CodeIssuesDiscussionsWikiPull RequestsProjectsCommitsActionsReleasesContributorsPulse● GatesSecuritySettingsDeploymentsPipelineInsightsAgents✨ Explain✨ Ask AI✨ Workspace✨ Spec✨ Tests▓ Debt Map✨ NL Search🏛 Archaeology
Blame · Line-by-line history
gatetest.config.json
Each line is annotated with the commit that last touched it. Click any SHA to jump to that commit and see the surrounding change.
| a891b46 | 1 | { |
| 2 | "$comment": "GateTest scanner config for Gluecron.com. Sibling to the protected .gatetest.json marker file — do not merge them. Scanner reads both.", | |
| 3 | "project": { | |
| 4 | "name": "gluecron", | |
| 5 | "root": "." | |
| 6 | }, | |
| 7 | "triggers": { | |
| 8 | "pullRequest": { | |
| 9 | "enabled": true, | |
| 10 | "branchPatterns": [ | |
| 11 | "main", | |
| 12 | "master", | |
| 13 | "claude/*", | |
| 14 | "claude/**", | |
| 15 | "gatetest/*", | |
| 16 | "gatetest/**" | |
| 17 | ], | |
| 18 | "reason": "Every PR opened from agent branch prefixes (claude/*, gatetest/*) must be auto-scanned. Targets the lowercase main on Gluecron." | |
| 19 | }, | |
| 20 | "push": { | |
| 21 | "enabled": true, | |
| 22 | "branchPatterns": ["main", "master"] | |
| 23 | }, | |
| 24 | "schedule": [ | |
| 25 | { | |
| 26 | "name": "empire-smoke", | |
| 27 | "cron": "*/5 * * * *", | |
| 28 | "command": "bun run integrations/smoke/empire-smoke.ts", | |
| 29 | "reason": "Runs the cross-repo smoke harness every 5 minutes. Surfaces cert / DNS / response-code regressions before a human notices. Owned by agent 6 — ensure integrations/smoke/empire-smoke.ts exists before flipping schedule to required.", | |
| 30 | "severity": "error", | |
| 31 | "timeoutSeconds": 180, | |
| 32 | "allowMissing": true | |
| 33 | } | |
| 34 | ] | |
| 35 | }, | |
| 36 | "rules": { | |
| 37 | "schemaRegressionGate": { | |
| 38 | "enabled": true, | |
| 39 | "severity": "error", | |
| 40 | "when": { | |
| 41 | "pathsChanged": [ | |
| 42 | "src/**/*.ts", | |
| 43 | "src/**/*.tsx", | |
| 44 | "**/schema.ts", | |
| 45 | "**/schema.prisma", | |
| 46 | "**/*.types.ts", | |
| 47 | "**/types/**/*.ts" | |
| 48 | ] | |
| 49 | }, | |
| 50 | "command": "npm run typecheck --if-present", | |
| 51 | "scope": "dependents", | |
| 52 | "reason": "When exported types or DB schemas move, re-typecheck every dependent module so the ripple doesn't land silently." | |
| 53 | }, | |
| 54 | "secretLeak": { | |
| 55 | "enabled": true, | |
| 56 | "severity": "error", | |
| 57 | "scanEveryPR": true, | |
| 58 | "patterns": [ | |
| 59 | "\\.env(\\..+)?$", | |
| 60 | "\\.env\\.local$", | |
| 61 | "\\.env\\.production$", | |
| 62 | ".*\\.pem$", | |
| 63 | ".*\\.key$", | |
| 64 | "(^|/)id_rsa$", | |
| 65 | "(^|/)id_ed25519$", | |
| 66 | "(^|/)\\.pgpass$", | |
| 67 | "(^|/)credentials\\.json$", | |
| 68 | "(^|/)service-account.*\\.json$" | |
| 69 | ], | |
| 70 | "contentPatterns": [ | |
| 71 | "AKIA[0-9A-Z]{16}", | |
| 72 | "ghp_[A-Za-z0-9]{36,}", | |
| 73 | "gho_[A-Za-z0-9]{36,}", | |
| 74 | "github_pat_[A-Za-z0-9_]{80,}", | |
| 75 | "sk-ant-[A-Za-z0-9_-]{40,}", | |
| 76 | "sk-[A-Za-z0-9]{40,}", | |
| 77 | "xox[baprs]-[A-Za-z0-9-]{10,}", | |
| 78 | "-----BEGIN (RSA |OPENSSH |EC |DSA |PGP )?PRIVATE KEY-----" | |
| 79 | ], | |
| 80 | "reason": "Verify .env / *.pem / id_rsa / hardcoded tokens don't slip through." | |
| 81 | } | |
| 82 | }, | |
| 83 | "ignore": { | |
| 84 | "paths": [ | |
| 85 | "**/node_modules/**", | |
| 86 | "**/.turbo/**", | |
| 87 | "**/.vercel/**", | |
| 88 | "**/.output/**", | |
| 89 | "**/dist/**", | |
| 90 | "**/build/**", | |
| 91 | "**/*.min.js", | |
| 92 | "**/*.min.css", | |
| 93 | "**/*.map", | |
| ea52715 | 94 | "coverage/**", |
| 95 | "src/__tests__/**", | |
| 96 | "scripts/**", | |
| 97 | "cli/**", | |
| a18b6e2 | 98 | "vscode-extension/**", |
| 99 | ".claude/worktrees/**" | |
| a891b46 | 100 | ] |
| 2d46e26 | 101 | }, |
| 102 | "$comment_pre_push_severity": "The categories below are downgraded from 'error' to 'warning' for the pre-push hook. The crossFileTaint rule in particular produces 300+ false positives in a parameterized-Drizzle codebase (every db.select() flagged as a sink), and the envVars rule flags every internal env var as missing from .env.example. These are noise relative to the actual security work tracked in AUDIT-v2.md. Real issues here still surface in the GateTest UI, just don't block git push.", | |
| 103 | "severityOverrides": { | |
| 104 | "crossFileTaint": "warning", | |
| 105 | "envVars": "warning", | |
| 106 | "moneyFloat": "warning", | |
| 107 | "logPii": "warning", | |
| 108 | "cookieSecurity": "warning", | |
| 109 | "dataIntegrity": "warning", | |
| 110 | "compatibility": "warning", | |
| 111 | "documentation": "warning", | |
| 112 | "links": "warning", | |
| 113 | "codeQuality": "warning", | |
| 114 | "int": "warning", | |
| 115 | "secrets": "warning", | |
| 93bcdea | 116 | "dead-code": "warning", |
| 117 | "errorSwallow": "warning" | |
| a891b46 | 118 | } |
| 119 | } |