Skip to content

chore: harden, lint, observability improvements #54

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Hardonian merged 2 commits into from
Aug 11, 2026
Merged

chore: harden, lint, observability improvements #54

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ad9e409
chore: harden repo hygiene and CI security
Aug 10, 2026
e58afeb
fix(ci): authenticate gitleaks pull-request scans
Hardonian Aug 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 21 additions & 0 deletions .github/workflows/security.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
name: Security
on:
push:
branches: [main, master]
pull_request:
branches: [main, master]

permissions:
contents: read
pull-requests: read

jobs:

@kilo-code-bot kilo-code-bot Bot Aug 11, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

WARNING: Missing explicit permissions on the workflow

The workflow doesn't set permissions, so GITHUB_TOKEN uses default permissions. For private repos, the token has write permissions by default. Since this workflow only reads code, it should explicitly set read-only permissions (e.g., permissions: contents: read).

Reply with @kilocode-bot fix it to have Kilo Code address this issue.

secret-scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- uses: gitleaks/gitleaks-action@v2
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
8 changes: 8 additions & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,3 +30,11 @@ go.work.sum
# Editor/IDE
# .idea/
# .vscode/
__pycache__/
node_modules/
build/
.pytest_cache/
.idea/
.vscode/
*.pyc
*.log
9 changes: 9 additions & 0 deletions .pre-commit-config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
repos:
- repo: local
hooks:
- id: no-plaintext-secrets
name: block plaintext secrets
entry: bash -c 'if grep -RInE "(sk_live_|sk_test_|ghp_|AIza|BEGIN RSA)" . --exclude-dir=.git --exclude-dir=node_modules --exclude-dir=vendor --exclude-dir=dist --exclude-dir=build --exclude-dir=test --exclude-dir=tests --exclude-dir=fixtures --exclude-dir=examples --exclude-dir=docs 2>/dev/null; then exit 1; fi'

@kilo-code-bot kilo-code-bot Bot Aug 11, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

WARNING: grep error handling is broken - the hook passes silently on filesystem errors

The if grep ...; then exit 1; fi pattern treats grep's exit code 2 (error, e.g., permission denied) as a non-match. With 2>/dev/null suppressing stderr, the hook will silently pass when grep encounters filesystem errors, potentially missing secrets.

Reply with @kilocode-bot fix it to have Kilo Code address this issue.

@kilo-code-bot kilo-code-bot Bot Aug 11, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

SUGGESTION: AIza pattern is overly broad and may cause false positives

AIza is only 4 characters and can appear in legitimate strings (e.g., documentation, variable names). Consider using a more specific pattern like AIza[0-9A-Za-z-_]{35} to match actual Google API key formats.

Reply with @kilocode-bot fix it to have Kilo Code address this issue.

language: system
pass_filenames: []
always_run: true
Loading