From e9cd602941e1824c6d52c80cbf1e3bd6198cf773 Mon Sep 17 00:00:00 2001 From: evg-g <229170690+evg-g@users.noreply.github.com> Date: Tue, 6 Oct 2026 14:17:38 +0300 Subject: [PATCH] fix(ci): ignore the rebased fake secret; unlink localhost URLs in README The rebase merge of #20 rewrote 52380ec as 103c04e, so the reviewed fake webhook test secret no longer matched its .gitleaksignore fingerprint and the secret scan failed on main (the README's api ci badge read failing). Both fingerprints are now listed. The README's localhost addresses for a locally running API (health, Swagger UI, ReDoc) were clickable links that fail for any reader; they are now code text. Co-Authored-By: Claude Opus 5.5 --- .gitleaksignore | 5 ++++- README.md | 6 +++--- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/.gitleaksignore b/.gitleaksignore index 20c6879..ef8806e 100644 --- a/.gitleaksignore +++ b/.gitleaksignore @@ -16,5 +16,8 @@ # tests/integration/test_commit_failure.py:37 — the same fake webhook test secret "0123456789abcdef", # copied into the AURORA-3 commit-failure tests. It signs nothing outside the test process. Flagged -# by the generic-api-key rule on entropy alone; the value was replaced in a50c7f9. +# by the generic-api-key rule on entropy alone; the value was replaced later on the same branch. +# 52380ec is the commit on the PR branch; the rebase merge rewrote it as 103c04e on main, so both +# fingerprints are listed (a rebase changes the SHA, and the fingerprint carries it). 52380ec296e26e2a6ae13701064b1b611d74bd9e:tests/integration/test_commit_failure.py:generic-api-key:37 +103c04e8cd787fe0a2bc6c646562082989820287:tests/integration/test_commit_failure.py:generic-api-key:37 diff --git a/README.md b/README.md index e4e18e2..084e5db 100644 --- a/README.md +++ b/README.md @@ -62,7 +62,7 @@ make test # run the test suite make dev # start the API on http://localhost:8000 ``` -Then open http://localhost:8000/health/live. +Then open `http://localhost:8000/health/live` in your browser. ## Try the API by hand @@ -79,8 +79,8 @@ reserved `.test` TLD. | Tool | How | Notes | |---|---|---| -| **Swagger UI** | http://localhost:8000/docs | Browse every endpoint and send requests from the browser. Run `POST /api/v1/auth/login`, copy `access_token`, click *Authorize*, and paste it (just the token, no `Bearer ` prefix). Protected endpoints then send it for you; they show a lock icon. | -| **ReDoc** | http://localhost:8000/redoc | Read-only reference view of the same spec. | +| **Swagger UI** | `http://localhost:8000/docs` | Browse every endpoint and send requests from the browser. Run `POST /api/v1/auth/login`, copy `access_token`, click *Authorize*, and paste it (just the token, no `Bearer ` prefix). Protected endpoints then send it for you; they show a lock icon. | +| **ReDoc** | `http://localhost:8000/redoc` | Read-only reference view of the same spec. | | **`.http` files** | [`requests/`](requests) | The recommended way. Open in VS Code with the [REST Client](https://marketplace.visualstudio.com/items?itemName=humao.rest-client) extension (or a JetBrains IDE) and click *Send Request*. Send the login request first; later requests reuse its token automatically. See [`requests/README.md`](requests/README.md). | | **Postman** | *Import* → *Link* → `http://localhost:8000/openapi.json` (or the committed [`contracts/openapi.json`](contracts/openapi.json)) | Postman builds a collection from the spec. Call `POST /api/v1/auth/login`, then set *Authorization* → *Bearer Token* to the returned `access_token` on the collection. |