Skip to content

ci: load the org Gitleaks baseline for EVM keys - #10

Open
adamkoy wants to merge 5 commits into
mainfrom
ci/gitleaks-evm-baseline
Open

ci: load the org Gitleaks baseline for EVM keys#10
adamkoy wants to merge 5 commits into
mainfrom
ci/gitleaks-evm-baseline

Conversation

@adamkoy

@adamkoy adamkoy commented Sep 28, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Load the shared Gitleaks baseline so EVM private keys are caught even when the variable is not named PRIVATE_KEY (for example deployer_pk).
  • The workflow downloads the config pinned in m0-platform/secret-scan at 640b598d5685d92449a7529bd29854823ee23481 and passes it as GITLEAKS_CONFIG.

Test plan

  • Secret Scan (Gitleaks) is green on this pull request
  • The job log shows it is using /tmp/m0-gitleaks.toml

@adamkoy
ci: load the org Gitleaks baseline for EVM private keys
25bd4db 
The stock action misses deployer_pk-style keys. Fetch the shared baseline so a 32-byte hex is caught regardless of the variable name.
@github-actions

github-actions Bot commented Sep 28, 2026 •
edited
Loading

Copy link
Copy Markdown

LCOV of commit c01ede2 during Forge Coverage #33

Summary coverage rate:
  lines......: 100.0% (2 of 2 lines)
  functions..: 100.0% (1 of 1 function)
  branches...: no data found

Files changed coverage rate: n/a

adamkoy and others added 4 commits September 28, 2026 16:15
@adamkoy
ci: scan the full repo history with the org Gitleaks workflow
a8e1258 
Call the pinned secret-scan workflow so EVM rules apply and every commit in the repo is scanned, not only the pull request diff.
@adamkoy
ci: pin the Gitleaks baseline that ignores 1Password op:// references
323b2bc 
Vault pointers are not secrets. The key is injected by the op CLI at runtime.
@adamkoy
ci: track secret-scan@main so allow-list updates do not need a pin bump
10e423d 
False-positive rules can change in one place while these callers stay put.
@adamkoy
ci: re-run secret scan against the org baseline
c01ede2
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@adamkoy