fix(gitleaks): allowlist example JWT fixture in test_gitleaks_config.bats - #710
Conversation
…bats PR #705 (issue #697) embeds the example expired JWT literally in tests/test_gitleaks_config.bats to test the allowlist, but .gitleaks.toml only allowlisted that token under .claude/skills/**/api-testing-patterns.md. Because the secret scan walks full history, the unallowlisted occurrence fails Secret scan (gitleaks) on affected PRs (e.g. #707). Add a path-scoped (condition=AND) allowlist for the self-test file so the fixture is suppressed while a real secret committed there would still be reported. https://claude.ai/code/session_015VRMMWmqW9nW81jygmea3e
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Warning Review limit reached
More reviews will be available in 57 minutes and 17 seconds. Learn how PR review limits work. Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file). ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the .gitleaks.toml configuration to add an allowlist rule that suppresses an expired JWT dummy token fixture in the tests/test_gitleaks_config.bats self-test, preventing false positives. There are no review comments, and I have no additional feedback to provide.
|
Dev-Lead — waiting on PR blockers (intent: review-changes)PR: #710 |
|
Note @don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically. |
Resolves the .gitleaks.toml conflict by keeping the canonical allowlist entry merged via #710; drops #707's now-redundant duplicate. Brings the secret-scan fix into this PR so its history-wide gitleaks scan passes. https://claude.ai/code/session_015VRMMWmqW9nW81jygmea3e
…bats (#710) PR #705 (issue #697) embeds the example expired JWT literally in tests/test_gitleaks_config.bats to test the allowlist, but .gitleaks.toml only allowlisted that token under .claude/skills/**/api-testing-patterns.md. Because the secret scan walks full history, the unallowlisted occurrence fails Secret scan (gitleaks) on affected PRs (e.g. #707). Add a path-scoped (condition=AND) allowlist for the self-test file so the fixture is suppressed while a real secret committed there would still be reported. https://claude.ai/code/session_015VRMMWmqW9nW81jygmea3e
…bats (#710) PR #705 (issue #697) embeds the example expired JWT literally in tests/test_gitleaks_config.bats to test the allowlist, but .gitleaks.toml only allowlisted that token under .claude/skills/**/api-testing-patterns.md. Because the secret scan walks full history, the unallowlisted occurrence fails Secret scan (gitleaks) on affected PRs (e.g. #707). Add a path-scoped (condition=AND) allowlist for the self-test file so the fixture is suppressed while a real secret committed there would still be reported. https://claude.ai/code/session_015VRMMWmqW9nW81jygmea3e
* feat(personas): onboard dev-lead, pr-review, business-analyst as personas Formalizes the three existing agents under the persona standard and makes each addressable as @petry-projects/<role> (org team handles — teams created: dev-lead, pr-review, business-analyst; all closed, notifications disabled, 0 members). Closes the manifest half of #1281 / #1282 / #1283. Each persona (all status: draft): - personas/<id>/persona.yml — a compliant manifest documenting the REAL runtime: definition layers point at what exists (dev-lead → prompts/dev-lead/; pr-review → agents/pr-reviewer.md + prompts/; business-analyst → vendored bmad-method analyst v6.8.0 + prompts/incubation/). Triggers reflect reality, advisory by default, every write surface carries its gate_label (§4 rule 2). - prompts/<id>/advisory.md — a role-focused advisory the shared persona runner serves on @-mention (read-only, prints between sentinels, marker-first — the qa-lead contract). dev-lead advises on implementation/scoping (code is still written only by its label-triggered runtime, not this path); pr-review gives review guidance (the full tiered review runs on its existing path); business-analyst advises on framing/research/next-analysis-step. - README.md + seed held-out evals (draft-exempt from the count gate; expand before promotion). pr-review points evals.paths at its EXISTING skill sets (evals/deep-review/, evals/triage/) — the multi-skill case #779 unblocks. Decisions taken (from the onboarding issues): - @-addressability for all three (the initiative's goal). pr-review's legacy @donpetry-bot path is retained (real account, works); this adds the role handle. - business-analyst is the Analyst role (brainstorm/market-research/brief) ONLY; the PRD stays with a separate product-manager persona — the documented Analyst→PM handoff is preserved, not collapsed. - pr-review's canary-rings registration (#710) stays a separate follow-up; draft personas don't require it. Deliberately NOT here (tracked, per-issue): real (non-seed) eval sets; the product-manager persona; pr-review canary registration; and — for the mention paths to go live — enrolling these into the router soak (the framework is live only in the next ring today). MERGE ORDER: after petry-projects/.github#779 (schema: evals.paths) and #1302 (validator: reads paths + count gate). pr-review's manifest uses `paths`, which main's validator cannot parse until #1302 lands. Verification - validate-personas.py (with #779 schema + #1302 validator): 4/4 valid, invariants hold. - validate-cases.py: OK, 7 skills / 54 cases, no cross-split id overlap. - markdownlint: clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore: dev-lead update (review-changes) [skip ci-relay] * chore: dev-lead update (review-changes) [skip ci-relay] * fix(reviews): address review comments [skip ci-relay] --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
1 participant
Closes #709.
What
Adds a path-scoped
[[allowlists]]entry to.gitleaks.tomlfor the example expired-JWT fixture embedded intests/test_gitleaks_config.bats.Why
PR #705 (issue #697, commit
58934f64) added a regression-guard test that embeds the example expired JWT literally in the committed file asEXPIRED_JWT='eyJ…'. The secret scan runsgitleaks detect --source .(full history), and.gitleaks.tomlonly allowlisted that token under.claude/skills/**/api-testing-patterns.md— not in the test file. So the unallowlisted occurrence failsSecret scan (gitleaks)on affected PRs (notably #707, which never touches that file).mainis clean; this surfaces on PRs in that lineage.The fix
condition = "AND"binds the dummy value to that one path — consistent with every other entry in the file — so a real secret committed there in future is still reported (not a blanket file suppression).Unblocks
Once merged, affected PRs clear the check by updating their branch with
main.Generated by Claude Code