mirror of
https://github.com/garrytan/gstack.git
synced 2026-11-10 02:30:39 +01:00
Garry Tanandcapy-ai[bot]
910093087d
* Stop the secrets check flagging code that reads an environment variable (GST-1894) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * Keep the new secrets test rows out of the line-start credential shape Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * Give the fixture-label exemption only to files named like tests A production file such as ab-test.ts or load-test.ts matched the test-file pattern, so a weak real password in it stopped being flagged. The pattern now matches only the documented forms: *.test.*, *.spec.*, *_test.* and test_*.py. Review-Finding: p1/red-team#1 reader=red-team Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * Keep flagging a hardcoded fallback in backticks or on the next line The env-read exemption only looked for a quoted fallback on the same line, so token = opts?.env?.API_TOKEN ?? followed by a backtick literal, or by a literal wrapped onto the next line, passed the secrets check. Backtick literals now count, and the next line is read when the expression continues there. The changelog now says plainly that an ALL-CAPS literal used as the variable name still passes. Review-Finding: voices/outside-voice#1 reader=outside-voice Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * Exempt an env read only when its line has no fallback, and stop reading the next line Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * Say in the changelog that quoted lowercase env names now fail the secrets check Review-Finding: p1/red-team#1 reader=red-team Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> --------- Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
CHANGELOG fragments
A PR adds its CHANGELOG entry here as changelog.d/<branch-slug>.md: the entry text only, with no ## [x] heading, and bump: minor or bump: major front matter only when the change warrants more than a patch, and important: security|regression|data-loss|blocker only when it must reach stable within about a day (docs/releases.md#the-daily-check). It never edits VERSION, package.json's version or a released CHANGELOG section. The merge step (gstack-ship-queue land, or train land in a stamped train) assigns the version (under merge: direct, the release PR from gstack-release-stamp open does), folds every fragment into one CHANGELOG section and deletes the files. This README is skipped. See docs/ship-policy.md#changelog-fragments.