From 18f60be43eda52ec4f1e18e57a9828d0b64ce546 Mon Sep 17 00:00:00 2001 From: Vishal Rana Date: Tue, 18 Aug 2026 08:49:01 -0700 Subject: [PATCH] chore: prepare the repository for a public release Two things a stranger's tooling sees before they read any code. A secret scan of this repository reports twelve findings. All twelve are redaction-test fixtures: strings invented to look exactly like leaked credentials, asserted never to reach output, so that a real leak fails the test rather than passing unnoticed. Two are in internal/compose/redact_test.go today; ten are in internal/onebox/memory_test.go, which was deleted in 7ad7671 but stays reachable in history. Nothing is wrong, but "twelve leaks found" is what anyone pointing a scanner at this repository will see first, and explaining that twelve times is worse than listing them once. .gitleaksignore lists them by fingerprint rather than by path, so it cannot quietly widen: a genuine secret added to either file later produces a new fingerprint and is still reported. Both scan modes are now clean. CONTRIBUTING.md carried a code of conduct with no CODE_OF_CONDUCT.md beside it, which GitHub's community-standards check looks for and contributors look for. The file now exists, carrying the same standard in the same words rather than a second one that can drift, plus how to report conduct and what enforcement means. CONTRIBUTING links to it instead of restating it. `just check` passes. Co-Authored-By: Claude Opus 5 (1M context) --- .gitleaksignore | 35 +++++++++++++++++++++++++++++++++++ CODE_OF_CONDUCT.md | 32 ++++++++++++++++++++++++++++++++ CONTRIBUTING.md | 3 +++ 3 files changed, 70 insertions(+) create mode 100644 .gitleaksignore create mode 100644 CODE_OF_CONDUCT.md diff --git a/.gitleaksignore b/.gitleaksignore new file mode 100644 index 00000000..012e87c0 --- /dev/null +++ b/.gitleaksignore @@ -0,0 +1,35 @@ +# Redaction tests need something that looks exactly like a leaked credential, +# because what they assert is that it never reaches output. Every fingerprint +# below is an invented fixture that has never been valid anywhere, kept so that +# a real leak would fail the test rather than pass unnoticed. +# +# Listed by fingerprint rather than by path, so this cannot quietly widen into a +# blanket exemption: a genuine secret added to either file later produces a new +# fingerprint and is still reported. +# +# Two files, two states: +# internal/compose/redact_test.go present today; asserts a fake Stripe key +# never reaches rendered Compose output +# internal/onebox/memory_test.go deleted in 7ad7671; the entries remain +# because the blobs stay reachable in history +# +# Regenerate with: +# gitleaks detect --no-banner --redact -v # history +# gitleaks detect --no-banner --redact --no-git -v # working tree + +internal/compose/redact_test.go:stripe-access-token:67 +internal/compose/redact_test.go:stripe-access-token:74 + +4403ea605e13b8488545113c265f8e9536c5e3cd:internal/compose/redact_test.go:stripe-access-token:67 +4403ea605e13b8488545113c265f8e9536c5e3cd:internal/compose/redact_test.go:stripe-access-token:74 +842d7ae17ee7851987762106f83bf24f5ff641be:internal/compose/redact_test.go:stripe-access-token:67 +842d7ae17ee7851987762106f83bf24f5ff641be:internal/compose/redact_test.go:stripe-access-token:74 + +091fe5765f4e2729b682c2b5df3151e321dc960b:internal/onebox/memory_test.go:generic-api-key:189 +091fe5765f4e2729b682c2b5df3151e321dc960b:internal/onebox/memory_test.go:generic-api-key:191 +091fe5765f4e2729b682c2b5df3151e321dc960b:internal/onebox/memory_test.go:jwt:199 +091fe5765f4e2729b682c2b5df3151e321dc960b:internal/onebox/memory_test.go:private-key:200 +983b111d6290bedf7720c99e4ca921d65634b892:internal/onebox/memory_test.go:generic-api-key:189 +983b111d6290bedf7720c99e4ca921d65634b892:internal/onebox/memory_test.go:generic-api-key:191 +983b111d6290bedf7720c99e4ca921d65634b892:internal/onebox/memory_test.go:jwt:199 +983b111d6290bedf7720c99e4ca921d65634b892:internal/onebox/memory_test.go:private-key:200 diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md new file mode 100644 index 00000000..a431bb63 --- /dev/null +++ b/CODE_OF_CONDUCT.md @@ -0,0 +1,32 @@ +# Code of conduct + +Be straightforward and civil. Critique the change, not the person. + +That is the whole standard, and it is deliberately short. A longer document +would not make anyone behave better, and this project would rather state one +rule it will actually apply than enumerate cases it will not. + +## What it means in practice + +- Argue with the code, the design, or the evidence. Not with the author. +- Disagreement is welcome and expected; this project changes its mind when + someone shows it something. Contempt is not the same as disagreement. +- Say what you know, and say which part you are unsure about. A confident wrong + answer costs more than an honest question. +- Assume the person on the other side is doing their best with what they had. + +## Enforcement + +Maintainers may remove comments, close issues and pull requests, and block +accounts that make the project worse to participate in. That judgement rests +with the maintainers, and it does not require a hearing. + +To report conduct rather than a security issue, open a private report through +[GitHub's reporting flow](https://github.com/labstack/onebox/security/advisories/new) +or contact the maintainers directly. Security vulnerabilities have their own +process: see [SECURITY.md](SECURITY.md). + +## Scope + +This applies in the repository — issues, pull requests, discussions, commits and +reviews — and anywhere someone is representing the project. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index bbbebb5d..29fe2bd6 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -119,3 +119,6 @@ Do not open a public issue for a security vulnerability. See Be straightforward and civil. Critique the change, not the person. Maintainers may remove comments, close issues, and block accounts that make the project worse to participate in. + +The full text, including how to report conduct, is in +[CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md).