From c92d47df970a317278e4c2d5fadadb4d1c1e7372 Mon Sep 17 00:00:00 2001 From: Zhengchao An Date: Thu, 9 Jul 2026 05:23:22 +0800 Subject: [PATCH] chore(security): exclude test/dev paths from secret scanning (#4584) --- .github/secret_scanning.yml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 .github/secret_scanning.yml diff --git a/.github/secret_scanning.yml b/.github/secret_scanning.yml new file mode 100644 index 000000000..f08638b44 --- /dev/null +++ b/.github/secret_scanning.yml @@ -0,0 +1,14 @@ +# GitHub secret scanning path exclusions. +# Secrets detected under these paths are auto-closed as "ignored by +# configuration" and are not blocked by push protection. +# +# Deliberately NOT excluded: production source files (e.g. rustfs/src/**, +# crates/*/src/**) even when a hit sits inside a #[cfg(test)] module or a +# doc-comment example — excluding the file would also stop scanning the +# production code in it. Close those alerts manually as "used in tests". +paths-ignore: + - "crates/e2e_test/**" # dedicated e2e test crate, test credentials throughout + - "**/tests/**" # Rust integration-test dirs (crates/*/tests, rustfs/tests) + - "**/benches/**" # benchmark harnesses + - ".docker/**" # local docker-compose dev configs (e.g. mqtt vm.args cookie) + - ".vscode/**" # local editor launch configs