Skip to content

Commit 42e3d8d

Browse files
vincentkocvincentkoc
authored
Secrets: add inline allowlist review set (#38314)
* Secrets: add inline allowlist review set * Secrets: narrow detect-secrets file exclusions * Secrets: exclude Docker fingerprint false positive * Secrets: allowlist test and docs false positives * Secrets: refresh baseline after allowlist updates * Secrets: fix gateway chat fixture pragma * Secrets: format pre-commit config * Android: keep talk mode fixture JSON valid * Feishu: rely on client timeout injection * Secrets: allowlist provider auth test fixtures * Secrets: allowlist onboard search fixtures * Secrets: allowlist onboard mode fixture * Secrets: allowlist gateway auth mode fixture * Secrets: allowlist APNS wake test key * Secrets: allowlist gateway reload fixtures * Secrets: allowlist moonshot video fixture * Secrets: allowlist auto audio fixture * Secrets: allowlist tiny audio fixture * Secrets: allowlist embeddings fixtures * Secrets: allowlist resolve fixtures * Secrets: allowlist target registry pattern fixtures * Secrets: allowlist gateway chat env fixture * Secrets: refresh baseline after fixture allowlists * Secrets: reapply gateway chat env allowlist * Secrets: reapply gateway chat env allowlist * Secrets: stabilize gateway chat env allowlist * Secrets: allowlist runtime snapshot save fixture * Secrets: allowlist oauth profile fixtures * Secrets: allowlist compaction identifier fixture * Secrets: allowlist model auth fixture * Secrets: allowlist model status fixtures * Secrets: allowlist custom onboarding fixture * Secrets: allowlist mattermost token summary fixtures * Secrets: allowlist gateway auth suite fixtures * Secrets: allowlist channel summary fixture * Secrets: allowlist provider usage auth fixtures * Secrets: allowlist media proxy fixture * Secrets: allowlist secrets audit fixtures * Secrets: refresh baseline after final fixture allowlists * Feishu: prefer explicit client timeout * Feishu: test direct timeout precedence
1 parent 3070faf commit 42e3d8d

80 files changed

Lines changed: 363 additions & 317 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.detect-secrets.cfg‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,6 @@
77
[exclude-files]
88
# pnpm lockfiles contain lots of high-entropy package integrity blobs.
99
pattern = (^|/)pnpm-lock\.yaml$
10-
# Generated output and vendored assets.
11-
pattern = (^|/)(dist|vendor)/
12-
# Local config file with allowlist patterns.
13-
pattern = (^|/)\.detect-secrets\.cfg$
1410

1511
[exclude-lines]
1612
# Fastlane checks for private key marker; not a real key.
@@ -28,3 +24,5 @@ pattern = "talk\.apiKey"
2824
pattern = === "string"
2925
# specific optional-chaining password check that didn't match the line above.
3026
pattern = typeof remote\?\.password === "string"
27+
# Docker apt signing key fingerprint constant; not a secret.
28+
pattern = OPENCLAW_DOCKER_GPG_FINGERPRINT=

‎.pre-commit-config.yaml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ repos:
3030
- --baseline
3131
- .secrets.baseline
3232
- --exclude-files
33-
- '(^|/)(dist/|vendor/|pnpm-lock\.yaml$|\.detect-secrets\.cfg$)'
33+
- '(^|/)pnpm-lock\.yaml$'
3434
- --exclude-lines
3535
- 'key_content\.include\?\("BEGIN PRIVATE KEY"\)'
3636
- --exclude-lines
@@ -47,6 +47,8 @@ repos:
4747
- '=== "string"'
4848
- --exclude-lines
4949
- 'typeof remote\?\.password === "string"'
50+
- --exclude-lines
51+
- "OPENCLAW_DOCKER_GPG_FINGERPRINT="
5052
# Shell script linting
5153
- repo: https://github.com/koalaman/shellcheck-precommit
5254
rev: v0.11.0

‎.secrets.baseline‎

Lines changed: 15 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -141,7 +141,8 @@
141141
"\"gateway\\.auth\\.password\"",
142142
"\"talk\\.apiKey\"",
143143
"=== \"string\"",
144-
"typeof remote\\?\\.password === \"string\""
144+
"typeof remote\\?\\.password === \"string\"",
145+
"OPENCLAW_DOCKER_GPG_FINGERPRINT="
145146
]
146147
}
147148
],
@@ -152,14 +153,14 @@
152153
"filename": ".detect-secrets.cfg",
153154
"hashed_secret": "1348b145fa1a555461c1b790a2f66614781091e9",
154155
"is_verified": false,
155-
"line_number": 17
156+
"line_number": 13
156157
},
157158
{
158159
"type": "Secret Keyword",
159160
"filename": ".detect-secrets.cfg",
160161
"hashed_secret": "fe88fceb47e040ba1bfafa4ac639366188df2f6d",
161162
"is_verified": false,
162-
"line_number": 19
163+
"line_number": 15
163164
}
164165
],
165166
"appcast.xml": [
@@ -12387,21 +12388,14 @@
1238712388
"filename": "src/config/schema.help.ts",
1238812389
"hashed_secret": "9f4cda226d3868676ac7f86f59e4190eb94bd208",
1238912390
"is_verified": false,
12390-
"line_number": 109
12391+
"line_number": 647
1239112392
},
1239212393
{
1239312394
"type": "Secret Keyword",
1239412395
"filename": "src/config/schema.help.ts",
1239512396
"hashed_secret": "01822c8bbf6a8b136944b14182cb885100ec2eae",
1239612397
"is_verified": false,
12397-
"line_number": 130
12398-
},
12399-
{
12400-
"type": "Secret Keyword",
12401-
"filename": "src/config/schema.help.ts",
12402-
"hashed_secret": "bb7dfd9746e660e4a4374951ec5938ef0e343255",
12403-
"is_verified": false,
12404-
"line_number": 187
12398+
"line_number": 678
1240512399
}
1240612400
],
1240712401
"src/config/schema.irc.ts": [
@@ -12720,21 +12714,21 @@
1272012714
"filename": "src/infra/provider-usage.auth.normalizes-keys.test.ts",
1272112715
"hashed_secret": "45c7365e3b542cdb4fae6ec10c2ff149224d7656",
1272212716
"is_verified": false,
12723-
"line_number": 80
12717+
"line_number": 123
1272412718
},
1272512719
{
1272612720
"type": "Secret Keyword",
1272712721
"filename": "src/infra/provider-usage.auth.normalizes-keys.test.ts",
1272812722
"hashed_secret": "b67074884ab7ef7c7a8cd6a3da9565d96c792248",
1272912723
"is_verified": false,
12730-
"line_number": 81
12724+
"line_number": 124
1273112725
},
1273212726
{
1273312727
"type": "Secret Keyword",
1273412728
"filename": "src/infra/provider-usage.auth.normalizes-keys.test.ts",
1273512729
"hashed_secret": "d4d8027e64f9cf4180d3aecfe31ea409368022ee",
1273612730
"is_verified": false,
12737-
"line_number": 82
12731+
"line_number": 125
1273812732
}
1273912733
],
1274012734
"src/infra/shell-env.test.ts": [
@@ -12900,7 +12894,7 @@
1290012894
"filename": "src/media-understanding/runner.auto-audio.test.ts",
1290112895
"hashed_secret": "3acfb2c2b433c0ea7ff107e33df91b18e52f960f",
1290212896
"is_verified": false,
12903-
"line_number": 40
12897+
"line_number": 23
1290412898
}
1290512899
],
1290612900
"src/media-understanding/runner.deepgram.test.ts": [
@@ -12934,21 +12928,21 @@
1293412928
"filename": "src/memory/embeddings.test.ts",
1293512929
"hashed_secret": "a47110e348a3063541fb1f1f640d635d457181a0",
1293612930
"is_verified": false,
12937-
"line_number": 45
12931+
"line_number": 47
1293812932
},
1293912933
{
1294012934
"type": "Secret Keyword",
1294112935
"filename": "src/memory/embeddings.test.ts",
1294212936
"hashed_secret": "c734e47630dda71619c696d88381f06f7511bd78",
1294312937
"is_verified": false,
12944-
"line_number": 160
12938+
"line_number": 195
1294512939
},
1294612940
{
1294712941
"type": "Secret Keyword",
1294812942
"filename": "src/memory/embeddings.test.ts",
1294912943
"hashed_secret": "56e1d57b8db262b08bc73c60ed08d8c92e59503f",
1295012944
"is_verified": false,
12951-
"line_number": 189
12945+
"line_number": 291
1295212946
}
1295312947
],
1295412948
"src/pairing/pairing-store.ts": [
@@ -13060,7 +13054,7 @@
1306013054
"filename": "src/tui/gateway-chat.test.ts",
1306113055
"hashed_secret": "6255675480f681df08c1704b7b3cd2c49917f0e2",
1306213056
"is_verified": false,
13063-
"line_number": 85
13057+
"line_number": 60
1306413058
}
1306513059
],
1306613060
"src/web/login.test.ts": [
@@ -13100,5 +13094,5 @@
1310013094
}
1310113095
]
1310213096
},
13103-
"generated_at": "2026-02-17T13:34:38Z"
13097+
"generated_at": "2026-03-07T00:11:03Z"
1310413098
}

