Repository navigation
Scheduled Security workflow: Secret scan fails on generic-api-key false positives in test fixtures (red for 3 weeks) #211
Description
Summary
The weekly scheduled Security workflow has been red three weeks in a row, each time in the Source, dependencies, and SBOM job, for three different reasons. The most actionable one is the Secret scan (gitleaks) step failing on generic-api-key false positives in test fixtures, which will keep failing every scheduled run because the scan covers the full history (git log -p -U0 --full-history --all).
Evidence (scheduled runs on this repo):
| Date | Run | Failing step | Detail |
|---|---|---|---|
| 2026-10-05 | 37265762346 | npm audit --audit-level=high (+ all 3 Image scan jobs) |
audit threshold tripped |
| 2026-10-12 | 38205278059 | Secret scan |
gitleaks generic-api-key false positives |
| 2026-10-19 | 39200430360 | npm run test:public |
two timing flakes (details below) |
I reproduced the gitleaks failure with a workflow_dispatch run of the same workflow on my fork: Schultzenator/spaceapp run 39213368933 — same step, leaks found: 21, every single finding is RuleID: generic-api-key in fixtures/docs, none of them are real credentials:
apps/api/tests/cors-origin-guard.test.ts:65— a hard-codedsec-websocket-keytest headerapps/api/tests/codex-reset-credits.test.ts:14,apps/web/tests/demo-store.test.ts:229,packages/contracts/tests/toolbar-system-actions.test.ts:66— literalidempotencyKeytest valuesapps/api/tests/request-correlation.test.ts:11,apps/api/tests/google-autoclaim.test.ts:6,apps/api/tests/google-oauth-security.test.ts:9— literalsessionSecrettest valuesapps/web/tests/demo-setup.test.ts:11,apps/web/tests/owner-setup.test.tsx:224— literal demopasswordvaluespackages/db/tests/telegram-persistence.test.ts:123/:155—secretVersionfixturespackages/gateway/tests/fixtures/headroom-parity/**—cache_keyfixturesagent-skills/space-hyperframes/media-use/scripts/lib/telemetry.mjs:12—POSTHOG_API_KEYplaceholder constantpackages/gateway/src/providers/claude/oauth.ts:7—CLAUDE_OAUTH_CLIENT_ID(public OAuth client id, not a secret)docs/quality/pause-checkpoint-2026-10-03.md:61— prose in a status notepackages/contracts/tests/admin-operations.test.ts:99,apps/web/tests/space-gateway-dialog.test.tsx:51
Push-triggered runs stay green because gitleaks only scans the pushed commit range there, but the scheduled run scans full history, so these findings re-fail the pipeline every week.
Suggested fix
Add path-based allowlists to .gitleaks.toml for test fixtures, e.g.:
[[allowlists]]
description = "test fixtures use literal placeholder keys that trip generic-api-key"
paths = [
'''apps/[^/]+/tests/.*''',
'''packages/[^/]+/tests/.*''',
'''docs/quality/.*''',
]
regexTarget = "match"plus inline # gitleaks:allow comments for the remaining non-test spots (telemetry.mjs, oauth.ts).
The 2026-10-19 flakes (same run, different cause)
For completeness, the Oct 19 scheduled run failed in the test suite on two timing-sensitive tests:
apps/api/tests/room-watchdog.test.ts:258— "triggers auto-interrupt and publishes ROOM_WATCHDOG_ALERT when room lock times out":expected 'PANE_CREATED' to be 'ROOM_WATCHDOG_ALERT'. Looks like an event-ordering race:store.getLatestEvent()returns the pane-created event instead of the watchdog event recorded just before it (no unique timestamp/tie-break in the in-memory store's event log).apps/web/tests/smoke.test.tsx— "focuses a browser handoff from live SSE only while the server request is active":expected false to be true(SSE/timing).
These look like the same family as the shared-chat-dispatch flake reported in #207.
Activity
fix(security): merge gitleaks allowlist into single [allowlist] table…
yhpop commentedon Oct 20, 2026
@oll4com Would you consider a separate $50 USD fixed-price fix for the gitleaks portion of #211, paid by PayPal after acceptance?
I read
.gitleaks.tomland the Security workflow. Proposed scope: reproduce the reported full-history findings, suppress only verified placeholder matches (not whole test/docs directories), and add a synthetic-secret regression check so genuine leaks in those paths still fail. Deliverables would be a tested PR, before/after scanner output, and a short explanation of each exception. The timing flakes and dependency/image audit failures would remain outside this small scope.This would be AI-assisted work, reviewed and tested before submission. I have not run the scan or made a fix yet. If you want this as a paid task, please confirm the scope, $50 budget and PayPal availability before I start.
fix(security,tests): allowlist gitleaks test fixture false positives …
fix(security): add test fixtures and public client IDs to gitleaks al…
fix(security): mark public Claude OAuth client id with gitleaks:allow (…
fix(security): mark public PostHog client key with gitleaks:allow (ol…
Dimank92 commentedon Oct 24, 2026
Hi team 👋
I have submitted PR #285 (#285) to resolve this issue.
It configures the path-based allowlists in
.gitleaks.tomlfor test fixture paths and documentation, and adds regex/inline allowlists for the public Claude OAuth client ID and PostHog key, turning the scheduled full-history scan green while keeping production code fully guarded.fix(security): configure gitleaks allowlist for test fixtures and pub…
fix(ci): suppress generic-api-key false positives in test fixtures an…
oll4com commentedon Oct 27, 2026
Thank you for documenting the scheduled full-history scan failures and separating the secret-scan findings from the test flakes and dependency audit failures.
We have responded on PR #291 about its DCO sign-offs. The current head now contains sign-off lines on both commits; its Actions runs are still waiting for maintainer approval. Code and security review remain necessary, including checking that any scanner exceptions are narrow and still detect genuine secrets in test and documentation paths.
This issue has no posted bounty, and we are not agreeing to a separate paid task here. Thank you for the report and the proposed fixes.
fix(security): configure gitleaks allowlist for test fixtures and pub…
fix(security,tests): allowlist gitleaks test fixture false positives …
oll4com commentedon Oct 31, 2026
Status update: the inline gitleaks:allow lines for the PostHog key and the Claude OAuth client ID shipped in run-spaceapp 1.1.9, but the scheduled full-history scan still fails (Security run 40886100441 on 29 October: 29 findings), because gitleaks also reads the old commits. We are fixing it with exact fingerprints of the verified placeholder findings in .gitleaksignore rather than path or pattern exemptions, so a real secret added to a test or a document later still fails the scan. We will close this issue when the scheduled scan is green.