fix(security): bind Gitleaks range to live PR merge base

[seonghobae]

Problem

ContextualWisdomLab/.github#1639 exact head 6a8e8b2c279779ec7516a67ee96a02c7b9048468 failed Security Scan run 34195535497, job 101962314786.

The Gitleaks job used the pull-request event snapshot base 9330d41c92b1e6ab35261f3f5189936ea1ad8bff, which was 248 commits behind protected main@7fd571dbcdbae6acf29d8f4ee704d7ba6297e4db. Because #1639 had already integrated current main, that range rescanned merged base history and reported two generic-api-key fixtures outside the effective three-file metadata delta.

Root cause

security-scan.yml constructed event_base_sha..event_head_sha without authenticating the live PR base or deriving the current merge base. Long-lived PR event snapshots therefore turned already-merged main history into apparent PR-introduced history.

Repair

• Read and authenticate the open live PR with github.token.
• Require the canonical base repository and event exact head while keeping fork heads scannable as untrusted source.
• Fetch the live base ref and reject API/fetch races fail closed.
• Scan git merge-base(live_base, exact_head)..exact_head.
• Materialize only the authenticated live base's .gitleaks.toml; never trust PR checkout policy.
• Preserve the existing redacted SARIF and hard-gate behavior for all file types.
• Record the RCA, alternatives, risk, operator scene, and follow-up in the product/technical gap baseline and CHANGELOG fragment.

No fixture suppression, secret-rule weakening, force push, lifecycle synchronization, or unrelated metadata delta is included.

Test-first evidence

RED before implementation:

2 failed, 2 passed

Predecessor a28006ee72931f8b54b1dfcd567fdf394635ec86 was locally GREEN before the policy-boundary forward repair:

66 related tests passed
2996 passed, 1 skipped, 21 subtests passed
git diff --check: clean

A direct boundary review found and repaired an over-restrictive same-repository-head check before completion. A second RED contract proved fork PRs would have been blocked; a third RED contract proved the live PR API lacked its explicit read permission. That predecessor authenticated the canonical base plus exact head without executing fork source and granted only pull-requests: read; its executable temporary Git graph proved the stale event base was absent from the Gitleaks arguments. Pre-stack security head 0131ff9c… additionally binds scanner configuration to the authenticated live base and adds a source contract for the boundary. Its local or hosted result is non-authorizing for the stacked head. The first full stacked-tree run exposed the executable fixture's missing Actions-provided RUNNER_TEMP (1 failed, 3003 passed, 1 skipped, 21 subtests); c760ddf6… adds only that test environment binding, and the focused Gitleaks contract is 7 passed.

Lifecycle and integration

Current exact head is 0f2b318c01bfa253c8ba13dc5b474cfd4349bf04, tree cce2c06fe889a5a1c08c729bc345f4a3f326768e. It is an ordinary two-parent child of prior #2041 c51aae180f621d709163d295f1e9113671bc9585 and current canonical CodeQL successor #2040@d7bb95f6d6ca705725596df5170d6e1345080535, preserving both concurrent intents.

A history-aware merge reported clean but would have reverted valid current CodeQL files, so it was rejected before publication. The published tree instead treats exact #2040 tree 588f31d1bc499112064911070c5854d8bcaf3491 as authoritative and overlays only #2041's four Gitleaks-boundary paths. Relative to #2040, the stack is 17 commits ahead / 0 behind and its effective delta is exactly those four paths.

Focused CodeQL/Gitleaks contracts passed 139 tests; the full exact tree passed 3090 tests with 1 skip and 21 subtests; statement/branch and public-doc coverage are 100%; git diff --check is clean. The PR remains Draft/Proposed while canonical #2040 is open and its exact-head hosted checks plus qualifying independent approval remain incomplete. Fresh #2041 hosted checks and a qualifying current-head independent approval remain mandatory after the prerequisite integrates; predecessor GREEN is non-authorizing.

After this owner repair reaches protected main, rerun #1639 and verify that Gitleaks scans only its effective live-base delta. #1639 remains the canonical repository-metadata writer; this PR repairs the central security owner and does not replace or retire it.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Design-assurance repair on exact head 0131ff9ca9878c3829961b19d63fe195cb731fdd:

• P1 closed in owner source: the PR checkout can no longer supply the active .gitleaks.toml; only the authenticated live-base blob is materialized into RUNNER_TEMP.
• Added a contract that rejects checkout-config trust while preserving fork-head scanning and the live merge-base range.
• Updated the Gap baseline and CHANGELOG in the same atomic forward commit; no secret rule, fixture, or unrelated metadata delta was weakened.

This new head requires a wholly fresh Security/Python/Semgrep/CodeQL generation and independent review. Keep Proposed/Draft until those exact-head gates are terminal GREEN, then rerun the original #1639 failure after protected integration to prove that only its live-base delta is scanned.

