chore: setup pre-commit, CI secret scanning, and initial lint fixes - #25
Open
moghit-eou wants to merge 17 commits into
Open
moghit-eou wants to merge 17 commits into
moghit-eou wants to merge 17 commits into
Conversation
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
moghit-eou
force-pushed
the
feat/gitleaks-pre-commit-hook
branch
from
August 18, 2026 10:35
efe24dd to
afcc697
Compare
moghit-eou
changed the title
moghit-eou
force-pushed
the
feat/gitleaks-pre-commit-hook
branch
2 times, most recently
from
August 18, 2026 22:09
82e002d to
484d8f2
Compare
moghit-eou
force-pushed
the
feat/gitleaks-pre-commit-hook
branch
from
August 18, 2026 22:13
b69f4ee to
1a428d9
Compare
…lve, codeql-action v4)
- enable the pre-commit manager and switch hook revs to the - add a git-refs custom manager to track semgrep-rules develop head branch - add git-refs to the minimumReleaseAge cooldown list
moghit-eou
marked this pull request as ready for review
September 10, 2026 10:03
jdaln
reviewed
Sep 10, 2026
jdaln
left a comment
jdaln
left a comment
Contributor
There was a problem hiding this comment.
LGTM,
Please @KFilippopolitis check the version bumps and approve + merge after testing
Contributor
|
Let's wait for @KFilippopolitis to finish the big rework on #29 before merging this one. |
Contributor
|
Hello @moghit-eou , we will release the platform-backend tomorrow or the day after it. Please rebase with master and push the PR again in the Medical-Informatics-Platform organization. Thank you :) |
Contributor
|
@moghit-eou @KFilippopolitis has not yet pushed the new version it seems. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Started as SARIF artifact encryption, grew to cover secret scanning and dependency
pinning along the way.
Secret scanning (new)
secrets-scan.ymlrunning Gitleaks on PRs and pushes tomaster.ci/setup-tools.sh(SHA256 pinned) and to pre-commit.ci/suppress_gitleaks.tomlfor allowlisting.SARIF artifact encryption
Workflow artifacts inherit repository visibility and GitHub has no per-artifact
permissions, so raw SARIF was downloadable by anyone with read access to the repo.
gpg --symmetricbefore upload.ARTIFACT_PASSWORDis unavailable (Dependabot, Renovate,fork PRs) instead of shipping a file encrypted with an empty passphrase.
Workflow cleanup
GATE_FAIL_THRESHOLD/GATE_WARN_THRESHOLD.Supply chain
HEALTHCHECKin JSON notation.DOCKERIZE_VERSION.setup-tools.shso local and CI match.pom.xml: Spring Boot 4.0.7, Tomcat 11.0.25, Jackson 3.1.5.Before merge
Add an
ARTIFACT_PASSWORDrepository secret.Decrypt an artifact with: