Repository navigation
chore(ci): pin gainratio/ci modules to 8420264 - #69
Merged
Merged
Conversation
gainratio/ci#83 makes foundation.guard canary a classic ghp_ token and a randomized stateless ghs_ token through this repo's own scan config, in several file types, and refuse on a miss. Track it per the consumers-track-latest rule. The new guard passes against this repo's current main. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dz52qtnUaQELb6B2eNdXHM
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Re-pin every
gainratio/cimodule reference fromfbc0223to8420264(gainratio/ci#83):dagger.jsonplus the contract constants, workflow lineage pins and docs that assert the literal SHA.Why
gainratio/ci#83 makes
foundation.guardrun a classicghp_canary and a randomized statelessghs_<APPID>_<JWT>canary (canary.py/.ts/.txt/.env+ extensionless) through the exact config each scan uses, and refuse withguard-canary-missedon any miss. gitleaks 8.30.1 misses statelessghs_tokens on its own (gitleaks#2192). Consumers track latest.Claim touched: secret scanning catches leaked GitHub tokens.
Local guard result
dagger -m github.com/gainratio/ci/modules/portfolio-foundation@8420264 call guard --source=. --repository=gainratio/privacy-core --commit-sha=<main d7dda8e> sync→ exit 0, not refused (scanned with the foundation default config (no repo.gitleaks.toml)). Config is unchanged by this PR, so the branch scans identically.Red run proving the guard can fail: same command on agentic-context-service
96e4444(config before the stateless rule) → exit 1,guard-canary-missed: classic GitHub token in canary.py not detected by /snapshot/.gitleaks.toml.Local gate:
dagger developresolves the new pin; contract tests touched by the SHA bump pass (see commit). Full gate: this PR's CI.🤖 Generated with Claude Code
https://claude.ai/code/session_01Dz52qtnUaQELb6B2eNdXHM