Repository navigation
Detection par la forme : retrait de la deny-list en clair - #1
Merged
Merged
Conversation
The workflow carried the full customer roster inline, each name written with one letter in parentheses. An ERE capturing group matches the same string, so the scan kept working while a full-text search for the name found nothing -- that fools GitHub's index, not a reader. The guard against leaking a client name had become the leak, and in a worse shape than a stray mention: the whole portfolio, concentrated in one file of a public repo. Detection is now by SHAPE, never by name: * scripts/check_no_client_leak.py -- copied byte-for-byte from the canonical source (Statyx/Fab-Analyze-Data-Agent@6e4a65e7, sha256 33312e7e...28cd3). Real GUIDs, real Fabric SQL endpoints and personal paths, over `git ls-files` only. Not to be edited here: a local improvement is how two repos start converging on each other instead of on the canonical copy. * scripts/check_client_denylist.py -- name matching is preserved, but the names come from the CLIENT_DENYLIST secret (or a gitignored .clientdeny). No secret: warning, build stays green. Findings print a file, a line and a hash prefix -- never the name, never the line, since public CI logs would republish it. Single-character parentheses are stripped before matching, so the obfuscation removed here cannot be reintroduced unnoticed. Colour contexts (shields.io, hex, rgb(), CSS declarations) are dropped generically, because some client names double as colour words. The canonical checker only allowlists the nil GUID, so the visibly fake repeated-digit placeholders in the task flow tripped it. The ids there are internal to that file, so they become readable slugs; edge integrity was verified (10 tasks, 11 edges, 0 orphans). .gitattributes pins LF on both scripts: core.autocrlf=true would rewrite the canonical copy on checkout and break its hash on Windows. Co-authored-by: Copilot App <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Remplace la deny-list de noms en clair par une detection par la forme.
Pourquoi
Le garde-fou anti-fuite embarquait la liste des noms a proteger, en clair, dans un fichier
suivi par git. Sur un depot public, cela publie exactement ce qu'il devait masquer.
Ce qui change
CLIENT_DENYLIST(secret GitHub Actions) ou un fichier.clientdenygitignore.chemin utilisateur personnel. Une regle morphologique ne peut pas redevenir une fuite.
.gitattributesfixeeol=lfsur le scanner partage, sinon un checkout Windowsreecrit le fichier en CRLF et invalide son empreinte publiee.
Verifications