boost-skill-cli 1.0.155__tar.gz → 1.0.156__tar.gz

boost_skill_cli-1.0.156/.gitleaks.toml

@@ -0,0 +1,17 @@
+# gitleaks configuration — secret-scanning gate (see .github/workflows/ci.yml).
+#
+# Extends gitleaks' upstream default ruleset (which covers cloud keys, tokens,
+# private keys, high-entropy strings, …) and allowlists the one place boost
+# ships *synthetic* secrets on purpose: its own secret-scanner test fixtures.
+# Everything else — source, docs, real history — is scanned unmodified.
+
+title = "boost gitleaks config"
+
+[extend]
+useDefault = true
+
+[[allowlists]]
+description = "boost's own secret-scanner tests ship synthetic private keys / tokens by design (they exist to prove core/secretscan.py flags them)"
+paths = [
+    '''tests/unit/test_secretscan\.py''',
+]

{boost_skill_cli-1.0.155 → boost_skill_cli-1.0.156}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.155
+Version: 1.0.156
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.155 → boost_skill_cli-1.0.156}/boost_cli/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.0.155'
-__version_tuple__ = version_tuple = (1, 0, 155)
+__version__ = version = '1.0.156'
+__version_tuple__ = version_tuple = (1, 0, 156)
 
 __commit_id__ = commit_id = None

{boost_skill_cli-1.0.155 → boost_skill_cli-1.0.156}/boost_skill_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.155
+Version: 1.0.156
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.155 → boost_skill_cli-1.0.156}/boost_skill_cli.egg-info/SOURCES.txt

@@ -1,5 +1,6 @@
 .gitattributes
 .gitignore
+.gitleaks.toml
 CLAUDE.md
 CONTRIBUTING.md
 LICENSE
@@ -281,6 +282,7 @@ tests/unit/test_docs_pages_linked.py
 tests/unit/test_embed.py
 tests/unit/test_errors_and_cli_table.py
 tests/unit/test_frontmatter.py
+tests/unit/test_gitleaks_config.py
 tests/unit/test_gitutil.py
 tests/unit/test_imperative.py
 tests/unit/test_import_budget.py

{boost_skill_cli-1.0.155 → boost_skill_cli-1.0.156}/docs/roadmap/items/secret-scanning-gitleaks-push-protection.md

@@ -2,15 +2,15 @@
 id: secret-scanning-gitleaks-push-protection
 board: code
 section: health
-status: planned
+status: shipped
 category: Security · Secrets
 complexity: S
 impact: Med
 wow: 3
 note: pre-commit-able
 order: 4
-owner:
-pr:
+owner: loop/gitleaks
+pr: 180
 title: Secret scanning — <code>gitleaks</code> + push protection
 ---
 Scan the full history and every PR diff for leaked tokens, keys and

{boost_skill_cli-1.0.155 → boost_skill_cli-1.0.156}/docs/roadmap.html

@@ -987,7 +987,7 @@ harness.</p>
       </article>
 
       <article class="cap rcard">
-        <div class="head"><span class="pill planned">Planned</span><span class="cat">Security · Secrets</span></div>
+        <div class="head"><span class="pill shipped">Shipped</span><span class="cat">Security · Secrets</span></div>
         <h3>Secret scanning — <code>gitleaks</code> + push protection</h3>
         <p>Scan the full history and every PR diff for leaked tokens, keys and
            PyPI credentials with the free <code>gitleaks</code> action, paired

boost_skill_cli-1.0.156/tests/unit/test_gitleaks_config.py

@@ -0,0 +1,59 @@
+"""Unit test: .gitleaks.toml — the secret-scanning gate's configuration.
+
+Validates the config is well-formed and does what the CI gate relies on:
+extend the upstream default ruleset and allowlist boost's own synthetic
+secret-scanner fixtures (so the gate stays green on deliberate test data while
+still catching a real leak anywhere else).
+"""
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+import pytest
+
+_CONFIG = Path(__file__).resolve().parents[2] / ".gitleaks.toml"
+
+pytestmark = [
+    pytest.mark.skipif(not _CONFIG.exists(),
+                       reason="repo-root .gitleaks.toml not reachable (e.g. mutation sandbox)"),
+    pytest.mark.skipif(sys.version_info < (3, 11),
+                       reason="tomllib is stdlib only on Python 3.11+"),
+]
+
+
+def _load():
+    import tomllib
+    with open(_CONFIG, "rb") as f:
+        return tomllib.load(f)
+
+
+def test_is_valid_toml():
+    assert isinstance(_load(), dict)
+
+
+def test_extends_the_default_ruleset():
+    # Without useDefault the config would replace, not extend, gitleaks' rules —
+    # silently disabling every built-in detector.
+    cfg = _load()
+    assert cfg.get("extend", {}).get("useDefault") is True
+
+
+def test_allowlists_the_secretscan_fixtures():
+    cfg = _load()
+    allowlists = cfg.get("allowlists") or ([cfg["allowlist"]] if "allowlist" in cfg else [])
+    paths = [p for al in allowlists for p in al.get("paths", [])]
+    assert any("test_secretscan" in p for p in paths), (
+        "the synthetic-secret fixture file must be allowlisted or the gate "
+        "reports boost's own test data as a leak")
+
+
+def test_allowlist_does_not_blanket_ignore_tests():
+    # A too-broad `tests/` allowlist would blind the scanner to a real secret
+    # committed in any other test file. Keep it scoped to the fixture file.
+    cfg = _load()
+    allowlists = cfg.get("allowlists") or ([cfg["allowlist"]] if "allowlist" in cfg else [])
+    paths = [p for al in allowlists for p in al.get("paths", [])]
+    for p in paths:
+        assert p.rstrip("$").rstrip("/") not in ("tests", "tests/", r"tests/.*", "tests"), \
+            "allowlist path %r is too broad — scope it to the fixture file" % p