mirror of
https://github.com/Significant-Gravitas/AutoGPT.git
synced 2026-04-08 03:00:28 -04:00
613978a611
### Why / What / How **Why:** We had no local pre-commit protection against accidentally committing secrets. The existing `detect-secrets` hook only ran on `pre-push`, which is too late — secrets are already in git history by that point. GitHub's push protection only covers known provider patterns and runs server-side. **What:** Adds a 3-layer defense against secret leaks: local pre-commit hooks (gitleaks + detect-secrets), and a CI workflow as a safety net. **How:** - Moved `detect-secrets` from `pre-push` to `pre-commit` stage - Added `gitleaks` as a second pre-commit hook (Go binary, faster and more comprehensive rule set) - Added `.gitleaks.toml` config with allowlists for known false positives (test fixtures, dev docker JWTs, Firebase public keys, lock files, docs examples) - Added `repo-secret-scan.yml` CI workflow using `gitleaks-action` on PRs/pushes to master/dev ### Changes 🏗️ - `.pre-commit-config.yaml`: Moved `detect-secrets` to pre-commit stage, added baseline arg, added `gitleaks` hook - `.gitleaks.toml`: New config with tuned allowlists for this repo's false positives - `.secrets.baseline`: Empty baseline for detect-secrets to track known findings - `.github/workflows/repo-secret-scan.yml`: New CI workflow running gitleaks on every PR and push ### Checklist 📋 #### For code changes: - [x] I have clearly listed my changes in the PR description - [x] I have made a test plan - [x] I have tested my changes according to the test plan: - [x] Ran `gitleaks detect --no-git` against the full repo — only `.env` files (gitignored) remain as findings - [x] Verified gitleaks catches a test secret file correctly - [x] Pre-commit hooks pass on commit (both detect-secrets and gitleaks passed) #### For configuration changes: - [x] `.env.default` is updated or already compatible with my changes - [x] `docker-compose.yml` is updated or already compatible with my changes - [x] I have included a list of my configuration changes in the PR description (under **Changes**)
37 lines
1.1 KiB
TOML
37 lines
1.1 KiB
TOML
title = "AutoGPT Gitleaks Config"
|
|
|
|
[extend]
|
|
useDefault = true
|
|
|
|
[allowlist]
|
|
description = "Global allowlist"
|
|
paths = [
|
|
# Template/example env files (no real secrets)
|
|
'''\.env\.(default|example|template)$''',
|
|
# Lock files
|
|
'''pnpm-lock\.yaml$''',
|
|
'''poetry\.lock$''',
|
|
# Secrets baseline
|
|
'''\.secrets\.baseline$''',
|
|
# Build artifacts and caches (should not be committed)
|
|
'''__pycache__/''',
|
|
'''classic/frontend/build/''',
|
|
# Docker dev setup (local dev JWTs/keys only)
|
|
'''autogpt_platform/db/docker/''',
|
|
# Load test configs (dev JWTs)
|
|
'''load-tests/configs/''',
|
|
# Test files with fake/fixture keys (_test.py, test_*.py, conftest.py)
|
|
'''(_test|test_.*|conftest)\.py$''',
|
|
# Documentation (only contains placeholder keys in curl/API examples)
|
|
'''docs/.*\.md$''',
|
|
# Firebase config (public API keys by design)
|
|
'''google-services\.json$''',
|
|
'''classic/frontend/(lib|web)/''',
|
|
]
|
|
# CI test-only encryption key (marked DO NOT USE IN PRODUCTION)
|
|
regexes = [
|
|
'''dvziYgz0KSK8FENhju0ZYi8''',
|
|
# LLM model name enum values falsely flagged as API keys
|
|
'''Llama-\d.*Instruct''',
|
|
]
|