chore(secret-leak): bump betterleaks v1.6.1 to v1.7.0 - #110
Merged
Conversation
Upstream release tracked in the operations tracker.
v1.7.0 grows the default ruleset from 325 rules to 412 (87 new detectors, 187
now carrying validation), and the generic rule starts filtering
public-by-design credentials that reach no sensitive data. There is no
config-schema change, and scan times drop across the board.
The risk in this bump is not the schema, it is the 87 new detectors: this
workflow gates pull requests across every enrolled repo, so a version that
starts reporting new findings fails everyone's CI at once. Verified before
pinning, comparing v1.6.1 against v1.7.0:
* the canonical org base config parses on both
* the audit [extend] overlay (base + disabledRules) parses on both
* scans of three real repo trees produce byte-identical coverage and no
findings on either version
Pinned to the index digest, matching the previous pin, so the reference stays
valid on non-amd64 runners.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
WalkthroughThe reusable secret leak check workflow updates its default Betterleaks container image from the pinned v1.6.1 digest to the pinned v1.7.0 digest. ChangesBetterleaks image update
Estimated code review effort: 1 (Trivial) | ~2 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Contributor
🛡️ Security suite
Note All security checks passed. Updated for |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Bumps the default betterleaks image in
reusable-secret-leak-check.ymlfrom v1.6.1 to v1.7.0.What is in v1.7.0
--log-optsWhy this needed testing before pinning
The schema is not the risk. The 87 new detectors are. This workflow gates pull requests across every enrolled repo, so a version that starts producing findings fails everyone's CI at once, and the failures would look unrelated to whatever change is under review.
Verified locally, v1.6.1 against v1.7.0:
[extend]overlay parses (base +disabledRules)Byte counts are identical across versions, so both scanned the same surface. Trees were exported with
git archive HEADso only tracked files were scanned.The
[extend]overlay matters specifically: the weekly audit layersdisabledRules = ["generic-api-key"]on top of the fetched base, and that is the part most likely to break on a config change.Pin detail
Pinned to the index digest, matching the existing pin. Note that
docker image inspectafter a--platform linux/amd64pull returns the platform-specific manifest digest (sha256:06d60954...) rather than the index digest. Using that would work on the amd64 runners but silently break any non-amd64 caller.Follow-up
The weekly audit in the operations repo pins the same digest independently and needs the matching bump. That is a separate PR.
Summary by CodeRabbit