From d26fd6e111760a4fde265581e8b5d47be352e67e Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 7 Aug 2026 16:50:56 +0100 Subject: [PATCH] fix(secret-scanner): stage THE estate baseline, not standards' own config MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Every consumer without its own .gitleaks.toml has been failing the gitleaks gate with: FTL failed to load extended config, err: open config/gitleaks/estate-baseline.toml: no such file The reusable sparse-checked-out standards/.gitleaks.toml and copied it into the consumer as .gitleaks-estate.toml. But that file is not the baseline — it is standards' own repo config, and it CONSUMES the baseline via [extend] path = "config/gitleaks/estate-baseline.toml" `[extend] path` resolves against the PROCESS working directory (as standards' own config comments state). Inside standards that path exists; copied into a consumer it does not, so gitleaks aborts before scanning anything and the gate fails — scanning ZERO files while reporting a failure. Stage config/gitleaks/estate-baseline.toml instead. That file's own header already documents this exact staging as the intended behaviour, and it extends only gitleaks' built-in rules (useDefault = true), so it needs no path resolution in the consumer. Observed on my-lang (run 31187815519); affects every consumer repo that does not carry its own .gitleaks.toml. Co-Authored-By: Claude Opus 5 --- .github/workflows/secret-scanner-reusable.yml | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/.github/workflows/secret-scanner-reusable.yml b/.github/workflows/secret-scanner-reusable.yml index 38d3f7a4..cba2d044 100644 --- a/.github/workflows/secret-scanner-reusable.yml +++ b/.github/workflows/secret-scanner-reusable.yml @@ -165,13 +165,21 @@ jobs: ref: main path: .standards-gitleaks sparse-checkout: | - .gitleaks.toml + config/gitleaks/estate-baseline.toml sparse-checkout-cone-mode: false - name: Stage estate gitleaks baseline run: | set -euo pipefail - cp .standards-gitleaks/.gitleaks.toml .gitleaks-estate.toml + # Stage THE estate baseline, not standards' own repo config. + # standards/.gitleaks.toml is a CONSUMER of the baseline -- it carries + # `[extend] path = "config/gitleaks/estate-baseline.toml"`, and + # `[extend] path` resolves against the PROCESS working directory. Copied + # into a consumer, that path does not exist and gitleaks dies with + # FTL failed to load extended config ... no such file + # scanning nothing and failing the gate. The baseline file's own header + # documents this staging as the intended behaviour. + cp .standards-gitleaks/config/gitleaks/estate-baseline.toml .gitleaks-estate.toml # Delete the tooling checkout BEFORE scanning: otherwise the scan # walks standards' own tree and reports ITS files as the caller's. # (The Hypatia baseline job above does the same thing for the same