coulomb/railiance-forge
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

FORGE-WP-ADHOC-2026-10-27: allow filename content digests in the receive scanner
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
The pinned Gitleaks profile now ignores one generic-api-key match: a text-extension filename whose value is exactly 64 lowercase hex digits. A bare keyword assignment of that digest still blocks. The installed Forgejo adapter is unchanged.

Assistant: grok
Assistant-Model: grok-4.7
Assistant-Session: 01a17f2b-8cc3-76f0-9bce-3b3444b9a5e9
This commit is contained in:
tegwick 2026-10-27 22:30:34 +01:00
parent 2afdff68b1
commit 67f1cd044f
5 changed files with 75 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

10
docs/receive-secret-detection.md
View file

@ -56,8 +56,14 @@ names; the adapter does not make Git's transport diagnostics a secret-safe log.
Exit 0 is `clean` in this declared scope; exit 1 is `blocked`; exit 2 is
`unverified`. Both nonzero statuses must refuse the complete push. There is no
implicit baseline/ignore or override switch. A false-positive exception needs a
separate reviewed mechanism with exact scope, approval and expiry.
implicit baseline/ignore or override switch. Repository configuration cannot
disable detection. The adapter's private config adds one reviewed
`generic-api-key` match allowlist: a filename with a normal text extension
(`.md`, `.markdown`, `.txt`, `.yaml`, `.yml`, `.json`, `.py`, or `.toml`) whose
value is exactly 64 lowercase hex digits. A bare keyword assignment of that
same digest still blocks. Any wider exception needs a separate reviewed
mechanism with exact scope, approval and expiry. Keep this profile identical
to Repo Manager's staged-scan config.
## Bounds and remaining coverage