mirror of
https://github.com/BerriAI/litellm.git
synced 2026-09-22 00:31:44 +00:00
Improve .gitguardian.yaml: add test file patterns and simplify comments
- Add patterns to ignore all test files (Python and TypeScript) - Add patterns for common test fixtures and mock data - Ignore Jupyter notebooks and example config files - Simplify and clean up comments for better maintainability
This commit is contained in:
parent
b93bfde97a
commit
b92363b5b5
1 changed files with 42 additions and 32 deletions
|
|
@ -1,7 +1,6 @@
|
|||
version: 2
|
||||
|
||||
secret:
|
||||
# Exclude files and paths by globbing
|
||||
ignored_paths:
|
||||
- "**/*.whl"
|
||||
- "**/*.pyc"
|
||||
|
|
@ -29,83 +28,94 @@ secret:
|
|||
- "**/*.avif"
|
||||
- "**/*.webp"
|
||||
|
||||
# Test data files
|
||||
# Test files and fixtures
|
||||
- "**/tests/**/*.py"
|
||||
- "**/test_*.py"
|
||||
- "**/*_test.py"
|
||||
- "**/*.test.tsx"
|
||||
- "**/*.test.ts"
|
||||
- "**/*.spec.tsx"
|
||||
- "**/*.spec.ts"
|
||||
- "**/tests/**/data_map.txt"
|
||||
- "tests/**/*.txt"
|
||||
|
||||
# Documentation and other non-code files
|
||||
# Example and documentation files
|
||||
- "cookbook/**/*.ipynb"
|
||||
- "litellm/proxy/_super_secret_config.yaml"
|
||||
- "docs/**"
|
||||
- "**/*.md"
|
||||
- "**/*.lock"
|
||||
- "poetry.lock"
|
||||
- "package-lock.json"
|
||||
|
||||
# Ignore security incidents with the SHA256 of the occurrence (false positives)
|
||||
# Ignore false positives by SHA256 hash or pattern
|
||||
ignored_matches:
|
||||
# === Current detected false positives (SHA-based) ===
|
||||
|
||||
# gcs_pub_sub_body - folder name, not a password
|
||||
# Specific false positives (SHA256-based)
|
||||
- name: GCS pub/sub test folder name
|
||||
match: 75f377c456eede69e5f6e47399ccee6016a2a93cc5dd11db09cc5b1359ae569a
|
||||
|
||||
# os.environ/APORIA_API_KEY_1 - environment variable reference
|
||||
- name: Environment variable reference APORIA_API_KEY_1
|
||||
match: e2ddeb8b88eca97a402559a2be2117764e11c074d86159ef9ad2375dea188094
|
||||
|
||||
# os.environ/APORIA_API_KEY_2 - environment variable reference
|
||||
- name: Environment variable reference APORIA_API_KEY_2
|
||||
match: 09aa39a29e050b86603aa55138af1ff08fb86a4582aa965c1bd0672e1575e052
|
||||
|
||||
# oidc/circleci_v2/ - test authentication path, not a secret
|
||||
- name: OIDC CircleCI test path
|
||||
match: feb3475e1f89a65b7b7815ac4ec597e18a9ec1847742ad445c36ca617b536e15
|
||||
|
||||
# text-davinci-003 - OpenAI model identifier, not a secret
|
||||
- name: OpenAI model identifier text-davinci-003
|
||||
- name: OpenAI model identifier
|
||||
match: c489000cf6c7600cee0eefb80ad0965f82921cfb47ece880930eb7e7635cf1f1
|
||||
|
||||
# Base64 Basic Auth in test_pass_through_endpoints.py - test fixture, not a real secret
|
||||
- name: Test Base64 Basic Auth header in pass_through_endpoints test
|
||||
- name: Test Base64 Basic Auth header
|
||||
match: 61bac0491f395040617df7ef6d06029eac4d92a4457ac784978db80d97be1ae0
|
||||
|
||||
# PostgreSQL password "postgres" in CI configs - standard test database password
|
||||
- name: Test PostgreSQL password in CI configurations
|
||||
- name: Test PostgreSQL password
|
||||
match: 6e0d657eb1f0fbc40cf0b8f3c3873ef627cc9cb7c4108d1c07d979c04bc8a4bb
|
||||
|
||||
# Bearer token in locustfile.py - test/example API key for load testing
|
||||
- name: Test Bearer token in locustfile load test
|
||||
- name: Test Bearer token in load test
|
||||
match: 2a0abc2b0c3c1760a51ffcdf8d6b1d384cef69af740504b1cfa82dd70cdc7ff9
|
||||
|
||||
# Inkeep API key in docusaurus.config.js - public documentation site key
|
||||
- name: Inkeep API key in documentation config
|
||||
- name: Inkeep API key in documentation
|
||||
match: c366657791bfb5fc69045ec11d49452f09a0aebbc8648f94e2469b4025e29a75
|
||||
|
||||
# Langfuse credentials in test_completion.py - test credentials for integration test
|
||||
- name: Langfuse test credentials in test_completion
|
||||
- name: Langfuse test credentials
|
||||
match: c39310f68cc3d3e22f7b298bb6353c4f45759adcc37080d8b7f4e535d3cfd7f4
|
||||
|
||||
# Test password "sk-1234" in e2e test fixtures - test fixture, not a real secret
|
||||
- name: Test password in e2e test fixtures
|
||||
- name: Test password in e2e fixtures
|
||||
match: ce32b547202e209ec1dd50107b64be4cfcf2eb15c3b4f8e9dc611ef747af634f
|
||||
|
||||
# === Preventive patterns for test keys (pattern-based) ===
|
||||
|
||||
# Test API keys (124 instances across 45 files)
|
||||
# Test API key patterns
|
||||
- name: Test API keys with sk-test prefix
|
||||
match: sk-test-
|
||||
|
||||
# Mock API keys
|
||||
- name: Mock API keys with sk-mock prefix
|
||||
match: sk-mock-
|
||||
|
||||
# Fake API keys
|
||||
- name: Fake API keys with sk-fake prefix
|
||||
match: sk-fake-
|
||||
|
||||
# Generic test API key patterns
|
||||
- name: Test API key patterns
|
||||
- name: Generic test API key pattern
|
||||
match: test-api-key
|
||||
|
||||
- name: Short fake sk keys (1–9 digits only)
|
||||
- name: Short fake sk keys
|
||||
match: \bsk-\d{1,9}\b
|
||||
|
||||
# Common test fixtures
|
||||
- name: Test API key fixture 88dc28d0f03
|
||||
match: 88dc28d0f030c55ed4ab77ed8faf098196cb1c05df778539800c9f1243fe6b4b
|
||||
|
||||
- name: Test API key fixture 40b7608ea43
|
||||
match: 40b7608ea43423400d5b82bb5ee11042bfb2ed4655f05b5992b5abbc2f294931
|
||||
|
||||
- name: SHA256 empty string (test fixture)
|
||||
match: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
|
||||
|
||||
- name: Test JWT token pattern
|
||||
match: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9\.
|
||||
|
||||
- name: Mock data in code comments
|
||||
match: \/\*.*api_key.*\*\/
|
||||
|
||||
- name: Commented Langfuse credentials
|
||||
match: #\s+langfuse_(public_key|secret):
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue