clawdie/websources
Watch
1
0
Fork
You've already forked websources
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

chore: root-anchored /keys/ ignore + tracked-secret gate #14

Merged
clawdie merged 1 commit from chore/keys-ignore-secret-gate into main 2026-10-06 10:37:34 +02:00
Conversation 1 Commits 1 Files changed 3 +64 -1
clawdie commented 2026-10-05 20:47:39 +02:00
Owner
Copy link

What

The enforcement half of the credential lifecycle (policy: colibri
docs/wiki/credentials.md). One commit, three files:

  • .gitignore — root-anchored /keys/, the disposable repo-local
    test-credential boundary.
  • scripts/check-secrets.sh (new) — the operational gate .gitignore
    cannot be. Fails when:
    • anything under keys/ is tracked;
    • a private-key-like filename is tracked (id_*, *_rsa, *.ed25519,
      *.pem, *.key, *.p12, *.pfx);
    • a forge.env / jev.env credential file is tracked;
    • any tracked file contains a -----BEGIN … PRIVATE KEY----- header.
  • package.json — adds check:secrets and includes it in check:all.

Verification

  • Clean tree → check-secrets: clean (exit 0).
  • Force-staged keys/forgejo-test and a stray leak.key → exit 1 with the
    offenders listed (both cases exercised).
  • npm run check:boundaries PASS · npm run check:links PASS.

Note

keys/ is a deliberately insecure, disposable convenience boundary — not a
secure store. The policy and the promotion-by-replacement rule live in colibri
docs/wiki/credentials.md.

## What The enforcement half of the credential lifecycle (policy: colibri `docs/wiki/credentials.md`). One commit, three files: - **`.gitignore`** — root-anchored **`/keys/`**, the disposable repo-local test-credential boundary. - **`scripts/check-secrets.sh`** (new) — the operational gate `.gitignore` cannot be. Fails when: - anything under `keys/` is tracked; - a private-key-like filename is tracked (`id_*`, `*_rsa`, `*.ed25519`, `*.pem`, `*.key`, `*.p12`, `*.pfx`); - a `forge.env` / `jev.env` credential file is tracked; - any tracked file contains a `-----BEGIN … PRIVATE KEY-----` header. - **`package.json`** — adds `check:secrets` and includes it in `check:all`. ## Verification - Clean tree → `check-secrets: clean` (exit 0). - Force-staged `keys/forgejo-test` and a stray `leak.key` → **exit 1** with the offenders listed (both cases exercised). - `npm run check:boundaries` PASS · `npm run check:links` PASS. ## Note `keys/` is a deliberately insecure, disposable convenience boundary — not a secure store. The policy and the promotion-by-replacement rule live in colibri `docs/wiki/credentials.md`. 
Adds /keys/ (root-anchored) to .gitignore for the disposable test
credential boundary, and scripts/check-secrets.sh: fails if keys/ is tracked, a
private-key-like file is tracked, a forge/jev env file is tracked, or any tracked
file carries a private-key header. Wired into npm run check:all as check:secrets.
See colibri docs/wiki/credentials.md.
clawdie deleted branch chore/keys-ignore-secret-gate 2026-10-06 10:37:34 +02:00
clawdie commented 2026-10-06 12:48:34 +02:00
Author
Owner
Copy link

Gate confirmation — full run on merged main

Re-ran the complete gate set in a clean disposable worktree at e67b49a
(the real checkout has unrelated untracked files, so a throwaway worktree was
safer than installing there).

git worktree add --detach /tmp/ws-verify origin/main
npm ci --no-audit --no-fund      # added 369 packages in 5s
npm run check:portal
npm run check:wiki
Gate Result
npm ci 369 packages, exit 0
check:portal PASS — Astro build OK; 6 pages, 6 locales, version 0.10.0 synced, zero broken local references
check:wiki PASS — Astro build OK; 10 pages; wiki.json 10 page/locale entries, 19 provenance records; locale parity, required routes, provenance, internal targets all pass
check:secrets clean (no tracked keys or credential files)
check:boundaries / check:links pass (all sites)
test:wiki 31/31 OK

Non-blocking: npm warn install-scripts esbuild@0.28.2 (postinstall: node install.js)
— both Astro builds completed regardless.

node_modules is ignored (.gitignore:5 -> node_modules/), local-only, and was
not committed; the disposable worktree was removed and the real checkout is
untouched (0 dirty). This closes the earlier astro: not found caveat — both
previously-unrun gates now pass on the merged head.

## Gate confirmation — full run on merged `main` Re-ran the complete gate set in a **clean disposable worktree** at `e67b49a` (the real checkout has unrelated untracked files, so a throwaway worktree was safer than installing there). ```sh git worktree add --detach /tmp/ws-verify origin/main npm ci --no-audit --no-fund # added 369 packages in 5s npm run check:portal npm run check:wiki ``` | Gate | Result | | --- | --- | | `npm ci` | **369 packages**, exit 0 | | `check:portal` | **PASS** — Astro build OK; 6 pages, 6 locales, version `0.10.0` synced, zero broken local references | | `check:wiki` | **PASS** — Astro build OK; 10 pages; `wiki.json` 10 page/locale entries, 19 provenance records; locale parity, required routes, provenance, internal targets all pass | | `check:secrets` | **clean** (no tracked keys or credential files) | | `check:boundaries` / `check:links` | **pass** (all sites) | | `test:wiki` | **31/31 OK** | Non-blocking: `npm warn install-scripts esbuild@0.28.2 (postinstall: node install.js)` — both Astro builds completed regardless. `node_modules` is ignored (`.gitignore:5 -> node_modules/`), local-only, and was **not committed**; the disposable worktree was removed and the real checkout is untouched (0 dirty). This closes the earlier `astro: not found` caveat — both previously-unrun gates now pass on the merged head.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
clawdie/websources!14
No description provided.