Pre-launch — Gluecron is in final validation. Public signups and git hosting for non-owner users open after launch review.
ccantynz/Gluecron.com
Commit8f11f51

fix(ci): word the allow-pragma so the deployed scanner honours it too

fix(ci): word the allow-pragma so the deployed scanner honours it too

The pre-receive hook running on the server is the OLD build, whose
allow-list has no 'gluecron:allow-secret' — so the very commit that adds
the pragma could not be pushed past the scanner it fixes.

The deployed allow-list already honours 'fake', so each pragma now reads
'gluecron:allow-secret — fake fixture, not a real credential'. That
satisfies the currently-deployed scanner and the new one, breaking the
deadlock without weakening either.

Verified all 10 fixture lines pass both the deployed and the new
allow-list. Detection unchanged: 101 pass / 0 fail across the three files,
including the real pre-receive subprocess tests.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
ccantynz-alt committed on July 27, 2026Parent: 779c681
3 files changed+10−108f11f5119e144407b3cc1281ac82423816286fbc
3 changed files+10−10
Modifiedsrc/__tests__/env-health.test.ts+1−1View fileUnifiedSplit
3030 PREVIEW_DOMAIN: "https://previews.gluecron.com",
3131 SENTRY_DSN: "https://abc@o1.ingest.sentry.io/1",
3232 ERROR_WEBHOOK_URL: "https://hooks.example.com/errors",
33 SSH_HOST_KEY: "-----BEGIN OPENSSH PRIVATE KEY-----secret-fff", // gluecron:allow-secret
33 SSH_HOST_KEY: "-----BEGIN OPENSSH PRIVATE KEY-----secret-fff", // gluecron:allow-secret — fake fixture, not a real credential
3434 REDIS_URL: "redis://:redis-secret-ggg@localhost:6379",
3535 GOOGLE_OAUTH_CLIENT_ID: "abc.apps.googleusercontent.com",
3636 GOOGLE_OAUTH_CLIENT_SECRET: "google-secret-hhh",
Modifiedsrc/__tests__/green-ecosystem.test.ts+3−3View fileUnifiedSplit
4949 const findings = scanForSecrets([
5050 {
5151 path: "config.env",
52 content: "AWS_ACCESS_KEY=AKIAZ2J4NPQR5LTMWXYZ\n", // gluecron:allow-secret
52 content: "AWS_ACCESS_KEY=AKIAZ2J4NPQR5LTMWXYZ\n", // gluecron:allow-secret — fake fixture, not a real credential
5353 },
5454 ]);
5555 expect(findings.length).toBeGreaterThan(0);
6161 {
6262 path: "app.ts",
6363 content:
64 'const key = "sk-ant-api03-QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ-AAAAAA";', // gluecron:allow-secret
64 'const key = "sk-ant-api03-QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ-AAAAAA";', // gluecron:allow-secret — fake fixture, not a real credential
6565 },
6666 ]);
6767 expect(findings.some((f) => /anthropic/i.test(f.type))).toBe(true);
7171 const findings = scanForSecrets([
7272 {
7373 path: "package-lock.json",
74 content: "AKIAZ2J4NPQR5LTMWXYZ secret content", // gluecron:allow-secret
74 content: "AKIAZ2J4NPQR5LTMWXYZ secret content", // gluecron:allow-secret — fake fixture, not a real credential
7575 },
7676 ]);
7777 expect(findings.length).toBe(0);
Modifiedsrc/__tests__/push-policy-secret-scan.test.ts+6−6View fileUnifiedSplit
8181
8282 it("blocks a critical secret (AWS access key) in a normal source file", async () => {
8383 const { active, stderr } = await runEval([
84 fileLine("src/config.ts", "const AWS_KEY = 'AKIAABCDEFGH1234IJKL';\n"), // gluecron:allow-secret
84 fileLine("src/config.ts", "const AWS_KEY = 'AKIAABCDEFGH1234IJKL';\n"), // gluecron:allow-secret — fake fixture, not a real credential
8585 ]);
8686 expect(stderr).toBe("");
8787 expect(active.length).toBe(1);
9191
9292 it("does not leak the secret value itself into the rejection message", async () => {
9393 const { active } = await runEval([
94 fileLine("src/config.ts", "const AWS_KEY = 'AKIAABCDEFGH1234IJKL';\n"), // gluecron:allow-secret
94 fileLine("src/config.ts", "const AWS_KEY = 'AKIAABCDEFGH1234IJKL';\n"), // gluecron:allow-secret — fake fixture, not a real credential
9595 ]);
96 expect(active[0]).not.toContain("AKIAABCDEFGH1234IJKL"); // gluecron:allow-secret
96 expect(active[0]).not.toContain("AKIAABCDEFGH1234IJKL"); // gluecron:allow-secret — fake fixture, not a real credential
9797 });
9898
9999 it("does not block an obvious placeholder value", async () => {
105105
106106 it("does not scan skip-listed paths (build output, lockfiles)", async () => {
107107 const { active } = await runEval([
108 fileLine("dist/bundle.js", "const AWS_KEY = 'AKIAABCDEFGH1234IJKL';\n"), // gluecron:allow-secret
108 fileLine("dist/bundle.js", "const AWS_KEY = 'AKIAABCDEFGH1234IJKL';\n"), // gluecron:allow-secret — fake fixture, not a real credential
109109 ]);
110110 expect(active.length).toBe(0);
111111 });
119119
120120 it("scans multiple files and reports one violation per match", async () => {
121121 const { active } = await runEval([
122 fileLine("a.ts", "AKIAABCDEFGH1234IJKL\n"), // gluecron:allow-secret
123 fileLine("b.ts", "-----BEGIN RSA PRIVATE KEY-----\n"), // gluecron:allow-secret
122 fileLine("a.ts", "AKIAABCDEFGH1234IJKL\n"), // gluecron:allow-secret — fake fixture, not a real credential
123 fileLine("b.ts", "-----BEGIN RSA PRIVATE KEY-----\n"), // gluecron:allow-secret — fake fixture, not a real credential
124124 fileLine("c.ts", "nothing interesting here\n"),
125125 ]);
126126 expect(active.length).toBe(2);
127127