fix: harden crypto live pool audit gate (#101)

Author: Pigbibi

.github/workflows/ci.yml

@@ -31,6 +31,11 @@ jobs:
           python -m pip install -r "$REQ_FILE"
           python -m pip install ruff
 
+      - name: Verify dependencies
+        run: |
+          set -euo pipefail
+          python -m pip check
+
       - name: Run ruff
         run: |
           set -euo pipefail

scripts/gate_codex_app_review.py

@@ -104,7 +104,7 @@ def compile_patterns(policy: dict[str, Any]) -> list[re.Pattern[str]]:
 # ─── static guard ────────────────────────────────────────────────────────────
 
 _SENSITIVE = re.compile(
-    r'(?:api[_\s]?key|secret|password|token|credential|private[_\s]?key)\s*[:=]\s*["\']'
+    r'(?P<field>api[_\s]?key|secret|password|token|credential|private[_\s]?key)\s*[:=]\s*["\']'
     r'(?!\$\{\{|{{|example|placeholder|test|your[-_\s]|xxx|TODO|CHANGEME)[^"\']{12,}["\']',
     re.IGNORECASE,
 )
@@ -129,7 +129,8 @@ def scan_diff(diff_text: str, path_patterns: list[re.Pattern[str]]) -> list[str]
             continue
         m = _SENSITIVE.search(line[1:])
         if m:
-            violations.append(f"**Hardcoded secret** in `{current}`: `{m.group(0)[:100]}`")
+            field = re.sub(r"\s+", "_", m.group("field").strip().lower())
+            violations.append(f"**Hardcoded secret** in `{current}`: `{field}=<redacted>`")
     return list(dict.fromkeys(violations))
 
 

tests/test_gate_codex_app_review.py

@@ -0,0 +1,28 @@
+from __future__ import annotations
+
+import unittest
+
+from scripts.gate_codex_app_review import scan_diff
+
+
+class GateCodexAppReviewTests(unittest.TestCase):
+    def test_scan_diff_redacts_hardcoded_secret_values(self) -> None:
+        secret_field = "API" + "_KEY"
+        secret_value = "super" + "secretvalue123456"
+        diff_text = (
+            "diff --git a/example.env b/example.env\n"
+            "--- a/example.env\n"
+            "+++ b/example.env\n"
+            f'+{secret_field} = "{secret_value}"\n'
+        )
+
+        violations = scan_diff(diff_text, [])
+
+        self.assertEqual(len(violations), 1)
+        self.assertIn("<redacted>", violations[0])
+        self.assertIn("api_key", violations[0])
+        self.assertNotIn(secret_value, violations[0])
+
+
+if __name__ == "__main__":
+    unittest.main()