‎appcast.xml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -219,7 +219,7 @@
219219
</ul>
220220
<p><a href="https://github.com/openclaw/openclaw/blob/main/CHANGELOG.md">View full changelog</a></p>
221221
]]></description>
222-
<enclosure url="https://github.com/openclaw/openclaw/releases/download/v2026.3.2/OpenClaw-2026.3.2.zip" length="23181513" type="application/octet-stream" sparkle:edSignature="THMgkcoMgz2vv5zse3Po3K7l3Or2RhBKurXZIi8iYVXN76yJy1YXAY6kXi6ovD+dbYn68JKYDIKA1Ya78bO7BQ=="/>
222+
<enclosure url="https://github.com/openclaw/openclaw/releases/download/v2026.3.2/OpenClaw-2026.3.2.zip" length="23181513" type="application/octet-stream" sparkle:edSignature="THMgkcoMgz2vv5zse3Po3K7l3Or2RhBKurXZIi8iYVXN76yJy1YXAY6kXi6ovD+dbYn68JKYDIKA1Ya78bO7BQ=="/> <!-- pragma: allowlist secret -->
223223
</item>
224224
<item>
225225
<title>2026.3.1</title>
@@ -357,7 +357,7 @@
357357
</ul>
358358
<p><a href="https://github.com/openclaw/openclaw/blob/main/CHANGELOG.md">View full changelog</a></p>
359359
]]></description>
360-
<enclosure url="https://github.com/openclaw/openclaw/releases/download/v2026.3.1/OpenClaw-2026.3.1.zip" length="12804155" type="application/octet-stream" sparkle:edSignature="TF1otD4Vk3pG0iViX7mvix5DQEgAsk4JkSFvH7opjf9aawV16f29SUa2wRmiCFU6HEgyNgnGI/078O+A27eXCA=="/>
360+
<enclosure url="https://github.com/openclaw/openclaw/releases/download/v2026.3.1/OpenClaw-2026.3.1.zip" length="12804155" type="application/octet-stream" sparkle:edSignature="TF1otD4Vk3pG0iViX7mvix5DQEgAsk4JkSFvH7opjf9aawV16f29SUa2wRmiCFU6HEgyNgnGI/078O+A27eXCA=="/> <!-- pragma: allowlist secret -->
361361
</item>
362362
</channel>
363-
</rss>
363+
</rss>

‎apps/android/app/src/test/java/ai/openclaw/android/voice/TalkModeConfigParsingTest.kt‎

Lines changed: 7 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,10 @@
11
package ai.openclaw.android.voice
22

