security: redact revoked GitLab PAT from QUICKSTART.adoc — greens the last two reds - #536
Merged
Merged
Conversation
…ces) The pasted session transcript in rhodium-standard-repositories/rhodium-pipeline/docs/QUICKSTART.adoc contained a live, write-scoped GitLab PAT 40 times. The token has now been REVOKED at GitLab (owner-confirmed 2026-07-27); this redacts all 40 occurrences to [REDACTED-REVOKED-PAT], clearing the Hypatia secret_detected findings that were deliberately left unbaselined and are the sole cause of the red Hypatia + Governance gates. Revocation (already done) is the actual remediation; a history purge is optional. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
hyperpolymath
added a commit
that referenced
this pull request
Jul 27, 2026
…tia Security Scan (#538) Greens **Hypatia Security Scan**, the last red besides the token. ## Root cause The `scan / Hypatia Neurosymbolic Analysis` job's **"Gate on baseline"** step (in `hypatia-scan-reusable.yml`) ran `apply-baseline.sh` **directly on the raw findings** — with none of the path relativization that `governance-reusable.yml` performs. Hypatia's `code_safety`/`honest_completion` modules emit **absolute** host paths (`/home/runner/work/standards/standards/…`) in `.file`, while `.hypatia-baseline.json` uses **repo-relative** paths. So those findings never matched the baseline, were treated as unbaselined, and blocked the gate — even though they're acknowledged. That's why, on the token-purge PR (#536), the Governance baseline gate **passed** but this scan gate **failed**: governance relativizes, this one didn't. ## Fix Added the identical `jq` relativization the governance gate uses (the hypatia#566 stopgap). Estate-wide — fixes the scan gate for **every** repo that commits a baseline. ## Verification - The `jq` was unit-tested: `/root/a → a`, `rel/b` unchanged, `/root → .`. - Correctness proof: the governance gate passes at the stricter `info` threshold once the token is gone, so at this gate's `high` threshold, with matching relativization, nothing unbaselined remains to block on. ## Merge order Independent of, but complementary to, **#536** (token purge). #536 greens Governance; this greens the scan gate. **Both** must land for `Hypatia Security Scan` to go green (the scan sees the live token as a real finding until #536, and sees unrelativized baselined findings until this). Together → main fully green. Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
hyperpolymath
added a commit
that referenced
this pull request
Jul 27, 2026
…536) The token redaction in #536 edited a file under the rhodium-standard-repositories spec home via the GitHub API, where no pre-commit hook runs, so the derived registry went stale by exactly one source_hash and Registry Verify turned red on main. Regenerated with scripts/build-registry.sh: one hash updated, no entries added/removed, TOPOLOGY.md unchanged; --check and scorecards --check --strict both pass. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
hyperpolymath
added a commit
that referenced
this pull request
Jul 27, 2026
… last red on main (#539) Greens **Registry Verify** — the only remaining red on main. **Cause:** #536's token redaction edited `rhodium-standard-repositories/rhodium-pipeline/docs/QUICKSTART.adoc`, which is under the `rhodium-standard-repositories` spec home. The commit went in via the GitHub API (no local pre-commit hook), so the derived registry went stale by **exactly one `source_hash`** — the RSR entry. **Fix:** regenerated with `scripts/build-registry.sh` from a fresh clone of main (`564413e82`): - one hash updated (`6a00a68f…` → `d196156c…`), no entries added/removed, `TOPOLOGY.md` unchanged - verified locally: `build-registry.sh --check` ✓ and `build-scorecards.sh --check --strict` ✓ (single-step fix this time — no scorecard fallout) With this merged, main should be **fully green** for the first time: the token reds cleared via #536+#538, and this clears the drift #536 itself introduced. **Process note for the record:** any spec-home edit made via the API bypasses the #381 pre-commit guard — the CI auto-regen bot (#381 option 2) would close that hole permanently. Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Redacts the revoked GitLab PAT from
rhodium-standard-repositories/rhodium-pipeline/docs/QUICKSTART.adoc— the last blocker keeping main red.[REDACTED-REVOKED-PAT](noglpat-prefix / high-entropy body, so it can't re-trip gitleaks or Hypatia).secret_detectedfindings that.hypatia-baseline.jsondeliberately left unbaselined (a live credential must never be baselined). With them gone, the baseline gate has nothing left to block on.Expected result: greens Hypatia Security Scan + Governance → main fully green.
History note: the token is still in git history (and was public), so revocation is the real fix and is already done. A
git filter-repo/BFG history purge is optional cleanup, not required to neutralise the now-dead credential.