fix(launch): deliver the initial message via POST /sessions instead of a dropped second request #466
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Secret Scan | |
| # Secret scanning (issue #457), split from ci.yml so the weekly full-history | |
| # sweep does not drag the entire CI matrix (unit/web/e2e/lint/Trivy) onto a | |
| # schedule. Two triggers, two scopes: | |
| # - pull_request: scan only the PR's commit range (fast; a pre-existing secret | |
| # on an unrelated branch must not block every PR). | |
| # - schedule: weekly full-history sweep to surface a secret committed before | |
| # the per-PR gate existed. | |
| on: | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| # Mondays 07:00 UTC. | |
| - cron: "0 7 * * 1" | |
| permissions: | |
| contents: read | |
| env: | |
| GITLEAKS_VERSION: "8.30.1" | |
| # Pinned release asset + its published SHA-256 (verified before execution so a | |
| # tampered/mutated asset can't run in CI). Update both together on version bump. | |
| GITLEAKS_SHA256: "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb" | |
| jobs: | |
| gitleaks: | |
| name: gitleaks | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| # Need history for both scopes; on a PR this is the PR's commits, for | |
| # the scheduled run it's the whole default branch. | |
| fetch-depth: 0 | |
| - name: Install gitleaks (pinned + checksum-verified) | |
| run: | | |
| set -euo pipefail | |
| asset="gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" | |
| curl -sSL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/${asset}" -o "$asset" | |
| echo "${GITLEAKS_SHA256} ${asset}" | sha256sum -c - | |
| sudo tar -xzf "$asset" -C /usr/local/bin gitleaks | |
| gitleaks version | |
| - name: Scan PR commit range | |
| if: github.event_name == 'pull_request' | |
| env: | |
| BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| HEAD_SHA: ${{ github.event.pull_request.head.sha }} | |
| run: | | |
| set -euo pipefail | |
| # Fail closed: gitleaks exits 0 (secret undetected) if the log range | |
| # can't be resolved — e.g. the base SHA isn't in the checkout. Verify | |
| # both endpoints exist first so a broken range can't silently pass. | |
| for sha in "$BASE_SHA" "$HEAD_SHA"; do | |
| git cat-file -e "${sha}^{commit}" 2>/dev/null || { | |
| echo "::error::commit $sha not present in checkout; cannot scan the PR range safely" | |
| exit 1 | |
| } | |
| done | |
| gitleaks detect \ | |
| --source . \ | |
| --config .gitleaks.toml \ | |
| --redact \ | |
| --verbose \ | |
| --exit-code 1 \ | |
| --log-opts "${BASE_SHA}..${HEAD_SHA}" | |
| # A hit here should be triaged per the leak-response runbook | |
| # (docs/security.md): rotate/revoke first, rewrite | |
| # history only if the severity table calls for it. | |
| - name: Full-history scan (scheduled) | |
| if: github.event_name == 'schedule' | |
| run: | | |
| gitleaks detect \ | |
| --source . \ | |
| --config .gitleaks.toml \ | |
| --redact \ | |
| --verbose \ | |
| --exit-code 1 | |
| # Regression tests for the custom rules + allowlist in .gitleaks.toml. Runs | |
| # here (not in the pip-only unit-test job) because it needs the gitleaks | |
| # binary on PATH; without this job the tests would skip everywhere. | |
| config-tests: | |
| name: gitleaks config tests | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Install gitleaks (pinned + checksum-verified) | |
| run: | | |
| set -euo pipefail | |
| asset="gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" | |
| curl -sSL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/${asset}" -o "$asset" | |
| echo "${GITLEAKS_SHA256} ${asset}" | sha256sum -c - | |
| sudo tar -xzf "$asset" -C /usr/local/bin gitleaks | |
| gitleaks version | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@v4 | |
| - name: Set up Python | |
| run: uv python install 3.12 | |
| - name: Install dependencies | |
| run: uv sync --all-extras --dev | |
| - name: Run gitleaks config regression tests | |
| run: uv run pytest test/test_gitleaks_config.py -v |