CI: run the shared security workflow (gitleaks secret scan + dependency audit, Track Q)

OP OpenVibers committed 23 Sept 2026 · 454dc09b0d · 2 files, +20 −0

Calls OpenVibers/OpenVibe.Shared/.github/workflows/security.yml@83c998b.
.gitleaks.toml allowlists only proven false positives (test fixtures / doc placeholders), matched on path AND value.

Changes

ddiff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
iindex 04e7152..f562d51 100644
---- a/.github/workflows/ci.yml
++++ b/.github/workflows/ci.yml
@@@ -17,3 +17,6 @@ jobs:
  
        - name: contract check (openvibe-contracts)
          run: npx openvibe-contracts-check --service media --src server
++  # Secret scan (gitleaks) and dependency audit, shared by every OpenVibers repo (Track Q).
++  security:
++    uses: OpenVibers/OpenVibe.Shared/.github/workflows/security.yml@83c998b65424fb97e6f6de55ad9cc5981767e89c
ddiff --git a/.gitleaks.toml b/.gitleaks.toml
nnew file mode 100644
iindex 0000000..d3a9a94
---- /dev/null
++++ b/.gitleaks.toml
@@@ -0,0 +1,17 @@
++# gitleaks configuration, used by the shared security workflow
++# (OpenVibers/OpenVibe.Shared/.github/workflows/security.yml). The default rules stay on; every
++# allowlist below is one proven false positive, matched on path AND value so nothing else is hidden.
++[extend]
++useDefault = true
++
++[[allowlists]]
++description = "A file object key (def456-b.png) in the objects-model test"
++condition = "AND"
++paths = ['''^test/objects-model\.test\.js$''']
++regexes = ['''^def456-b\.png$''']
++
++[[allowlists]]
++description = "Throwaway app keys the local smoke test provisions for its own temporary server, and its deliberately wrong key"
++condition = "AND"
++paths = ['''^scripts/smoke-test\.sh$''']
++regexes = ['''^(smoke-[a-z]+-key-[0-9]+|wrong-key)$''']