openvibers/openvibe.tools Commits

CI: run the shared security workflow (gitleaks secret scan + dependency audit, Track Q)

OP OpenVibers committed 23 Sept 2026 · 2a0b70c314 · 2 files, +16 −0

Calls OpenVibers/OpenVibe.Shared/.github/workflows/security.yml@83c998b.
.gitleaks.toml allowlists only proven false positives (test fixtures / doc placeholders), matched on path AND value.

Changes

ddiff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
iindex 8380915..6977377 100644
---- a/.github/workflows/ci.yml
++++ b/.github/workflows/ci.yml
@@@ -20,3 +20,8 @@ jobs:
            for app in img audio docs; do
              (cd apps/$app && npx openvibe-contracts-check --service tools --src server --src ../_shared)
            done
++  # Secret scan (gitleaks) and dependency audit, shared by every OpenVibers repo (Track Q).
++  security:
++    uses: OpenVibers/OpenVibe.Shared/.github/workflows/security.yml@83c998b65424fb97e6f6de55ad9cc5981767e89c
++    with:
++      audit-fail-level: none   # report only until fixed: apps/img has 5 critical advisories (to-ico -> jimp/request chain) that need a semver-major to-ico/sharp bump
ddiff --git a/.gitleaks.toml b/.gitleaks.toml
nnew file mode 100644
iindex 0000000..ffa0335
---- /dev/null
++++ b/.gitleaks.toml
@@@ -0,0 +1,11 @@
++# gitleaks configuration, used by the shared security workflow
++# (OpenVibers/OpenVibe.Shared/.github/workflows/security.yml). The default rules stay on; every
++# allowlist below is one proven false positive, matched on path AND value so nothing else is hidden.
++[extend]
++useDefault = true
++
++[[allowlists]]
++description = "The public jwt.io sample token (sub 1234567890, iat 1516239022) prefilled in the JWT decoder demo"
++condition = "AND"
++paths = ['''^apps/gateway/public/dev\.html$''']
++regexes = ['''^eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9\.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkhvYm8iLCJpYXQiOjE1MTYyMzkwMjJ9\.''']