Skip to content

chore: allow exact disposable privilege/TLS warning fixture values in secret scanning #59

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
codegiveness merged 1 commit into from
Oct 10, 2026
Merged

chore: allow exact disposable privilege/TLS warning fixture values in secret scanning #59

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .gitleaks.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,11 +67,11 @@ regexes = ['''^Password=<password>$''']
# These values must remain tied to these exact paths, not entire test files.
[[allowlists]]
targetRules = ["npgsql-keyword-password", "sqlserver-keyword-password"]
description = "Disposable integration roles and invalid-configuration diagnostic marker"
description = "Disposable integration roles, interpolated disposable role constant and diagnostic markers"
condition = "AND"
paths = ['''^tools/PostgreSqlMcp\.Verify/Integration\.cs$''']
regexTarget = "match"
regexes = ['''^Password=(?:reader-disposable|writer-disposable|sensitive-configuration-marker)$''']
regexes = ['''^Password=(?:reader-disposable|writer-disposable|sensitive-configuration-marker|sensitive-tls-marker|\{password\})$''']

[[allowlists]]
targetRules = ["npgsql-keyword-password", "sqlserver-keyword-password"]
Expand Down
1 change: 1 addition & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@
- CodeQL: new same-repository-only `pull-request-upload` job uploads the candidate SARIF so PR heads get a code-scanning check run, which Scorecard SAST counts. Scan jobs stay read-only and fork PRs get no upload. No PR code is built or executed with the write token.
- OpenSSF Best Practices: propose answers for all 67 passing criteria in `.bestpractices.json` (previously 34), after the owner chose to answer previously deferred criteria. Developer-knowledge answers rest on the owner's attestation; response and fix answers cite zero issues, security advisories and Dependabot alerts and no open CodeQL alerts as of 2026-10-10; cryptographic answers describe Npgsql/.NET/OS defaults and operator-controlled TLS; `test_most` is Unmet because coverage is not measured. Nothing is saved on the badge website until the owner reviews and saves it.
- Document the repository's git and GitHub workflow in [docs/git-workflow.md](docs/git-workflow.md), including tested worktree limits on the VMware shared folder and the repository's merge settings and rulesets. Add bug/feature issue forms with a private security route, a pull-request template, CODEOWNERS and label-based categories for generated GitHub Release notes. Dependabot now uses an explicit `build(deps)` commit prefix and groups GitHub Actions updates into one pull request.
- Secret scanning: allow two more exact disposable values in `tools/PostgreSqlMcp.Verify/Integration.cs`, the interpolated `Password={password}` role constant and the `sensitive-tls-marker` diagnostic marker used by the privilege/TLS warning scenarios. Other values in that file, and these values in any other file, still fail.

## 0.4.0

Expand Down
Loading