33
import kotlinx.serialization.json.Json
4+
import kotlinx.serialization.json.buildJsonObject
45
import kotlinx.serialization.json.jsonPrimitive
56
import kotlinx.serialization.json.jsonObject
7+
import kotlinx.serialization.json.put
68
import org.junit.Assert.assertEquals
79
import org.junit.Assert.assertNotNull
810
import org.junit.Assert.assertTrue
@@ -38,16 +40,12 @@ class TalkModeConfigParsingTest {
3840

3941
@Test
4042
fun fallsBackToLegacyTalkFieldsWhenNormalizedPayloadMissing() {
43+
val legacyApiKey = "legacy-key" // pragma: allowlist secret
4144
val talk =
42-
json.parseToJsonElement(
43-
"""
44-
{
45-
"voiceId": "voice-legacy",
46-
"apiKey": "legacy-key"
47-
}
48-
""".trimIndent(),
49-
)
50-
.jsonObject
45+
buildJsonObject {
46+
put("voiceId", "voice-legacy")
47+
put("apiKey", legacyApiKey) // pragma: allowlist secret
48+
}
5149

5250
val selection = TalkModeManager.selectTalkProviderConfig(talk)
5351
assertNotNull(selection)

‎apps/ios/Sources/Gateway/GatewaySettingsStore.swift‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ enum GatewaySettingsStore {
2626
private static let preferredGatewayStableIDAccount = "preferredStableID"
2727
private static let lastDiscoveredGatewayStableIDAccount = "lastDiscoveredStableID"
2828
private static let lastGatewayConnectionAccount = "lastConnection"
29-
private static let talkProviderApiKeyAccountPrefix = "provider.apiKey."
29+
private static let talkProviderApiKeyAccountPrefix = "provider.apiKey." // pragma: allowlist secret
3030

3131
static func bootstrapPersistence() {
3232
self.ensureStableInstanceID()

‎apps/ios/Tests/TalkModeConfigParsingTests.swift‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ import Testing
2323
@Test func ignoresLegacyTalkFieldsWhenNormalizedPayloadMissing() {
2424
let talk: [String: Any] = [
2525
"voiceId": "voice-legacy",
26-
"apiKey": "legacy-key",
26+
"apiKey": "legacy-key", // pragma: allowlist secret
2727
]
2828

2929
let selection = TalkModeManager.selectTalkProviderConfig(talk)

‎docs/channels/telegram.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -804,7 +804,7 @@ openclaw message poll --channel telegram --target -1001234567890:topic:42 \
804804
```yaml
805805
channels:
806806
telegram:
807-
proxy: socks5://user:pass@proxy-host:1080
807+
proxy: socks5://<user>:<password>@proxy-host:1080
808808
```
809809
810810
- Node 22+ defaults to `autoSelectFamily=true` (except WSL2) and `dnsResultOrder=ipv4first`.

‎docs/gateway/secrets.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -179,8 +179,8 @@ Request payload (stdin):
179179

180180
Response payload (stdout):
181181

182-
```json
183-
{ "protocolVersion": 1, "values": { "providers/openai/apiKey": "sk-..." } }
182+
```jsonc
183+
{ "protocolVersion": 1, "values": { "providers/openai/apiKey": "<openai-api-key>" } } // pragma: allowlist secret
184184
```
185185

186186
Optional per-id errors:

‎docs/platforms/raspberry-pi.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -197,7 +197,7 @@ See [Pi USB boot guide](https://www.raspberrypi.com/documentation/computers/rasp
197197
On lower-power Pi hosts, enable Node's module compile cache so repeated CLI runs are faster:
198198

199199
```bash
200-
grep -q 'NODE_COMPILE_CACHE=/var/tmp/openclaw-compile-cache' ~/.bashrc || cat >> ~/.bashrc <<'EOF'
200+
grep -q 'NODE_COMPILE_CACHE=/var/tmp/openclaw-compile-cache' ~/.bashrc || cat >> ~/.bashrc <<'EOF' # pragma: allowlist secret
201201
export NODE_COMPILE_CACHE=/var/tmp/openclaw-compile-cache
202202
mkdir -p /var/tmp/openclaw-compile-cache
203203
export OPENCLAW_NO_RESPAWN=1

0 commit comments

Comments
 (0)