From 56df462a8f0f9f0631f308fec587fd012e37aaae Mon Sep 17 00:00:00 2001 From: Pouzor Date: Sat, 8 Aug 2026 01:29:47 +0200 Subject: [PATCH] ci: stop the secret scan reporting pytest names as Lob keys MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The push that carried the whole branch through TruffleHog failed on a "verified" Lob credential: `test_updates_an_existing_device_in_place`, a test function in backend/tests/test_racks.py. Lob's detector matches any `test_`-prefixed identifier of that length and reports it verified, because Lob test-mode keys authenticate unconditionally — so verification proves nothing here. Lob is a direct-mail API this project does not use, and any pytest function named that long trips it again, so the detector is excluded rather than the test renamed. ha-relevant: no --- .github/workflows/security.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 7c056eb..99e3035 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -22,6 +22,12 @@ jobs: uses: trufflesecurity/trufflehog@main with: path: ./ + # Lob (a direct-mail API this project does not use) matches any + # `test_`-prefixed identifier of ~35 chars and reports it verified, + # because Lob test keys authenticate unconditionally. Every pytest + # function named at that length trips it — the first was + # `test_updates_an_existing_device_in_place`. + extra_args: --exclude-detectors=Lob dependency-audit: runs-on: ubuntu-latest