tegwick
67f1cd044f
The pinned Gitleaks profile now ignores one generic-api-key match: a text-extension filename whose value is exactly 64 lowercase hex digits. A bare keyword assignment of that digest still blocks. The installed Forgejo adapter is unchanged. Assistant: grok Assistant-Model: grok-4.7 Assistant-Session: 01a17f2b-8cc3-76f0-9bce-3b3444b9a5e9
1.2 KiB
| id | type | title | domain | repo | status | owner | created | updated |
|---|---|---|---|---|---|---|---|---|
| FORGE-WP-ADHOC-2026-10-27 | workplan | Allow filename content digests in the receive scanner | financials | railiance-forge | active | grok | 2026-10-27 | 2026-10-27 |
Allow a text-filename digest through generic-api-key
id: FORGE-WP-ADHOC-2026-10-27-T01
status: done
priority: high
The pinned Gitleaks 8.30.1 profile now allowlists one generic-api-key match:
a filename with extension .md, .markdown, .txt, .yaml, .yml, .json,
.py, or .toml, whose value is exactly 64 lowercase hex digits. A bare
keyword assignment of the same digest still blocks, as do uppercase, short,
quoted, and suffixed values. The profile is scannerConfig in
tools/receive-secret-scan and matches Repo Manager's staged-scan config.
Repository .gitleaks.toml files and inline allow comments remain ignored.
Admit the updated adapter on the forge
id: FORGE-WP-ADHOC-2026-10-27-T02
status: wait
priority: high
Source and the disposable scanner test do not change the installed pre-receive adapter. The running Forgejo hook keeps the previous profile until this executable is rebuilt and admitted. The emergent-security 0.2.7 push stays blocked until that admission.