fix(rulesets): add Secret scan (gitleaks) + coverage to code-quality (#966) - #1001
fix(rulesets): add Secret scan (gitleaks) + coverage to code-quality (#966)#1001don-petry wants to merge 3 commits into
Conversation
…966) The codified code-quality ruleset enforced only SonarCloud, CodeQL, agent-shield/AgentShield, and dependency-audit/Detect ecosystems — diverging from the documented standard (github-settings.md §243), which also lists Secret Scan and Coverage. Now that the template ci.yml produces both checks (companion petry-projects/.github#569: gitleaks secret-scan job + stack-aware coverage job), add the two contexts so the enforced ruleset matches the docs and the template. Enables rulesets-by-default on repo-template: all six contexts (SonarCloud, CodeQL, AgentShield, dependency-audit/Detect ecosystems, Secret scan (gitleaks), coverage) are produced by the seeded scaffold + CodeQL default-setup, so code-quality can be applied without bricking a fresh repo. Refs #966, epic #964. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Warning Review limit reached
Next review available in: 47 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe pull request updates a GitHub ruleset configuration file to add three new required status check contexts—dependency-audit ecosystem detection, secret scanning via gitleaks, and coverage—to the required_status_checks list. ChangesRuleset Status Check Update
Estimated code review effort: 1 (Trivial) | ~2 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
Dev-Lead — review-changes (no-changes)No changes were needed for this PR. |
|
Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-07-01T17:36:02Z. |
Dev-Lead — fix-bot-comment (no-changes)Agent reasoning |
There was a problem hiding this comment.
Pull request overview
Updates the code-quality branch ruleset configuration to require two additional CI signals so that new repositories bootstrapped with this ruleset can enforce secret scanning and coverage alongside existing quality/security checks.
Changes:
- Add
Secret scan (gitleaks)to thecode-qualityrequired status-check contexts. - Add
coverageto thecode-qualityrequired status-check contexts.
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: MEDIUM
Reviewed commit: 1e8a6c9c82be367abf7fa858a7288c99a02540c9
Review mode: triage-approved (single reviewer)
Summary
Adds two required status-check contexts ('Secret scan (gitleaks)', 'coverage') to .github/rulesets/code-quality.json so the enforced ruleset matches the documented required-checks standard. JSON valid, 6 contexts. Focused +3/-1 config change; triage assessment confirmed.
Linked issue analysis
Refs #966 (epic #964): the enforced code-quality ruleset had drifted from the documented standard, which also lists Secret Scan + Coverage. This change closes that gap. 'Secret scan (gitleaks)' exactly matches the real CI check (green in this PR's rollup) — verified. 'coverage' is produced by companion petry-projects/.github#569 (template ci.yml); PR correctly flags 'merge after #569' so the check exists before it is required.
Findings
No blocking issues.
- (advisory, merge-ordering) Respect the documented dependency: merge #569 first so a 'coverage' check exists on downstream/repo-template repos before this ruleset requires it. A required context that never reports blocks all merges.
- (advisory, verify) Confirm the 'coverage' context string exactly matches the job name #569 emits; a mismatch would silently block PRs where this ruleset is enforced. The 'Secret scan (gitleaks)' string is confirmed to match this repo's actual check name.
- No secrets, no code-execution surface, no standards violation (change aligns with github-settings §243).
CI status
All checks green: Lint, ShellCheck, unit-tests, CodeQL (actions+python), SonarCloud (quality gate passed, 0 new issues), AgentShield, dependency-audit, Secret scan (gitleaks), holdout/test-deletion guards. Gemini + Copilot reviews: no feedback. CodeRabbit/Codex advisory bots rate-limited (non-blocking). Note: mergeStateStatus=BEHIND — rebase required before merge.
Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.
Dev-Lead — fix-bot-comment (no-changes)Agent reasoning |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Dev-Lead — fix-reviews (applied)Changes committed and pushed. |
fe9f358
|
Dev-Lead — waiting on PR blockers (intent: review-changes)PR: #1001 |
|
Note @don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically. |
Dev-Lead — review-changes (no-changes)No changes were needed for this PR. |
Review — fix requested (cycle 1/3)The automated review identified the following issues. Please address each one: Findings to fixAutomated review — NEEDS HUMAN REVIEWRisk: MEDIUM SummaryAdds Linked issue analysisNo closing issue references. The PR refs #966 (required-checks divergence from Findings
CI statusAll checks green on Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review. Additional tasks
The review cascade will automatically re-review after new commits are pushed. |
|
Superseded by the ruleset-relocation cleanup (petry-projects/.github#575). Editing the in-place |
Pull request was closed
…leaks.toml (#575) (#1014) * feat(seed): seed .gitleaks.toml into the repo template from standards/gitleaks.toml (#575) The template ci.yml's secret-scan job runs `gitleaks detect --config .gitleaks.toml` (push-protection.md), which fails file-not-found unless every repo ships a .gitleaks.toml at root. Seed it as a baseline file so day-0 repos are green. - BASELINE_MANIFEST: add `.gitleaks.toml|fetch:standards/gitleaks.toml`. - _emit_baseline: generalize the fetch source — bare `fetch` stays the Dependabot stack special case; new `fetch:<standards-path>` fetches that path verbatim (the form the manifest header already documented). Unknown sources fail loud. - Tests: verbatim-fetch + fail-loud for .gitleaks.toml; add it to the baseline-set list; provision the fixture + assert the cross-repo write in the seeding e2e. 28/28 seed bats pass; shellcheck --severity=warning -x clean. Companion to petry-projects/.github#578 (adds the secret-scan job to the template ci.yml). Land together so a seeded repo has both the job and its config. Part of #575 (folded-in from closed #1001). Epic #964. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore: dev-lead update (review-changes) [skip ci-relay] * chore: dev-lead update (review-changes) [skip ci-relay] --------- Co-authored-by: donpetry-bot <{}+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: Don Petry Bot <donpetry+bot@gmail.com> Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
What
Adds two required status-check contexts to
.github/rulesets/code-quality.json:Secret scan (gitleaks)andcoverage.Why
The enforced ruleset (SonarCloud, CodeQL, AgentShield, dependency-audit) diverged from the documented required-checks table (
github-settings.md §243, which also lists Coverage + Secret Scan). Companion petry-projects/.github#569 makes the templateci.ymlactually produce both checks (a canonical gitleakssecret-scanjob and a stack-awarecoveragejob that defaults to shell/bats via kcov). With those in place, adding the two contexts here makescode-qualityenforceable-by-default onrepo-template— all six contexts are produced by the seeded scaffold + CodeQL default-setup, so no fresh repo is bricked.Merge after #569 (so the checks exist before they're required).
Validation
jqvalid; 6 contexts. The bootstrap ruleset test (length > 0) still passes.Refs #966, epic #964.
Summary by CodeRabbit