[seonghobae]

Lifecycle concurrency audit for exact head 0131ff9ca9878c3829961b19d63fe195cb731fdd:

• event 30746307639 marked this PR Ready at 2026-09-08 10:07:54 UTC after the body was corrected to distinguish review admission from merge authority;
• that Ready event generated fresh exact-head Security/Semgrep/Python/CodeQL runs;
• event 30746474966 converted it back to Draft at 10:10:52 UTC without a source/head change;
• both events expose actor seonghobae and performed_via_github_app=null, so the GitHub event API cannot distinguish the underlying session/app;
• the current body still says the source is review-admissible and that checks/approval are merge gates, not Ready prerequisites.

No further lifecycle toggle is being made from this lane to avoid a writer loop. The second conversion has no accompanying source defect, permission defect, wrong base, or unresolved inline finding in the live record; if Draft is intentional for a different substantive reason, that reason should be recorded explicitly. Current head remains mergeable, review submissions = 0, review threads = 0.

[seonghobae]

Non-force stack repair before exact-head revalidation

#2041 head 0131ff9ca9878c3829961b19d63fe195cb731fdd and #2040 head 11f4bd96c7a2c29beef780a2c0d8a135ce05b04e share base 7fd571dbcdbae6acf29d8f4ee704d7ba6297e4db but change disjoint file sets. This parallel layout caused #2041's CodeQL dispatch to execute the superseded single-token Wake step: the native scan, SARIF gate, evidence preservation, and codeql-dispatch/python=success publication all succeeded, then job 102030509385 received HTTP 403 (workflow run containing this job is already running) from the old unconditional rerun POST.

#2040 already owns the Wake credential-chain / successful-scan compatibility delta. I will preserve both PRs and all commits by creating a normal two-parent merge commit on fix/gitleaks-live-base-merge-range, with the union tree of the two verified disjoint deltas, then retarget #2041 to fix/codeql-wake-target-app-token. This is a non-force, successor-preserving restack; no PR is closed, no history is rewritten, and #2041 remains Draft for fresh exact-head checks and independent review.

[seonghobae]

Stack parent advanced after RED→GREEN repair

#2040 advanced from 11f4bd96c7a2c29beef780a2c0d8a135ce05b04e through RED ff2f7ab4e8364cd8fcf189207c68787004974140 to GREEN e17d1e74e57789141feda99f542759dc99bde6cc. The focused wake contract first failed 2/2 for the intended returncode 0 behavior, then the full file passed 32/32 after missing/denied exact-job recovery became fail closed.

Because this PR is now based on the moving fix/codeql-wake-target-app-token branch, I will add one more normal two-parent merge commit carrying the advanced parent into this head. This preserves the existing Gitleaks four-file delta and keeps its PR diff isolated; no rewrite, closure, or lifecycle toggle.

[seonghobae]

Exact combined-tree verification update for c760ddf6fd7622f02cdcb251485b86c3f9b3b80d:

• Re-ran the complete repository suite from a worktree whose content was byte-identical to this exact remote head: GITHUB_ACTIONS=true python3 -m pytest -q -W error --basetemp=/tmp/cwl-2041-final-pytest.
• Result: 3004 passed, 1 skipped, 21 subtests passed in 211.17s.
• git diff --check c760ddf6fd7622f02cdcb251485b86c3f9b3b80d completed successfully.
• This supersedes the earlier environment-only ENOSPC run and confirms the RUNNER_TEMP executable-fixture repair on the combined fix(codeql): wake required jobs with the exchanged target app token #2040→fix(security): bind Gitleaks range to live PR merge base #2041 stack.

The PR remains Draft and merge-blocked: the exact-head hosted CodeQL workflow is still failing, and #2040 remains an unmerged prerequisite. No lifecycle toggle or merge authority is implied by the local verification.

[seonghobae]

Non-force stack reconciliation completed at exact head 50ff203027345bc6337d259bcec511cd98ab554b (tree 19880d165680f7262b58c04c963c33777c0068cc).

• ordered parents: prior fix(security): bind Gitleaks range to live PR merge base #2041 c760ddf6fd7622f02cdcb251485b86c3f9b3b80d, canonical fix(codeql): wake required jobs with the exchanged target app token #2040 a22dd5b7108698f5ae0c8dc0541c4dcc7b61abae
• fix(codeql): wake required jobs with the exchanged target app token #2040 compare: 15 ahead / 0 behind; mergeable
• effective delta remains exactly four paths: .github/workflows/security-scan.yml, the Gitleaks CHANGELOG fragment, docs/product-technical-gap-baseline.md, and tests/test_gitleaks_pr_consolidation.py
• the append-only Gap conflict preserves both the Gitleaks and CodeQL owner evidence
• focused merged-tree contracts: 402 passed
• full exact tree: 3031 passed, 1 skipped, 21 subtests passed
• statement and branch coverage: 100%; public-doc coverage: 100%; git diff --check: clean

Fresh exact-head hosted runs are CodeQL PR 34241409634, Semgrep 34241409581, Python Security 34241409659, Security Scan 34241409784, and Runtime Quality 34241409676; all were queued at publication. Ready remains review admission only. No merge, approval, auto-merge, protection bypass, manual rerun, empty push, force push, destructive rebase, or predecessor evidence transfer was performed.

