dc
0d58be975d
116c37b removed them on the grounds that a three-segment fingerprint matches
nothing. That is wrong for the mode this repo scans in: with `--no-git`, gitleaks
reports a finding as `file:rule:***` - the line number is not part of the
fingerprint - so the entries were matching, and the pipeline failed on the next
push with two findings in sas/mocks/mock-licence.json.
Measured on a clean checkout of this head, with the pinned tool
(@nogoo9/gitleaks 8.30.1-post.2) and the command the workflow runs:
with .gitleaksignore 6.10 MB scanned, no leaks found
without it 6.10 MB scanned, leaks found: 2
The 6.10 MB scan is the same figure the CI log reports, which is what makes this
comparable; my earlier check was run in a tree that still had node_modules in it,
scanned 1.05 GB, and its verdict meant nothing.
The entries stay, with the comment explaining that the pair is RSA key material
for the browser mock rather than a credential.
6 lines
277 B
Plaintext
6 lines
277 B
Plaintext
# sas/mocks/mock-licence.json holds a licence key pair for the mock estate: the
|
|
# activation key is RSA key material the browser demo decrypts with, not a
|
|
# credential for any service.
|
|
sas/mocks/mock-licence.json:generic-api-key:2
|
|
sas/mocks/mock-licence.json:generic-api-key:3
|