feat(security-suite): single source of truth for scanner configs (phase 1: betterleaks base + pinact dedup) by dkastl · Pull Request #102 · geolonia/.github

dkastl · 2026-07-24T02:24:31Z

Phase 1 of the Security Suite single-source-of-truth consolidation (tracking issue: geolonia-operations#236).

Goal

One canonical config per scanner in geolonia/.github, fetched as the fallback; every other location fetches it or is drift-checked; repos carry no copy (except dependabot.yml, which Dependabot can only read in-repo). This PR does the geolonia/.github side for betterleaks + pinact.

Changes

betterleaks

reusable-secret-leak-check.yml: add config resolution mirroring pinact -- config-path input, then repo-local .betterleaks.toml/.github/.betterleaks.toml, then centralized fetch from config-repo (default geolonia/.github@main), then built-in defaults. New config-repo/config-ref inputs; each source logged. Under ruleset enforcement callers cannot pass inputs, so a committed repo file is the per-repo knob.
.betterleaks.toml: the single canonical base. useDefault = true (every detector on) plus universal, non-secret false-positive patterns (doc placeholders, generated build artifacts, lifted from betterleaks/default.toml). This is the per-PR fallback and the base the weekly audit will extend.

No org-wide token exceptions here (by design). Project-specific token exceptions, even public client tokens (e.g. a Mapbox pk. token), are a repository-level decision: the owning repo commits its own .betterleaks.toml so its maintainers own the call and it is not granted org-wide. This repo is public, so an org-wide token exception would also expose that decision. The repo-local auto-detect above is the mechanism for it. The header documents this so no one re-adds one.

pinact

Delete pinact/.pinact.yml: a stale 45-line duplicate missing the geolonia/* @v1 float exemption that the canonical root .pinact.yml carries. Repoint the docs to the root file, which the Action Pinning Check already fetches as its fallback, so copying it is now optional (only .github/dependabot.yml is required in-repo).

Validation

Against the pinned betterleaks v1.6.1 (per-PR) and v1.5.0 (audit) images: the base parses on both, suppresses the doc placeholders, and still catches a GitHub PAT; a Mapbox pk. token in keyword context is flagged again (no org exception); an sk. token still fails. [extend] path + disabledRules chaining (the future audit delta) verified on both versions.

minmap unblock

minmap-image-export-api is a private repo; it unblocks via its own repo-local .betterleaks.toml (PR #6, which matches on the account substring, not the key value), auto-detected by the reusable. No org-wide exception, nothing published in this public repo.

Follow-up phases (issue #236)

geolonia-operations weekly audit: fetch this base + drop generic-api-key as a one-line delta; align image to v1.6.1; fix the stale "per-PR consumes this" comment.
geolonia-backstage templates: fetch canonical dependabot.yml; stop bundling .pinact.yml; reconcile hand-synced zizmor.yml.
geolonia/.github: delete now-unused betterleaks/default.toml; add a drift-check.

Summary by CodeRabbit

New Features
- Added an org-wide baseline for secret scanning with expanded allowlists for common placeholder patterns and generated build artifacts.
- Improved the reusable secret-leak check to automatically resolve and apply the most appropriate configuration, with safe fallback behavior when none is found locally.
Documentation
- Updated GitHub Actions pinning guidance to use canonical configuration files from the repository root and clarified fallback behavior for optional local files.
Chores
- Removed the outdated org-specific pinning configuration.

…eline Give the reusable secret-leak check the same config-resolution contract as reusable-pinact-check.yml, so it works as a truly reusable, ruleset-enforced Security Suite gate. - reusable-secret-leak-check.yml: add a "Resolve betterleaks config" step with priority order: explicit config-path input, repo-local .betterleaks.toml (or .github/.betterleaks.toml), centralized baseline fetched from config-repo (default geolonia/.github), then built-in defaults. Adds config-repo / config-ref inputs; each source is logged. Under ruleset enforcement callers cannot pass inputs, so a committed repo-root file is the per-repo customization surface. - .betterleaks.toml: org-wide baseline. useDefault = true keeps every detector on; a narrowly scoped allowlist suppresses Mapbox public (pk.) tokens, which are client-side and safe by design. Secret (sk.) tokens are not allowlisted. Validated against the pinned betterleaks v1.6.1 image: the baseline parses, suppresses a pk. token (caught by generic-api-key by default), and still catches a GitHub PAT.

coderabbitai · 2026-07-24T02:24:39Z

Walkthrough

Adds a canonical Betterleaks baseline with dynamic workflow resolution and updates pinact configuration guidance. The pinact directory configuration is removed, while documentation now describes the repository-root fallback and helper files.

