feat: implement issue #262 — Compliance: secret_scanning_non_provider_patterns - #278
feat: implement issue #262 — Compliance: secret_scanning_non_provider_patterns#278don-petry wants to merge 4 commits into
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request restructures the .github/settings.yml file by moving secret scanning configurations to the top-level security_and_analysis block. Additionally, a duplicate .dev-lead/ entry was added to .gitignore, which is redundant and should be removed.
| .dev-lead/ | ||
| .dev-lead/ | ||
| .dev-lead/ | ||
| .dev-lead/ |
There was a problem hiding this comment.
The entry .dev-lead/ is already present multiple times in this file (lines 65-69). This additional duplicate entry is redundant and should be removed.
|
Warning Review limit reached
More reviews will be available in 59 minutes and 59 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
This PR updates repository configuration to satisfy compliance finding #262 by ensuring GitHub Secret Scanning “non-provider patterns” is enabled via probot/settings-managed repo settings.
Changes:
- Enable
secret_scanning_non_provider_patterns(and keep AI detection enabled) under top-levelsecurity_and_analysisin.github/settings.yml. - Update
.gitignore(currently adds an additional duplicate.dev-lead/ignore entry).
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
.gitignore |
Adds another .dev-lead/ ignore entry (but introduces redundant duplicates). |
.github/settings.yml |
Ensures secret scanning non-provider patterns are enabled in the correct security_and_analysis section for compliance. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 52628211b3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| secret_scanning_non_provider_patterns: | ||
| status: enabled | ||
|
|
||
| security_and_analysis: |
There was a problem hiding this comment.
With .github/settings.yml managed by the Repository Settings app, security_and_analysis is not one of the supported top-level sections; the app dispatches top-level keys through Settings.PLUGINS, which only includes sections like repository, labels, branches, etc. Moving this block out of repository: makes the sync try to instantiate a missing plugin for security_and_analysis, so the settings push fails instead of enabling secret_scanning_non_provider_patterns (and may block later settings from applying).
Useful? React with 👍 / 👎.
Dev-Lead — fix-bot-comment (applied)Changes committed and pushed. |
|
|
Closing due to merge conflict that cannot be auto-rebased. Re-implementing from fresh main via dev-lead. |
Pull request was closed
Closes #262
Implemented by dev-lead agent. Please review.