fix(secret-scanner): stage THE estate baseline, not standards' own gitleaks config - #600
Conversation
…nfig
Every consumer without its own .gitleaks.toml has been failing the
gitleaks gate with:
FTL failed to load extended config, err: open
config/gitleaks/estate-baseline.toml: no such file
The reusable sparse-checked-out standards/.gitleaks.toml and copied it
into the consumer as .gitleaks-estate.toml. But that file is not the
baseline — it is standards' own repo config, and it CONSUMES the
baseline via
[extend]
path = "config/gitleaks/estate-baseline.toml"
`[extend] path` resolves against the PROCESS working directory (as
standards' own config comments state). Inside standards that path
exists; copied into a consumer it does not, so gitleaks aborts before
scanning anything and the gate fails — scanning ZERO files while
reporting a failure.
Stage config/gitleaks/estate-baseline.toml instead. That file's own
header already documents this exact staging as the intended behaviour,
and it extends only gitleaks' built-in rules (useDefault = true), so it
needs no path resolution in the consumer.
Observed on my-lang (run 31187815519); affects every consumer repo that
does not carry its own .gitleaks.toml.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
Note Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime. Code Review ✅ ApprovedUpdates the secret scanner workflow to stage the shared estate baseline gitleaks configuration instead of the standards repository's own config. No issues found.
OptionsDisplay: compact → Showing less information. Comment with these commands to change the behavior for this request:
Important Your trial ends in 3 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more. Was this helpful? React with 👍 / 👎 | Gitar |
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
|
1 participant
Every consumer repo without its own
.gitleaks.tomlis currently failing the gitleaks gate:Cause
The reusable sparse-checks-out
standards/.gitleaks.tomland copies it into the consumer as.gitleaks-estate.toml.But that file is not the baseline — it is standards' own repo config, and it is itself a consumer of the baseline:
[extend] pathresolves against the process working directory — standards' own config comments say so explicitly, having verified it empirically. Inside standards that path exists. Copied into a consumer it does not, so gitleaks aborts before scanning anything: zero files scanned, gate failed. The failure looks like a secret-scanning problem and is actually a config-staging one.Fix
Stage
config/gitleaks/estate-baseline.tomlinstead. Two lines — the sparse-checkout path and thecp.That is what the baseline file's own header already documents:
…so the workflow was contradicting the file it was meant to be staging. The baseline extends only gitleaks' built-in rules (
useDefault = true), so it requires no path resolution in the consumer — the failure mode does not recur one level down.Evidence
Observed on my-lang run 31187815519. my-lang has no
.gitleaks.tomlof its own, so it took the estate path and died. Verified: YAML parses, registry check clean.🤖 Generated with Claude Code