mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-07 04:12:04 +00:00
Marc-André Bombeck
64fa65b460
Seed one account as far as the schema allows (a row of every two-ended model, every column of those rows and of the account row, the instance settings, a sharing grant), export it both ways and restore each file into a fresh account, over the live account, and from a version-1 file in the old shapes. The files, counts, parsed payload, preview, restore outcome, reported phases, audit rows, wide-event fields and every row the account holds afterwards are compared with golden copies after ids, ciphertext and run-time timestamps are normalised. Refusals, skip reports and the schema's issue list for malformed files are pinned the same way. The seed moves out of the round-trip test into a shared fixture module so both files fill the same account.
44 lines
2.0 KiB
TOML
44 lines
2.0 KiB
TOML
# Gitleaks configuration. Extends the built-in default ruleset and adds
|
|
# a project-specific allowlist for false-positives that gitleaks 8.x flags
|
|
# as "generic-api-key" inside test fixtures.
|
|
[extend]
|
|
useDefault = true
|
|
|
|
[allowlist]
|
|
description = "Project-wide ignores for test fixtures and known non-secret tokens"
|
|
|
|
paths = [
|
|
# All test files contain hardcoded fake tokens / idempotency-keys.
|
|
'''(^|/)__tests__/''',
|
|
'''\.test\.ts$''',
|
|
# Golden copies of the backup file written by the parity test: synthetic
|
|
# fixture values, and every `…Encrypted` value already opened to its text.
|
|
'''^tests/integration/__golden__/''',
|
|
# OpenAPI spec contains example tokens (`hlk_example…`) used to document the schema.
|
|
'''^docs/api/openapi\.yaml$''',
|
|
]
|
|
|
|
# Substring matches — anything matching is treated as non-secret regardless of file.
|
|
regexes = [
|
|
# Idempotency-Key request-header values are random UUIDs / opaque strings,
|
|
# not secrets. The header name itself just trips the generic-api-key rule.
|
|
'''idempotency-key''',
|
|
# Allow the placeholder prefix used in OpenAPI examples + docs.
|
|
'''hlk_example''',
|
|
# i18n caption keys for the briefing-driven trend charts are dotted message
|
|
# keys, not secrets — one trips the generic-api-key entropy heuristic.
|
|
'''insights\.trendsRow\.caption''',
|
|
# Coach cadence-suggestion label keys are dotted message keys, not secrets;
|
|
# one trips the generic-api-key entropy heuristic.
|
|
'''coach\.reminderSuggestion\.cadence''',
|
|
# Level-A mood dimension label and anchor keys are dotted message keys, not
|
|
# secrets; they sit on fields named `labelKey` / `lowAnchorKey`, and the
|
|
# generic-api-key rule reads any `*Key: "<high-entropy string>"` as a token.
|
|
'''mood\.dimension\.''',
|
|
]
|
|
|
|
# Specific commit fingerprints from prior false-positive findings (kept for reproducibility).
|
|
# Empty by default; populate via `gitleaks detect --report-path` if a future regression
|
|
# triggers the same false-positive on a stable commit hash.
|
|
stopwords = []
|