mirror of
https://github.com/garrytan/gstack.git
synced 2026-11-10 18:50:18 +01:00
Garry Tanandcapy-ai[bot]
6afe390244
* Add failing tests: escaped secrets pass brain sync, unchanged lines hold edits, hooks miss new families (GST-2263) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * Brain sync scans only added lines, decodes JSON strings, and its pre-commit hook uses the same scanner (GST-2263) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * Use a placeholder password in the brain sync docs example so the credential scan passes Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * Test that the brain repo pre-commit hook refuses a commit when its scanner is missing or fails Review-Finding: p1/specialist-batched#2 reader=testing Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * Brain repo hook keeps its own copy of the secret scanner, and the scan catches auth headers with escaped keys Review-Finding: v1/adversarial-native#1 reader=adversarial-native Review-Finding: v1/outside-voice#1 reader=outside-voice Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * Name the brain sync changelog fragment after its branch Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * Brain sync scans the whole staged diff again, so renamed keys and secret file names are still held (GST-2263) Review-Finding: bin/gstack-brain-secret-scan.py:111:outside-voice reader=outside-voice Review-Finding: bin/gstack-brain-secret-scan.py:104:outside-voice reader=outside-voice Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> --------- Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>