ci(check-secrets): exclude brand favicon SVGs from kingfisher (LC-471)

Claude-Run commented

2026-06-26 09:44:31 +02:00

Member

The LC-470 landing-page redesign rebuilt server/assets/favicon.svg and favicon-dot.svg as an SVG wrapping a base64-encoded PNG raster. A substring of that base64 blob (CIo5WSqz7HzuYM41D1E0cwpOXjiVktTfRru) matches the KINGFISHER.CRATESIO.1 rule, so kingfisher reports it as a (false-positive) crates.io API key and exits non-zero, failing check-secrets.yml on every commit since b6a4261. TruffleHog (--only-verified) and Nosey Parker do not flag it; kingfisher is the only failing job.

Add both brand assets to kingfisher's existing --exclude list, alongside .sops.yaml and the *-secrets globs, with a comment naming the false positive. The path exclude also covers the files' history blobs, so --git-history full stays green. These are bundled brand images, not a secret-bearing surface, so excluding them from secret scanning carries no real risk.

#LC-471

Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com

The LC-470 landing-page redesign rebuilt server/assets/favicon.svg and favicon-dot.svg as an SVG wrapping a base64-encoded PNG raster. A substring of that base64 blob (CIo5WSqz7HzuYM41D1E0cwpOXjiVktTfRru) matches the KINGFISHER.CRATESIO.1 rule, so kingfisher reports it as a (false-positive) crates.io API key and exits non-zero, failing check-secrets.yml on every commit since b6a4261. TruffleHog (--only-verified) and Nosey Parker do not flag it; kingfisher is the only failing job. Add both brand assets to kingfisher's existing --exclude list, alongside .sops.yaml and the *-secrets globs, with a comment naming the false positive. The path exclude also covers the files' history blobs, so --git-history full stays green. These are bundled brand images, not a secret-bearing surface, so excluding them from secret scanning carries no real risk. #LC-471 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Claude-Run added 1 commit

2026-06-26 09:44:31 +02:00

ci(check-secrets): exclude brand favicon SVGs from kingfisher (LC-471)

check-secrets / Nosey parker (push) Successful in 3s

Details

check-secrets / Nosey parker (pull_request) Successful in 6s

Details

check-secrets / TruffleHog (push) Successful in 4s

Details

check-secrets / TruffleHog (pull_request) Successful in 7s

Details

check-secrets / Kingfisher (push) Successful in 8s

Details

check-secrets / Kingfisher (pull_request) Successful in 9s

Details

Check / clippy + fmt + tests (pull_request) Failing after 2m30s

Details

9700d271c2

The LC-470 landing-page redesign rebuilt server/assets/favicon.svg and favicon-dot.svg as an SVG wrapping a base64-encoded PNG raster. A substring of that base64 blob (CIo5WSqz7HzuYM41D1E0cwpOXjiVktTfRru) matches the KINGFISHER.CRATESIO.1 rule, so kingfisher reports it as a (false-positive) crates.io API key and exits non-zero, failing check-secrets.yml on every commit since b6a4261. TruffleHog (--only-verified) and Nosey Parker do not flag it; kingfisher is the only failing job.

Add both brand assets to kingfisher's existing --exclude list, alongside .sops.yaml and the *-secrets globs, with a comment naming the false positive. The path exclude also covers the files' history blobs, so --git-history full stays green. These are bundled brand images, not a secret-bearing surface, so excluding them from secret scanning carries no real risk.

#LC-471

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

vas2000-work added 1 commit

2026-06-28 00:45:28 +02:00