Skip to content

chore(betterleaks): bump v1.5.0 → v1.6.1#99

Merged
dkastl merged 1 commit into
mainfrom
chore/betterleaks-1.6.1
Jul 21, 2026
Merged

chore(betterleaks): bump v1.5.0 → v1.6.1#99
dkastl merged 1 commit into
mainfrom
chore/betterleaks-1.6.1

Conversation

@dkastl

@dkastl dkastl commented Jul 21, 2026

Copy link
Copy Markdown
Contributor

What

Bumps the pinned betterleaks version from v1.5.0 to v1.6.1 in the two places that must move together:

  • .github/workflows/reusable-secret-leak-check.yml — the betterleaks-image default digest (sha256:7a43a20d…291f1, resolved from the v1.6.1 tag on ghcr.io).
  • betterleaks/.pre-commit-config.example.yaml — the matching rev: v1.6.1 so local pre-commit and CI use identical rule shapes.

Why

v1.6.1 is the current latest release. Highlights across v1.6.0 → v1.6.1:

  • Expr replaces CEL as the expression runtime. Existing CEL-shaped configs remain accepted for compatibility.
  • Faster cold start (lazy regex compilation + tokenizer load, 160ms → 20ms) and a smaller binary (30MB → 22.7MB).
  • Rule specificity for more accurate generic-rule suppression.
  • Adds a config command; crypto dependency bump.

Config compatibility

The org default.toml uses only [[allowlists]] with regexes/paths — no CEL/Expr expressions — so the runtime migration does not affect it. (v1.6.0 also retains CEL-config compatibility regardless.)

Verification

  • Digest resolution method verified: the same query returns the existing pinned digest for the v1.5.0 tag, so v1.6.1 → sha256:7a43a20d…291f1 is the correct multi-arch index digest.
  • Live parse of default.toml against the new image was not run here (no local Docker); the config surface is regex/path-only and unaffected, and the reusable workflow's own run will exercise it on the next PR.

Tracking: geolonia/geolonia-operations#203

@dkastl
chore(betterleaks): bump v1.5.0 -> v1.6.1
34d97f7 
Update the pinned betterleaks image digest in the reusable Secret Leak
Check workflow and the matching pre-commit example rev.

v1.6.1 highlights:
- Expr replaces CEL as the expression runtime (existing CEL configs
  still accepted for compatibility).
- Faster cold start (lazy regex/tokenizer init) and a smaller binary.
- Rule specificity for more accurate generic-rule suppression.
- Adds a config command; crypto dependency bump.

The org default.toml uses only regex/path allowlists (no CEL/Expr
expressions), so the runtime migration does not affect it.

Digest sha256:7a43a20d... resolved from the v1.6.1 tag on ghcr.io.
@coderabbitai

coderabbitai Bot commented Jul 21, 2026 •
edited
Loading

Copy link
Copy Markdown

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 34 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 5f0730a3-3db9-47f1-9306-3215d55e37e2

📥 Commits

Reviewing files that changed from the base of the PR and between 7ae6278 and 34d97f7.

📒 Files selected for processing (2)
  • .github/workflows/reusable-secret-leak-check.yml
  • betterleaks/.pre-commit-config.example.yaml
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch chore/betterleaks-1.6.1

Comment @coderabbitai help to get the list of available commands.

@github-actions

github-actions Bot commented Jul 21, 2026

Copy link
Copy Markdown
Contributor

🛡️ Security suite

Check Result
✅ Supply chain · bumblebee No exposure matches
✅ Secrets · betterleaks No secrets in diff
✅ Action pinning · pinact All actions pinned
✅ Actions audit · zizmor No findings

Note

All security checks passed.

Updated for 34d97f7 · workflow run

@dkastl
dkastl marked this pull request as ready for review July 21, 2026 22:18
@dkastl
dkastl merged commit 236b83c into main Jul 21, 2026
6 checks passed
@dkastl
dkastl deleted the chore/betterleaks-1.6.1 branch July 21, 2026 22:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@dkastl