flan
6ccff1c8df
secret-scan / gitleaks (push) Successful in 11s
Scans the full git history on push, pull request and weekly, so a credential that was committed and later removed is still detected. The scanner archive is pinned by version and verified by SHA-256 before it runs, and matched values are redacted so they never reach the CI log. The accompanying allowlist covers two redaction test fixtures that assert secret-shaped input is masked. Each entry is pinned to an exact commit, file, rule and line, so a real secret added to those files later is still reported.
14 lines
735 B
Plaintext
14 lines
735 B
Plaintext
# Allowlisted Gitleaks fingerprints.
|
|
#
|
|
# Both entries are deliberate test fixtures for this project's own redaction
|
|
# function, not credentials: each asserts that a secret-shaped input is masked.
|
|
# They are history-only -- the current tests assemble those strings at runtime --
|
|
# and a historical commit cannot be cleaned without rewriting history, which is
|
|
# not warranted for fixture data.
|
|
#
|
|
# Each entry is pinned to an exact commit, file, rule and line rather than
|
|
# ignoring the tests/ directory, so a real secret committed to the same files
|
|
# later is still reported.
|
|
a9e828706529bab38759f9a8bea4aafc721853aa:tests/test_redact.py:generic-api-key:30
|
|
a9e828706529bab38759f9a8bea4aafc721853aa:tests/test_judge.py:generic-api-key:71
|