[napetrov]

Summary

Two new workflows, a pre-commit hook, and a Renovate group that keeps the hook and the CI pin on the same gitleaks version. ci.yml changes in one line: its pre-commit step skips the new hook, which only checks staged changes.

 .github/
 ├── workflows/
+│   ├── gitleaks.yml     # PR: commits over origin/main; push to main: all history
+│   ├── scorecard.yml    # push to main, weekly, branch_protection_rule -> SARIF + published score
 │   └── ci.yml           # pre-commit step: SKIP += gitleaks (no staged files in CI)
 └── renovate.json5       # regex manager for GITLEAKS_VERSION + "gitleaks" group (hook rev + workflow pin)
 .pre-commit-config.yaml  # + gitleaks hook (staged changes), rev frozen at v8.30.1
 README.md                # + OpenSSF Scorecard badge in the existing badge row
 dokimi/CONTRIBUTING.md   # hook list, Renovate grouping sentence

gitleaks. This uses the CLI, not gitleaks/gitleaks-action. The action needs a GITLEAKS_LICENSE secret for repos owned by an organization, and it is no longer MIT-licensed. The workflow downloads the 8.30.1 tarball and checks it against a SHA-256 written in the workflow file (the release's own checksums file comes from the same place as the tarball, so it proves nothing extra). Then:

pull_request: gitleaks git --redact --log-opts="origin/$BASE_REF..HEAD" .
push to main: gitleaks git --redact .          # all refs, about 3 s

--redact keeps secret values out of the public log. To handle a false positive, add gitleaks:allow on the line, or add a .gitleaks.toml allowlist, or put the fingerprint in .gitleaksignore for a commit already on main. The workflow header says how. No allowlist ships with this PR, because the history scan below found nothing to allowlist.

Scorecard. This is ossf/scorecard-action v2.5.0, the first release that pulls its image from ghcr.io. Older releases fail because gcr.io has been retired (Scorecard v5.6.0 release notes). The 7-day Renovate age policy would have held 2.5.0 back for one more day, but 2.4.4 no longer runs, so this PR pins 2.5.0. The workflow keeps the rules the results API enforces when results are published:

• top-level permissions: {}, with no workflow env or defaults
• id-token: write and security-events: write only in that job
• a GitHub-hosted ubuntu-latest runner (the API rejects other runners)
• steps limited to checkout, scorecard-action, upload-artifact and upload-sarif

Evidence

Full-history scan, gitleaks 8.30.1, default rules, --redact:

Scope	Commits	Findings
every ref in a full clone, plus all 91 refs/pull/*/head of intel/dokimi	1196	0
main only	276	0
working tree (gitleaks dir)	5.9 MB	0
this PR (main..HEAD)	1	0

To check that the rules actually fire, I scanned a canary file with a fake AWS key: the scan found 1 leak (aws-access-token, value printed as REDACTED). The pre-commit hook also failed on the same canary when it was staged. The hook takes about 20 s the first time (pre-commit fetches Go and builds gitleaks) and about 0.2 s per commit after that.

Scorecard v5.6.0, run locally on main @ 6e695ce (ghcr.io/ossf/scorecard:v5.6.0): 7.2 / 10

Check	Score	Reason
Binary-Artifacts	10	no binaries found
CI-Tests	10	30/30 merged PRs checked by CI
Code-Review	10	all changesets reviewed
Dangerous-Workflow	10	no dangerous patterns
Dependency-Update-Tool	10	Renovate
License	10	license file detected
SAST	10	CodeQL on all commits
Security-Policy	10	SECURITY.md
Token-Permissions	10	least privilege
Vulnerabilities	7	3 advisories: PYSEC-2026-2447 (diskcache) and PYSEC-2026-3046 (ragas), both documented in dokimi/SECURITY.md; PYSEC-2026-1845 (pytest < 9.0.3), which comes from the pytest>=7.4.0 floor, not from the lock (9.1.1)
Branch-Protection	5	PRs required, no force-push or delete; but no required status checks, 1 approval, no CODEOWNERS review, no stale-review dismissal, no last-push approval, admins exempt
Pinned-Dependencies	4	actions 39/39 and container image 1/1 pinned; pip install 1/16 by hash
Contributors	3	1 contributing org
Maintained	0	repo is younger than 90 days (this clears on its own)
CII-Best-Practices	0	no OpenSSF Best Practices badge
Fuzzing	0	not fuzzed
Packaging	n/a	no publishing workflow detected
Signed-Releases	n/a	no releases

With the new workflows, local Scorecard on this branch (--local) still gives Token-Permissions 10 and Dangerous-Workflow 10.

Cheapest next steps, none of them in this PR:

1. Repo settings (maintainer): on main's protection, require status checks (for example the static and test jobs and the gitleaks scan), require CODEOWNERS review, dismiss stale approvals, require approval of the last push, and apply the rules to admins. These raise Branch-Protection. The Action's default token may not be able to read every protection setting, so the published score can be different from this local run.
2. Register the project at bestpractices.dev (a form; the passing level). This raises CII-Best-Practices.
3. A small code change: raise the pytest floor to >=9.0.3 in requirements-test.txt and the dev extra. This clears one Vulnerabilities finding. Hash-pinning the pip install steps would raise Pinned-Dependencies, but that is a larger change.

Local checks on this branch:

• make dev then make ci-local: 0 failed, 21 passed, 4 skipped. The skips are docker, the job conditions, and semgrep. The new gitleaks / Install gitleaks and gitleaks / Scan commits rows pass.
• zizmor --offline --min-severity medium .github/workflows (1.30.1): no findings. Online --persona pedantic on the two new files flagged only one low-severity issue, missing concurrency, and I fixed it.
• pre-commit run --all-files: the new gitleaks hook and the check-* and zizmor hooks pass. ruff-check fails on 50 findings under .agent-eval/ that are already on main; CI skips that hook.
• renovate-config-validator --strict: valid.
• renovate --platform=local --dry-run=extract: extracts gitleaks/gitleaks from both .pre-commit-config.yaml (v8.30.1 + SHA) and gitleaks.yml (8.30.1).

Merge Danger

Door: two-way. Both workflows are new files, and reverting the PR removes them. One thing cannot be undone: once the first push-to-main run publishes, the score is public at api.scorecard.dev. Scorecard's weekly crawl already scores public repos, so the score was public anyway; publishing only switches it to the repo's own runs.

Blast Radius: CI

• The gitleaks scan becomes a new failing check for any PR that commits something that matches a gitleaks rule, including fake keys in tests. The fixes are listed in the workflow header. It is not a required check until a maintainer marks it as one.
• The pre-commit hook runs on every local commit for anyone with pre-commit install. A match blocks the commit, and SKIP=gitleaks bypasses it.
• When Renovate bumps gitleaks, the bump PR stays red until GITLEAKS_SHA256 is updated by hand. That is intended: there is no datasource for the tarball digest. This is documented in the workflow and in renovate.json5.
• Scorecard needs code scanning, which is already on for CodeQL. Its findings show up as code-scanning alerts in the scorecard category. Until the first run on main publishes, the README badge shows whatever the weekly crawl last recorded, or no score at all.

Checklist

• Tests added/updated and pytest passes (no package code changed; the suite passes in make ci-local)
• ruff, mypy, and schema checks pass
• Docs updated (or N/A) — see the docs-drift checklist in CONTRIBUTING.md
• No ad-hoc run artifacts committed
• New files carry the SPDX license header (or are exempt in .github/.licenserc.yaml)

🤖 Generated with Claude Code

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.12%. Comparing base (5c70cbf) to head (b92bb73).
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #118   +/-   ##
=======================================
  Coverage   91.12%   91.12%           
=======================================
  Files         212      212           
  Lines       26031    26031           
  Branches     4238     4238           
=======================================
  Hits        23721    23721           
  Misses       1643     1643           
  Partials      667      667           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

🟡 Changes recommended

Merge-only secrets can escape scanning, and offline local CI does not skip the new download-dependent job.

2 open issues

• Enable merge diffs to detect secrets in conflict resolutions · New
• Mark gitleaks as requiring network in offline CI · New

What changed in this PR

Adds secret scanning and OpenSSF Scorecard reporting to the repository’s security checks.

Changes:

• Adds gitleaks CI scanning and a staged-change pre-commit hook.
• Adds Scorecard publication and a README badge.
• Groups gitleaks version updates and documents the integration.

File	Description
README.md	Adds the Scorecard badge.
dokimi/​CONTRIBUTING.md	Documents scanning and grouped updates.
.pre-commit-config.yaml	Adds the pinned gitleaks hook.
.github/​workflows/​scorecard.yml	Publishes scores and uploads security findings.
.github/​workflows/​gitleaks.yml	Installs gitleaks and scans commit history.
.github/​workflows/​ci.yml	Skips staged-change scanning in general CI.
.github/​renovate.json5	Groups gitleaks hook and workflow updates.

_{Review effort: Balanced}

[napetrov]

Fixed in commit 9e6501b: added "gitleaks" to NEEDS_NETWORK in dokimi/scripts/ci_local.py. Regression test added: test_gitleaks_job_in_needs_network verifies the job is in the set. Now `make ci-local --offline` will skip the gitleaks job instead of failing.

[napetrov]

Already in place ("gitleaks" in NEEDS_NETWORK, ci_local.py; regression test test_gitleaks_job_in_needs_network). Re-checked on 7a86ddb: no change needed. Left open for the reviewer.

[Copilot]

🟢 Approval recommended

No unresolved blocking findings remain in the reviewed changes.

1 open issue

• Mark gitleaks as requiring network in offline CI

1 resolved since last review

• Enable merge diffs to detect secrets in conflict resolutions

_{Review effort: Balanced}

[antonwolfy]

Review at 9e6501b. The workflow, pins and Renovate wiring hold up. One thing to fix before merge: the merge-diff fix covers only the PR scan, not the push-to-main scan. One nit on the new test.

What I ran, on a Linux review host at 9e6501b:

• make ci-local: 21 passed, 0 failed, 4 skipped. The matrix legs on other Pythons were not run.
• tests/test_ci_local.py against deliberately broken copies of gitleaks.yml and ci_local.py.
• A reproduction of the merge-resolution case with the local gitleaks binary, on a throwaway repo.

Checked, no issues

• Offline skip: with "gitleaks" in NEEDS_NETWORK, ci-local --offline skips both gitleaks steps with one skip (needs network) line. Removing the entry fails test_gitleaks_job_in_needs_network.
• Scorecard workflow: top-level permissions: {}, no workflow env or defaults, id-token: write in the one job, ubuntu-latest, and only the allowed steps.
• Docs: the ci.yml SKIP list, the CONTRIBUTING.md hook list and Renovate sentence, and the "about 280 commits" figure match the tree (origin/main has 281 commits). The Renovate regex matches the GITLEAKS_VERSION: 8.30.1 line.

[Copilot]

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Copilot review overview

6 open issues

• Renovate managerFilePatterns typically expects regex strings (e.g.… · New
• BASE_REF is read from github.event.pull_request.base.ref, but this workflow also runs on push… · New
• The comment says newer runs replace older ones, but cancel-in-progress: false instead queues… · New
• Mark gitleaks as requiring network in offline CI
• This header comment lists harden-runner as an allowed step, but the workflow does not include it.… · New
• These assertions depend on an exact bash formatting string (including quoting/spacing), which makes… · New

_{Review effort: Lite}

[Copilot]

🟡 Changes recommended

Renovate matching, local scan execution, and merge-diff regression assertions need correction.

6 open issues

• Renovate regex lacks delimiters and misses workflow version · New
• Local runner skips scans due to missing github.base_ref mapping · New
• Assertions do not verify -m for each scan branch · New
• The comment says newer runs replace older ones, but cancel-in-progress: false instead queues…
• Mark gitleaks as requiring network in offline CI
• This header comment lists harden-runner as an allowed step, but the workflow does not include it.…

3 resolved since last review

• BASE_REF is read from github.event.pull_request.base.ref, but this workflow also runs on push…
• Renovate managerFilePatterns typically expects regex strings (e.g.…
• These assertions depend on an exact bash formatting string (including quoting/spacing), which makes…

_{Review effort: Balanced}

[antonwolfy]

Review at e91b0f1. The push-to-main scan now passes -m, so merge commits are scanned there too; its scope is a nit below. The regression test is still the open item, and it blocks.

What I ran, on a Linux review host at e91b0f1:

• make ci-local: 20 passed, 0 failed, 5 skipped. gitleaks / Install gitleaks passes. gitleaks / Scan commits is skipped.
• Mutation runs of tests/test_ci_local.py against six broken copies of gitleaks.yml.

I agree with @copilot-pull-request-reviewer on github.base_ref in ci_local.py and on the delimiter-free managerFilePatterns at renovate.json5:90. New evidence: make ci-local at this head prints gitleaks.yml:gitleaks / Scan commits: skip (unknown expression 'github.base_ref'), so the scan step no longer runs locally (the PR description says that row passes), and the other three managerFilePatterns entries in the file (lines 52, 67, 79) all use the /.../ form.

Still open from my earlier review:

• dokimi/tests/test_ci_local.py:380: test_gitleaks_workflow_includes_merge_diffs still passes when -m is removed from either branch, when --redact is removed, or when the if guard is flipped. pr_pattern.search(run_script) or '"' in run_script is always true, and the push regex ends in a lookahead that always matches. All six mutants (drop -m on the PR branch, drop -m on the push branch, remove --redact, flip the guard to push, reverse the range, delete the else) give 18 passed. Suggestion: run the step's script with a stub gitleaks for EVENT=pull_request and EVENT=push and assert the arguments of each run.
• .github/workflows/gitleaks.yml:69 (nit): push runs now get merge diffs, but the scope changed. In gitleaks' git source, a --log-opts value replaces its default --full-history --all, so --log-opts="-m" scans only what HEAD reaches, not every ref the fetch-depth: 0 checkout brings, while the header (lines 6-8) says "the whole history". I read this from the gitleaks source and did not run it. Suggestion, as in the thread: range=(--log-opts="-m --full-history --all").

[xaleryb]

• Ran: gitleaks 8.30.1 through the Scan commits step over the full repo history, on toy repos with merges, and with an unfetched base; the full suite, ruff, mypy, bandit and zizmor on the PR merged into main.
• -m (both ranges): a key on main allowlisted in .gitleaksignore by the fingerprint gitleaks prints. A PR branched before it, or the push scan after a --no-ff merge, reports it again under the merge SHA and fails. Expected 0. The synthetic merge SHA cannot be fingerprinted.
• Unresolvable range: BASE_REF empty or not fetched, or a shallow checkout. gitleaks logs git's error, scans 0 commits, exits 0. Expected a failure. The test did not pin the step's env: or fetch-depth.
• Pushed:
  • a5412bb --diff-merges=remerge in both ranges: conflict resolutions are still scanned, parents' lines are not reported again.
  • e3d7fd9 origin/$BASE_REF must resolve; the test expands the step's own env: and pins fetch-depth: 0.
• Left for the author: nothing blocking.

[xaleryb]

Approved at e3d7fd9. No must-fix or mid item remains after our commits, each red without its fix; full suite, ruff, mypy and bandit clean on Linux; CI green.

[napetrov]

Verified your two pushed commits on e3d7fd9 (no changes needed from my side):

1. Merge-diff -m leak (both ranges): fixed by a5412bb (--diff-merges=remerge). Parent lines are no longer reported under the merge SHA, and conflict resolutions are still scanned.
2. Unresolvable range exits 0: fixed by e3d7fd9. The step fails when origin/$BASE_REF does not resolve, and the test pins fetch-depth: 0 and expands the step's env:.

Checks on e3d7fd9: tests/test_ci_local.py 18 passed, ruff clean on the two touched files. The new test_gitleaks_scan_reports_each_line_once_under_its_own_commit fails on 7a86ddb's workflow (1 failed, 17 passed), so it covers the regression.

Nothing open on my side for this review.

🤖 Generated with Claude Code

[antonwolfy]

Review at e3d7fd9. The remerge change, the --full-history --all push scope and the unresolvable-base guard all do what the comments say, and the earlier points (merge diffs on both scans, --all, github.base_ref, the Renovate slashes) are fixed. Two things are worth fixing before merge, both inline: a test gap on the push scope and a doc claim about b/ paths.

What I ran, on a Linux review host at e3d7fd9:

• make ci-local: 21 passed, 0 failed, 4 skipped. tests/test_ci_local.py: 18 passed.
• Mutation runs of the new test against edited copies of gitleaks.yml.
• Reproductions of both inline findings with gitleaks 8.30.1 on a throwaway repo (fake AWS key).

Checked, no issues

• Merge resolutions: a key added only in a conflict resolution is found by the PR range and by the push scan. A key added in a feature commit and removed in the next one is still found, under its own commit.
• Guard: git rev-parse --verify --quiet "origin/$BASE_REF^{commit}" with || { ...; exit 1; } fails the step for an unfetched base. The test kills the mutants that drop the guard, make it exit 0, flip the event test, or drop fetch-depth: 0.
• Renovate and docs: the GITLEAKS_VERSION regex matches the workflow line, the hook rev and the workflow pin are both 8.30.1, "about 280 commits" matches (origin/main has 281), and the ci.yml SKIP list matches the hook id.
• Scorecard workflow: top-level permissions: {}, id-token: write in the one job, ubuntu-latest, only the allowed steps, every action pinned to a SHA.

[antonwolfy]

Review at 03caf62. Both earlier threads are fixed: the new test fails without --all, and the header now documents the b/<path> form. Two test gaps remain, both inline, and I'd close them before merge.

What I ran, on a Linux review host at 03caf62:

• make ci-local: 21 passed, 0 failed, 4 skipped. The skips are the same as before.
• tests/test_ci_local.py against deliberately broken copies of gitleaks.yml: 18 passed on the unmodified file.
• A reproduction of the b/ path claim with gitleaks 8.30.1 on a throwaway repo.

Checked, no issues

• Push scope: dropping --all from the push --log-opts now fails with assert 'ONLY_ON_OTHER' in {...}.
• PR leg: first-parent on the PR leg fails with assert 2 == 1.
• Header comment: a conflict-resolution finding is reported as File: b/f.txt. A .gitleaks.toml path entry ^(b/)?f\.txt$ suppresses it, and ^f\.txt$ does not.
• Test isolation: only git, bash and a stub gitleaks run, with a minimal environment, and no network.

[antonwolfy]

LGTM. Both test gaps from my last review are closed in d76df53, and nothing new turned up in the changes since 03caf62.

What I ran, on a Linux review host at d76df53:

• make ci-local: 21 passed, 0 failed, 4 skipped. The skips are the same as before (docker, job conditions, semgrep). gitleaks / Install gitleaks and gitleaks / Scan commits pass.
• tests/test_ci_local.py against deliberately broken copies of gitleaks.yml: 18 passed on the unmodified file.

Checked, no issues

• Push scan, merge-diff mode: changing the push --log-opts from --diff-merges=remerge to --diff-merges=first-parent now fails the test (1 failed, 17 passed).
• PR range: changing origin/$BASE_REF..HEAD to origin/$BASE_REF...HEAD now fails the test (1 failed, 17 passed). The new early branch makes the two forms differ.
• Other mutants: dropping --redact, and removing --diff-merges=remerge from both legs, also fail the test.
• Scope of the change: d76df53 touches only dokimi/tests/test_ci_local.py. The test runs git, bash and a stub gitleaks with a minimal environment, with no network.