Garry Tanandcapy-ai[bot] ccc3f0fc14 Catch secrets split across lines in UTF-16 files and stop deleted binaries from blocking pushes (GST-2261) (#4261) ...

* Catch secrets split across lines in UTF-16 files and skip deleted files in the push scan (GST-2261)

Each reading of a file git calls binary is now scanned as its own text with the file's line numbers, so a keyword and its value on the next line stay neighbours. The pre-push hook diffs with --irreversible-delete, so a deleted binary's old bytes no longer fill its 64 MiB buffer.

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* Leave the landed binary-scan changelog fragment unchanged (GST-2261)

Review-Finding: changelog.d/scan-binary-files-for-secrets.md:1:release reader=core
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* List a token once when several readings of a binary file find it (GST-2261)

Review-Finding: p1/specialist-batched#1 reader=specialist-batched
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* Report a repeated token once only within one binary file, so an allowlisted token never hides another (GST-2261)

Review-Finding: p2/specialist-batched#1 reader=security
Review-Finding: p2/red-team#2 reader=red-team
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* Name the changelog fragment after the branch (GST-2261)

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* Keep the side-by-side reading of binary files so a key and its keyword in different readings still fail (GST-2261)

Review-Finding: audit/cross-family#1 reader=gpt-6.1-sol
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

---------

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

2026-11-10 02:12:29 +00:00

..

checks

Catch secrets split across lines in UTF-16 files and stop deleted binaries from blocking pushes (GST-2261) (#4261)

2026-11-10 02:12:29 +00:00

allowlist.ts

v1.92.8.0 fix(redact): env.kv reads Python, Dart and JSX source syntax as code (#3630) (#3742)

2026-11-01 01:50:36 +00:00

config.ts

v1.94.17.0 ci-carry: guard carry, jobs-mapped lanes, aliases, per-file carry of runner-skipped files, path-skipped jobs (GST-1186, GST-1189, GST-1190) (#3929)

2026-11-03 14:14:50 +00:00

context.ts

v1.93.33.0 wave(review): #3705 #3744 #3745 #3764 #3765 #3795 (#3852)

2026-11-03 01:40:07 +00:00

django.ts

v1.91.161.0 fix(pregate): Django, Dart, asset and tool-config lanes; init drafts from the repo (#3266-#3269) (#3306)

2026-10-20 01:38:26 +00:00

docs-lane.ts

fix(pregate): waive version-stamp-only manifests from the lanes check (GBRA-95) (#3461)

2026-10-26 12:14:55 +00:00

docs-only-lane.ts

Let pull requests that only change human-facing docs skip the test suites (GST-1951) (#4178)

2026-11-09 01:42:33 +00:00

environment.ts

v1.91.254.0 pregate: starter policy, benign-finding allowlist, environment vs diff failures, per-run scratch (#3480)

2026-10-26 20:17:41 +00:00

flaky-exception.ts

v1.94.9.0 feat(pregate): owner-granted flaky exception for named cases in a red run (GST-1096) (#3911)

2026-11-03 08:34:42 +00:00

head-policy.ts

ship accept: a lanes-only head policy gates the final tree; owner-granted test-lane exception (GST-1595) (#4061)

2026-11-06 10:16:00 +00:00

import-graph.ts

v1.91.348.0 pregate: map tests to dotfiles named in quoted literals (GST-246) (#3661)

2026-10-31 02:58:48 +00:00

index.ts

Stop the pre-merge check from accepting a half-finished run (GST-2194) (#4258)

2026-11-10 01:33:31 +00:00

init-draft.ts

v1.93.15.0 fix(pregate): pytest, Playwright and mixed-language runners; literals stops flagging stray digits (#3598, #3492) (#3741)

2026-11-02 19:23:49 +00:00

lane-selection.ts

test-impact: tracer and reuse keys for free tests; pregate keeps main's always-run list (GST-167 PR 2, GST-233) (#3801)

2026-11-05 00:43:21 +00:00

regate.ts

v1.91.98.0 fix: plan obligations meet repo gates; priced paid gates; machine-proved restamps (field wave C, items 14-17) (#3166)

2026-10-13 15:38:41 +00:00

remote-receipt.ts

v1.91.336.0 ship-queue: assign VERSION/CHANGELOG at merge time (changelog fragments + gstack-ship-queue land) (#3594)

2026-10-30 16:54:58 +00:00

run-check.ts

Let a repository name its own docs-only paths in its ship policy (GST-1974) (#4185)

2026-11-09 04:14:37 +00:00

run-scratch.ts

v1.91.254.0 pregate: starter policy, benign-finding allowlist, environment vs diff failures, per-run scratch (#3480)

2026-10-26 20:17:41 +00:00

runtime.ts

v1.94.44.0 fix(install): a child's install for another workflow no longer drops /ship's install verdict (GST-1233) (#3960)

2026-11-03 22:58:53 +00:00

rust.ts

v1.91.197.0 fix(pregate): Rust crate lanes and nested JS package runners (#3344, port of #3346) (#3380)

2026-10-25 06:25:53 +00:00

stamp-only.ts

fix(pregate): waive version-stamp-only manifests from the lanes check (GBRA-95) (#3461)

2026-10-26 12:14:55 +00:00

starter.ts

v1.92.35.0 fix(pregate): a timeout-only policy keeps lane verdicts, warn lanes runs the tests, [] keeps removed-test suites (GST-775) (#3792)

2026-11-01 16:28:03 +00:00

supervise.ts

v1.93.35.0 fix: pregate no longer kills a quiet test suite that is busy working (GST-1095) (#3899)

2026-11-03 01:59:44 +00:00

types.ts

v1.94.0.0 ship: CI is the one full test run (CI carry, tree cache, /ship beside CI) (#3901)

2026-11-03 04:02:41 +00:00

workflows.ts

v1.93.1.0 fix(pregate): clear --run-url accepts a reusable-workflow lane's caller run (GST-971) (#3865)

2026-11-02 14:59:10 +00:00