From c7327fd31347bd816620f568cd1f254b024a3553 Mon Sep 17 00:00:00 2001
From: Vernon Keenan <vkeenan@gmail.com>
Date: Sun, 12 Jul 2026 05:23:59 +0000
Subject: [PATCH] ci: add first-ever build/vet/test + gitleaks CI (ADR-KV-014)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

lib is publicly mirrored on code.tnxs.net and had no CI at all. Add
.github/workflows/push.yml gating every push/PR on the private
self-hosted runner (ADR-KV-004): a test job (go build/vet/test) and a
gitleaks secret-scan job using the official docker image directly
(gitleaks/gitleaks-action needs an org license we don't have).

The gitleaks history scan surfaced 6 findings, all illustrative
`example:` JWTs hardcoded by swagger-codegen into the generated Kazoo
API client models and the vendored Kazoo swagger spec — placeholders
from the vendor's public docs, not real credentials. Added a minimal
.gitleaks.toml allowlist scoped to just those four generated files so
CI runs clean without masking real findings elsewhere.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .github/workflows/push.yml | 51 ++++++++++++++++++++++++++++++++++++++
 .gitleaks.toml             | 20 +++++++++++++++
 2 files changed, 71 insertions(+)
 create mode 100644 .github/workflows/push.yml
 create mode 100644 .gitleaks.toml

diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml
new file mode 100644
index 0000000..9b9f022
--- /dev/null
+++ b/.github/workflows/push.yml
@@ -0,0 +1,51 @@
+name: CI (lib)
+
+# First-ever CI for go/lib (ADR-KV-014). lib is publicly mirrored on
+# code.tnxs.net, so every push and PR gets a build/vet/test job plus a
+# gitleaks secret-scan job. lib is a Go library — no Dockerfile, no deploy.
+on:
+  push:
+    branches: ['**']
+  pull_request:
+
+defaults:
+  run:
+    shell: bash
+
+# Serialize per ref. PR runs cancel superseded validations; branch pushes never cancel.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  test:
+    runs-on: [self-hosted, Linux]
+    permissions: { contents: read }
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
+        with:
+          go-version: stable
+
+      - name: go build ./...
+        run: go build ./...
+
+      - name: go vet ./...
+        run: go vet ./...
+
+      - name: go test ./...
+        run: go test ./...
+
+  gitleaks:
+    runs-on: [self-hosted, Linux]
+    permissions: { contents: read }
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 0
+
+      - name: gitleaks detect (git history)
+        run: |
+          docker run --rm -v "$PWD:/repo" -w /repo zricethezav/gitleaks:latest \
+            detect --source /repo --redact -v
diff --git a/.gitleaks.toml b/.gitleaks.toml
new file mode 100644
index 0000000..18c3893
--- /dev/null
+++ b/.gitleaks.toml
@@ -0,0 +1,20 @@
+title = "gitleaks config for code.tnxs.net/vernonkeenan/lib"
+
+[extend]
+useDefault = true
+
+# ADR-KV-014: first-ever CI gitleaks scan surfaced 6 findings, all in
+# swagger-codegen-generated Kazoo API client models and the vendored
+# Kazoo swagger spec. Each is an illustrative `// Example:` / `example:`
+# JWT hardcoded by the generator to document the shape of an auth_token
+# field — a placeholder from the vendor's public API docs, not a
+# credential issued to or used by this project. Scoped narrowly to the
+# four generated files that triggered, not repo-wide.
+[allowlist]
+description = "Generated Kazoo API client/swagger example JWTs (not real secrets)"
+paths = [
+  '''api/kazoo/kazoo_models/get_account_descendent_response\.go''',
+  '''api/kazoo/kazoo_models/get_account_callflow_response\.go''',
+  '''api/kazoo/kazoo_models/get_account_response\.go''',
+  '''swagger/kazoo-telnexus\.yaml''',
+]