[seonghobae]

P1 wrong-base lifecycle finding: exact head 50ff203027345bc6337d259bcec511cd98ab554b still targets #2040 predecessor a22dd5b7108698f5ae0c8dc0541c4dcc7b61abae, while canonical #2040 has advanced to d4a95632af9031d7a40d3cab7e78c04f87044db4. Fresh compare is ahead 15 / behind 2 / diverged, merge base a22dd5b...; the unique four-file Gitleaks boundary remains identifiable. Ordinary/non-force restack the complete four-file delta onto current #2040 and reacquire exact-head checks/review. Ready state cannot authorize a stale unprotected parent.

[seonghobae]

Concurrent prerequisite advance reconciled non-force at exact head c51aae180f621d709163d295f1e9113671bc9585 (tree ea330d5467e05a826acd0545ffd00ce742bc3c7c). Ordered parents are prior #2041 50ff203027345bc6337d259bcec511cd98ab554b and current #2040 d4a95632af9031d7a40d3cab7e78c04f87044db4. This preserves #2040's new superseded-status suppression/migration bridge and #2041's verified Gitleaks delta.

Relative to current #2040: 16 ahead / 0 behind, mergeable, exactly four effective paths. Exact merged-tree verification: focused CodeQL/Gitleaks 61 passed; full 3032 passed, 1 skipped, 21 subtests; statement/branch coverage 100%; public-doc coverage 100%; diff check clean.

Fresh runs are Runtime Quality 34243109706, Security Scan 34243109766, Semgrep 34243109758, Python Security 34243109798, and CodeQL PR 34243109771. The PR stays Draft/Proposed because canonical #2040 is Draft and exact-head CodeQL is not GREEN; the prior Ready state and checks are not transferred. No lifecycle toggle, merge, approval, auto-merge, bypass, manual rerun, empty push, force push, destructive rebase, review dismissal, or stale-evidence transfer was performed.

[seonghobae]

Exact-head non-force reconciliation evidence

The current branch is now an ordinary force=false descendant of both prior #2041 and current canonical #2040 while preserving the semantic implementation boundary.

• exact head: 0f2b318c01bfa253c8ba13dc5b474cfd4349bf04
• exact tree: cce2c06fe889a5a1c08c729bc345f4a3f326768e
• parents: prior fix(security): bind Gitleaks range to live PR merge base #2041 c51aae180f621d709163d295f1e9113671bc9585 + fix(codeql): wake required jobs with the exchanged target app token #2040 d7bb95f6d6ca705725596df5170d6e1345080535
• compare to current fix(codeql): wake required jobs with the exchanged target app token #2040: 17 ahead / 0 behind, exactly four Gitleaks paths
• PR state: Draft/Proposed, mergeable, no unresolved review thread, no current-head review

A normal history-aware merge reported clean but its result would have deleted or reverted valid current CodeQL files. That candidate was rejected before publication. The published tree uses exact #2040 tree 588f31d1bc499112064911070c5854d8bcaf3491 as the authority and overlays only #2041's intended four-path delta.

Exact-tree validation:

• focused CodeQL/Gitleaks contracts: 139 passed
• full repository: 3090 passed, 1 skipped, 21 subtests passed
• statement/branch coverage: 100%
• public-doc coverage: 100%
• Deprecation Warning error mode and git diff --check: passed

Fresh exact-head hosted runs are non-terminal and remain merge gates:

• Runtime Quality 34245990142: in progress
• SAST Semgrep 34245990154: queued
• Security Scan 34245990120: queued
• Python Security 34245990168: queued
• CodeQL PR 34245990227: queued

No merge, approval, auto-merge authorization, protection bypass, manual rerun, empty push, force push, destructive rebase, review transfer, or predecessor Close was performed.

[seonghobae]

Exact-head hosted CodeQL handoff

Fresh exact-head CodeQL PR 34245990227 is terminal failure on attempt 1, while Runtime Quality, Semgrep, Python Security, and Security Scan are terminal GREEN.

• language jobs 102128564662 (python) and 102128564825 (actions) found no authenticated terminal verdict, dispatched the exact current base/head/run tuple, and failed closed as designed;
• coordinator 102129408072 dispatched successfully;
• exact protected handler 34246569084 is queued;
• no SARIF or source finding exists yet, and no manual rerun is justified while the exact handler is pending.

The PR remains Draft/Proposed at exact head 0f2b318c01bfa253c8ba13dc5b474cfd4349bf04, base d7bb95f6d6ca705725596df5170d6e1345080535, mergeable, with zero unresolved threads and no current-head review. The four-path semantic overlay and local exact-tree GREEN remain intact, but neither predecessor nor local evidence converts this hosted failure to approval.

No lifecycle toggle, rerun, empty push, synthetic status, merge, approval, auto-merge authorization, protection bypass, force push, destructive rebase, evidence transfer, or Close was performed.