Skip to content

ci: mark deliberate secret-shaped test fixtures for rust-secrets #81

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hyperpolymath merged 1 commit into from
Jul 21, 2026
Merged

ci: mark deliberate secret-shaped test fixtures for rust-secrets #81

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion benches/oracle_bench.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,7 +66,7 @@ fn secret_proposal() -> Proposal {
action_type: ActionType::CreateFile {
path: "src/config.rs".to_string(),
},
content: r#"let api_key = "supersecretkey12345""#.to_string(),
content: r#"let api_key = "supersecretkey12345""#.to_string(), // scanner-allow: rust-secrets
files_affected: vec!["src/config.rs".to_string()],
llm_confidence: 0.9,
}
Expand Down
2 changes: 1 addition & 1 deletion src/contract/src/lib.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1565,7 +1565,7 @@ mod tests {
let runner = ContractRunner::new();
let request = GatingRequest::new(create_proposal(
"config.rs",
r#"let password = "supersecret123456""#,
r#"let password = "supersecret123456""#, // scanner-allow: rust-secrets
));

let decision = runner.evaluate(&request).unwrap();
Expand Down
6 changes: 3 additions & 3 deletions src/oracle/src/lib.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -729,7 +729,7 @@ mod tests {
action_type: ActionType::CreateFile {
path: "config.rs".to_string(),
},
content: r#"let password = "supersecretpassword123""#.to_string(), // test fixture
content: r#"let password = "supersecretpassword123""#.to_string(), // test fixture — scanner-allow: rust-secrets
files_affected: vec!["config.rs".to_string()],
llm_confidence: 0.9,
};
Expand Down Expand Up @@ -766,7 +766,7 @@ mod tests {
action_type: ActionType::CreateFile {
path: "main.ts".to_string(),
},
content: r#"const x: string = 'hello'; let password = "secret123""#.to_string(),
content: r#"const x: string = 'hello'; let password = "secret123""#.to_string(), // scanner-allow: rust-secrets
files_affected: vec!["main.ts".to_string()],
llm_confidence: 0.9,
};
Expand Down Expand Up @@ -1048,7 +1048,7 @@ mod tests {
action_type: ActionType::CreateFile {
path: "config.rs".to_string(),
},
content: r#"const API_KEY = "abcdef1234567890abcdef""#.to_string(), // test fixture
content: r#"const API_KEY = "abcdef1234567890abcdef""#.to_string(), // test fixture — scanner-allow: rust-secrets

@github-actions github-actions Bot Jul 21, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛑 Gitleaks has detected a secret with rule-id generic-api-key in commit 2641199.
If this secret is a true positive, please rotate the secret ASAP.

If this secret is a false positive, you can add the fingerprint below to your .gitleaksignore file and commit the change to this branch.

echo 2641199e6d4d6eb56e00176901baf82244b97beb:src/oracle/src/lib.rs:generic-api-key:1051 >> .gitleaksignore

files_affected: vec!["config.rs".to_string()],
llm_confidence: 0.9,
};
Expand Down
2 changes: 1 addition & 1 deletion tests/gating_pipeline_test.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,7 +78,7 @@ fn e2e_hardcoded_secret_blocked() {
let runner = ContractRunner::new();
let proposal = create_proposal(
"config.rs",
r#"const password = "supersecretpassword123456789abcde""#,
r#"const password = "supersecretpassword123456789abcde""#, // scanner-allow: rust-secrets
);
let request = GatingRequest::new(proposal);

Expand Down
2 changes: 1 addition & 1 deletion tests/security_aspect_test.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -309,7 +309,7 @@ fn security_forbidden_pattern_detection() {

// Test secret patterns
let secret_patterns = vec![
r#"password = "thisisasecret123456""#,
r#"password = "thisisasecret123456""#, // scanner-allow: rust-secrets

@github-actions github-actions Bot Jul 21, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛑 Gitleaks has detected a secret with rule-id generic-api-key in commit 2641199.
If this secret is a true positive, please rotate the secret ASAP.

If this secret is a false positive, you can add the fingerprint below to your .gitleaksignore file and commit the change to this branch.

echo 2641199e6d4d6eb56e00176901baf82244b97beb:tests/security_aspect_test.rs:generic-api-key:312 >> .gitleaksignore

r#"secret = "thisisasecret123456""#,
r#"api_key = "thisisasecret123456""#,
];
Expand Down
Loading