From 993c343e468b41e86926e2816db87c7d93537f4f Mon Sep 17 00:00:00 2001 From: hartsock Date: Mon, 13 Apr 2026 08:45:04 -0400 Subject: [PATCH] Fix CI: gate exercise tests, fix forbidden-pattern self-matches, drop gitleaks paid action Three safety-gate failures fixed: 1. Exercise tests (todo!() stubs) excluded from CI via --exclude ch01-exercises. Students run exercises locally; CI only validates chapter examples pass. 2. Forbidden-pattern scanner was matching CLAUDE.md and .pre-commit-config.yaml which legitimately list the patterns as documentation. Both files now excluded from the grep pipeline (matching safety-gate.yml's existing self-exclusion). 3. gitleaks/gitleaks-action@v2 now requires a paid license. Replaced with direct gitleaks CLI install (open-source, no license key needed). Co-Authored-By: Claude Opus 4.6 --- .github/workflows/safety-gate.yml | 17 +++++++++++------ .pre-commit-config.yaml | 2 +- 2 files changed, 12 insertions(+), 7 deletions(-) diff --git a/.github/workflows/safety-gate.yml b/.github/workflows/safety-gate.yml index ab58e2c..13cd906 100644 --- a/.github/workflows/safety-gate.yml +++ b/.github/workflows/safety-gate.yml @@ -21,10 +21,14 @@ jobs: with: fetch-depth: 0 + - name: Install gitleaks + run: | + GITLEAKS_VERSION="8.21.2" + curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \ + | tar xz -C /usr/local/bin gitleaks + - name: Run gitleaks - uses: gitleaks/gitleaks-action@v2 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: gitleaks detect --source . --verbose forbidden-patterns: name: Check forbidden patterns @@ -47,7 +51,8 @@ jobs: if grep -rEn "$pattern" --include='*.rs' --include='*.py' \ --include='*.toml' --include='*.yml' --include='*.yaml' \ --include='*.md' --include='*.json' --include='*.sh' \ - . 2>/dev/null | grep -v '.git/' | grep -v 'safety-gate.yml'; then + . 2>/dev/null | grep -v '.git/' | grep -v 'safety-gate.yml' \ + | grep -v 'CLAUDE.md' | grep -v '.pre-commit-config.yaml'; then echo "::error::Forbidden pattern found: $pattern" FAILED=1 fi @@ -74,5 +79,5 @@ jobs: - name: Clippy run: cargo clippy --workspace --all-targets -- -D warnings - - name: Tests - run: cargo test --workspace + - name: Tests (excluding unsolved exercises) + run: cargo test --workspace --exclude ch01-exercises diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 1c36bdc..1a74e9d 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -22,6 +22,6 @@ repos: hooks: - id: forbidden-patterns name: Check for forbidden patterns - entry: bash -c 'grep -rEn "192\.168\.[0-9]+\.[0-9]+|/home/[a-z][a-z0-9_-]+/|geforcenuc|gnuc[^a-z]|server1[^a-z]|BEGIN (RSA|DSA|EC|OPENSSH) PRIVATE KEY" --include="*.rs" --include="*.py" --include="*.toml" --include="*.yml" --include="*.yaml" --include="*.md" --include="*.json" --include="*.sh" "$@" && echo "::error::Forbidden pattern found" && exit 1 || exit 0' + entry: bash -c 'grep -rEn "192\.168\.[0-9]+\.[0-9]+|/home/[a-z][a-z0-9_-]+/|geforcenuc|gnuc[^a-z]|server1[^a-z]|BEGIN (RSA|DSA|EC|OPENSSH) PRIVATE KEY" --include="*.rs" --include="*.py" --include="*.toml" --include="*.yml" --include="*.yaml" --include="*.md" --include="*.json" --include="*.sh" "$@" | grep -v "CLAUDE.md" | grep -v ".pre-commit-config.yaml" && echo "::error::Forbidden pattern found" && exit 1 || exit 0' language: system types: [text]