Changes

Configuration governance

Layer / File(s)	Summary
Betterleaks baseline configuration `.betterleaks.toml`	Defines default rules, allowlists for documented placeholders and example tokens, and exclusions for generated bundle artifacts.
Workflow configuration resolution `.github/workflows/reusable-secret-leak-check.yml`	Adds configuration precedence documentation and inputs, resolves explicit, local, centralized, or built-in configuration, and passes the resolved path to Betterleaks.
Pinact setup and fallback guidance `docs/github-actions-pinning.md`, `docs/workflows/pinact-check.md`, `pinact/.pinact.yml`	Updates setup instructions for the repository-root `.pinact.yml`, documents its optional fallback behavior, and identifies helper files under `pinact/`.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant GitHubActionsWorkflow
  participant LocalRepository
  participant GitHubAPI
  participant Betterleaks
  GitHubActionsWorkflow->>LocalRepository: Check explicit and repository-local config
  GitHubActionsWorkflow->>GitHubAPI: Fetch centralized .betterleaks.toml when needed
  GitHubAPI-->>GitHubActionsWorkflow: Return config content or failure
  GitHubActionsWorkflow->>Betterleaks: Run scan with resolved config path

Possibly related issues

geolonia/geolonia-operations#236 — Adds the canonical Betterleaks fallback and updates pinact configuration and documentation as described by the issue.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly names the security-suite config consolidation and the phase-1 betterleaks/pinact changes.
Description check	✅ Passed	The description covers summary, goals, changes, validation, and follow-up work; only the optional checklist/related-issues sections are omitted.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch feat/betterleaks-central-config

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-07-24T02:25:00Z

🛡️ Security suite

Check	Result
✅ Supply chain · `bumblebee`	No exposure matches
✅ Secrets · `betterleaks`	No secrets in diff
✅ Action pinning · `pinact`	All actions pinned
✅ Actions audit · `zizmor`	No findings

Note

All security checks passed.

_{Updated for c1f2130 · workflow run}

@v1

…up pinact One source of truth per scanner for the Security Suite. - .betterleaks.toml: expand into the single canonical base. Absorb the allowlist entries currently in betterleaks/default.toml (doc placeholders, example UUIDs, minified-bundle paths, client_id:client_secret, truncated-JWT) alongside the Mapbox pk. entry, with useDefault = true and generic-api-key left ON. This is the per-PR fallback and the base the weekly audit will extend (the audit disables generic-api-key as a one-line delta). Validated on betterleaks v1.5.0 and v1.6.1: Mapbox pk. and placeholders are suppressed, a GitHub PAT still fires. - Delete pinact/.pinact.yml, a stale 45-line duplicate missing the geolonia/* @v1 float exemption that the canonical root .pinact.yml carries. Repoint the docs to the root .pinact.yml, which the Action Pinning Check already fetches as its fallback, so copying it is now optional.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/workflows/pinact-check.md`:
- Around line 36-39: Update the setup guidance in the documentation so only
.github/dependabot.yml is described as required; consistently label .pinact.yml
as optional wherever the page lists or instructs users to copy the root files,
while preserving its fallback-fetch behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 6d3c306a-37e1-478a-acd8-dbf5a12d1585

📥 Commits

Reviewing files that changed from the base of the PR and between 06c2d7f and 3ab3e0b.

📒 Files selected for processing (5)

.betterleaks.toml
.github/workflows/reusable-secret-leak-check.yml
docs/github-actions-pinning.md
docs/workflows/pinact-check.md
pinact/.pinact.yml

💤 Files with no reviewable changes (1)

pinact/.pinact.yml

…po-level A real, in-use token exception is a repository-level decision the maintainers own, not a silent org-wide exemption baked into the public config. The repo-local .betterleaks.toml auto-detect (already in this PR) is how a repo makes and owns that call. - .betterleaks.toml: remove the Mapbox pk. allowlist. The base now carries only universal, non-secret false-positive patterns (doc placeholders, build artifacts). The header now says project-specific token exceptions, even public client tokens, must live in the owning repo, not here. - docs/workflows/pinact-check.md: make setup guidance consistent. Only .github/dependabot.yml is required (Dependabot reads it in-repo); .pinact.yml is optional since the check fetches the canonical file as its fallback (addresses CodeRabbit).

dkastl changed the title ~~feat(secret-leak): centralized .betterleaks.toml resolution + org baseline~~ feat(security-suite): single source of truth for scanner configs (phase 1: betterleaks base + pinact dedup) Jul 24, 2026

dkastl marked this pull request as ready for review July 24, 2026 02:59

coderabbitai Bot reviewed Jul 24, 2026

View reviewed changes

Comment thread docs/workflows/pinact-check.md Outdated

dkastl merged commit b6b8240 into main Jul 24, 2026
6 checks passed

dkastl deleted the feat/betterleaks-central-config branch July 24, 2026 03:18

coderabbitai Bot mentioned this pull request Jul 24, 2026

refactor(secret-leak): delete duplicate betterleaks/default.toml; dependabot drop-in header #103

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(security-suite): single source of truth for scanner configs (phase 1: betterleaks base + pinact dedup)#102

feat(security-suite): single source of truth for scanner configs (phase 1: betterleaks base + pinact dedup)#102
dkastl merged 3 commits into
mainfrom
feat/betterleaks-central-config

dkastl commented Jul 24, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jul 24, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 24, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dkastl commented Jul 24, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Goal

Changes

Validation

minmap unblock

Follow-up phases (issue #236)

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

github-actions Bot commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🛡️ Security suite

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dkastl commented Jul 24, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 24, 2026 •

edited

Loading

github-actions Bot commented Jul 24, 2026 •

edited

Loading