From 00bdefcf0ed7b549b0789f755e1ee5bc4961eee0 Mon Sep 17 00:00:00 2001
From: Diego Rodrigues de Sa e Souza
 <8016841+diegosouzapw@users.noreply.github.com>
Date: Tue, 14 Jul 2026 09:16:19 -0300
Subject: [PATCH] =?UTF-8?q?chore(ci):=20gate=20hygiene=20=E2=80=94=20secre?=
 =?UTF-8?q?ts=20baseline=200,=20semgrep=20drop,=20hadolint=20(WS6/D3=20+?=
 =?UTF-8?q?=20WS1.7)=20(#7099)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* chore(ci): gate hygiene — secrets baseline 0, semgrep metric drop, hadolint gate (WS6/D3 + WS1.7)

- .gitleaks.toml: allowlist (with mandatory justification) for the 3 frozen
  generic-api-key false positives — latencyP50Ms/latencyP95Ms are metric FIELD
  NAMES and interleaved-thinking-2025-05-14 is Anthropic's PUBLIC beta header.
  quality-baseline secretFindings 3 -> 0: the ratchet is now zero-tolerance
  (verified: check:secrets --ratchet reports 0 findings, no regression).
- quality-baseline: semgrepFindings removed — orphaned metric never wired to a
  blocking gate (semgrep.yml only echoes the count); CodeQL covers OWASP.
- ci.yml lint job: hadolint on the Dockerfile (image pinned by digest,
  --failure-threshold error). Verified green against the current Dockerfile
  (5 pre-existing warnings visible, 0 errors).
Also evaluated publint for the fast path (WS1.6) and REJECTED it with data:
1554 findings, ~all noise from the vendored dist/node_modules of the standalone
package — wrong tool for this package shape; check:pack-boot is the real gate.

* chore(ci): surgical baseline edit — preserve unicode formatting (was json.dump ensure_ascii noise)
---
 .github/workflows/ci.yml                            |  5 +++++
 .gitleaks.toml                                      | 13 +++++++++++++
 .../gate-hygiene-secrets-semgrep-hadolint.md        |  1 +
 config/quality/quality-baseline.json                |  9 ++-------
 4 files changed, 21 insertions(+), 7 deletions(-)
 create mode 100644 changelog.d/maintenance/gate-hygiene-secrets-semgrep-hadolint.md

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b471b5c2e9..b17c08fd5a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -125,6 +125,11 @@ jobs:
       - run: npm run check:route-guard-membership
       - run: npm run check:test-discovery
       - run: npm run check:tracked-artifacts
+      # WS1.7 (v3.8.49 plan): Dockerfile lint (hadolint, pinned by digest).
+      # failure-threshold=error keeps the 5 pre-existing warnings (DL3008/DL3003/
+      # DL3016 version pinning / WORKDIR) visible without blocking; any ERROR fails.
+      - name: hadolint (Dockerfile)
+        run: docker run --rm -i hadolint/hadolint@sha256:27086352fd5e1907ea2b934eb1023f217c5ae087992eb59fde121dce9c9ff21e hadolint --failure-threshold error - < Dockerfile
       - run: npm run check:lockfile
       - run: npm run check:licenses
       # check:docs-sync is run by the docs-sync-strict job (via check:docs-all) and the
diff --git a/.gitleaks.toml b/.gitleaks.toml
index 0051e694b2..8b9978a454 100644
--- a/.gitleaks.toml
+++ b/.gitleaks.toml
@@ -74,3 +74,16 @@
 #       '''tests/unit/''',
 #     ]
 #
+
+[[rules]]
+  # Falsos-positivos comprovados do generic-api-key — zerados em 2026-07-13 (WS6/D3,
+  # plano v3.8.49). Revisar em v3.9.0. Nenhum é credencial: dois são NOMES DE CAMPO
+  # de métricas de latência; o terceiro é o valor PÚBLICO de um beta header da API
+  # da Anthropic (documentado publicamente, não é segredo).
+  id = "generic-api-key"
+  [rules.allowlist]
+    description = "Field names + public Anthropic beta-header value (não são segredos)"
+    regexes = [
+      '''latencyP\d{2}Ms''',
+      '''interleaved-thinking-2025-05-14''',
+    ]
diff --git a/changelog.d/maintenance/gate-hygiene-secrets-semgrep-hadolint.md b/changelog.d/maintenance/gate-hygiene-secrets-semgrep-hadolint.md
new file mode 100644
index 0000000000..7009f36ab2
--- /dev/null
+++ b/changelog.d/maintenance/gate-hygiene-secrets-semgrep-hadolint.md
@@ -0,0 +1 @@
+- **Quality gates hygiene (WS6/D3 + WS1.7)**: gitleaks baseline zeroed — the 3 frozen `generic-api-key` false positives (latency field names + the public Anthropic beta-header value) are allowlisted with justification, so any NEW secret finding now regresses the ratchet from 0; the orphaned `semgrepFindings` baseline metric was dropped (never wired to a gate; CodeQL covers the OWASP families); Dockerfile now has a hadolint gate in the lint job (digest-pinned, error-threshold — the 5 pre-existing warnings stay visible without blocking)
diff --git a/config/quality/quality-baseline.json b/config/quality/quality-baseline.json
index f660fc33d3..225dd45f18 100644
--- a/config/quality/quality-baseline.json
+++ b/config/quality/quality-baseline.json
@@ -158,7 +158,8 @@
       "dedicatedGate": true
     },
     "secretFindings": {
-      "value": 3,
+      "_note": "Zeroed 2026-07-13 (WS6/D3): the 3 frozen generic-api-key FPs are allowlisted with justification in .gitleaks.toml — any NEW finding regresses the ratchet.",
+      "value": 0,
       "direction": "down",
       "dedicatedGate": true
     },
@@ -187,12 +188,6 @@
       "dedicatedGate": true,
       "_note": "oasdiff breaking-change gate (Fase 9 Onda 0). Blocks any breaking change vs base spec."
     },
-    "semgrepFindings": {
-      "value": 0,
-      "direction": "down",
-      "dedicatedGate": true,
-      "_note": "semgrep owasp/secrets findings. ADVISORY until first CI value is frozen, then flip blocking (Fase 9)."
-    },
     "mutationScore.src/sse/services/auth.ts": {
       "value": 52.57,
       "direction": "up",