jappel/leistungsbilanz-ts
1
0
Fork 1
Code Issues 6 Pull requests Projects Releases Packages Wiki Activity Actions

chore(baseline): make prepush/weekly, scanner fix for git worktrees
Some checks failed
security-baseline / secrets (push) Has been cancelled
Details
security-baseline / node (push) Has been cancelled
Details
security-baseline / semgrep (push) Has been cancelled
Details
security-baseline / trivy (push) Has been cancelled
Details

Browse source 
Update the Test & Security Baseline from cj/security-baseline (364d756):
- make prepush runs only the checks the diff needs (scripts/security/changed_scope.py)
- make weekly = check + trivy-fs, run by the weekly cron on cj-ki
- in git worktrees gitleaks scanned 0 commits and Semgrep ignored .gitignore (.next/); fixed

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Grovy311 2026-10-16 07:25:51 +02:00
parent afd8019a7b
commit ad9ca4cae5
3 changed files with 251 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

6
AGENTS.md
View file

@ -743,7 +743,7 @@ For a normal code change run the relevant focused tests plus:
- `npm run build:web`
- `npm run typecheck:scripts`
- `npx tsc --noEmit -p tsconfig.next.json`
- `make check` before every push (see Tests & Security Baseline)
- `make prepush` before every push, full `make check` before deploy and weekly (see Tests & Security Baseline)
Use a concise imperative commit message for each completed, verified work package.
@ -758,6 +758,8 @@ Scanners (gitleaks, Semgrep, Trivy) run as Docker images; npm runs locally or in
|---------|--------------|
| `make quick` | `npm run lint` (ESLint security rules) + `npm run typecheck` + `npm test` |
| `make check` | secrets (gitleaks) + quick + Semgrep (`.semgrep/`) + `npm audit --audit-level=high` |
| `make prepush` | before every push: only the checks the diff needs (`scripts/security/changed_scope.py`: docs -> secrets only, code -> lint/test/SAST on changed files, deps -> + audit, auth/routes/schemas -> + mutation, baseline tooling -> everything) |
| `make weekly` | weekly cron on cj-ki (Mon 05:00): `make check` + Trivy, notifies only on red |
| `make mutation` | `security-mutations.toml`: removes one protection at a time, every mutation must turn a test red |
| `make vet-deps PKGS="npm:name"` | checks a new package before it is added |
| `make container IMAGE=…`, `make zap TARGET=…` | image/Dockerfile scan, ZAP baseline against an own instance |
@ -787,7 +789,7 @@ Rules for agents working on this repo:
- Input only through zod schemas with `.strict()` (reject unknown fields); SQL only via
Drizzle or bound parameters; no secrets in code, repo, logs or chat.
- New packages only after `dependency-vetting` / `make vet-deps`.
- Before every push `make check`; red means no push. A diff touching auth, roles, routes
- Before every push `make prepush` (runs only the checks the diff needs; full `make check` before deploy and weekly via cron); red means no push. A diff touching auth, roles, routes
or personal data gets a `security-review` in a fresh context. Before a deploy run
`pre-release-gate`.
- Report checks that did not run as "not run", never as passed.