks.toml index 416b4cd..074ff6f 100644 --- a/.gitleaks.toml +++ b/.gitleaks.toml @@ -67,11 +67,11 @@ regexes = ['''^Password=$'''] # These values must remain tied to these exact paths, not entire test files. [[allowlists]] targetRules = ["npgsql-keyword-password", "sqlserver-keyword-password"] -description = "Disposable integration roles and invalid-configuration diagnostic marker" +description = "Disposable integration roles, interpolated disposable role constant and diagnostic markers" condition = "AND" paths = ['''^tools/PostgreSqlMcp\.Verify/Integration\.cs$'''] regexTarget = "match" -regexes = ['''^Password=(?:reader-disposable|writer-disposable|sensitive-configuration-marker)$'''] +regexes = ['''^Password=(?:reader-disposable|writer-disposable|sensitive-configuration-marker|sensitive-tls-marker|\{password\})$'''] [[allowlists]] targetRules = ["npgsql-keyword-password", "sqlserver-keyword-password"] diff --git a/CHANGELOG.md b/CHANGELOG.md index 42a7054..ede42c8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,7 @@ - CodeQL: new same-repository-only `pull-request-upload` job uploads the candidate SARIF so PR heads get a code-scanning check run, which Scorecard SAST counts. Scan jobs stay read-only and fork PRs get no upload. No PR code is built or executed with the write token. - OpenSSF Best Practices: propose answers for all 67 passing criteria in `.bestpractices.json` (previously 34), after the owner chose to answer previously deferred criteria. Developer-knowledge answers rest on the owner's attestation; response and fix answers cite zero issues, security advisories and Dependabot alerts and no open CodeQL alerts as of 2026-10-10; cryptographic answers describe Npgsql/.NET/OS defaults and operator-controlled TLS; `test_most` is Unmet because coverage is not measured. Nothing is saved on the badge website until the owner reviews and saves it. - Document the repository's git and GitHub workflow in [docs/git-workflow.md](docs/git-workflow.md), including tested worktree limits on the VMware shared folder and the repository's merge settings and rulesets. Add bug/feature issue forms with a private security route, a pull-request template, CODEOWNERS and label-based categories for generated GitHub Release notes. Dependabot now uses an explicit `build(deps)` commit prefix and groups GitHub Actions updates into one pull request. +- Secret scanning: allow two more exact disposable values in `tools/PostgreSqlMcp.Verify/Integration.cs`, the interpolated `Password={password}` role constant and the `sensitive-tls-marker` diagnostic marker used by the privilege/TLS warning scenarios. Other values in that file, and these values in any other file, still fail. ## 0.4.0