chore(ci): gate hygiene — secrets baseline 0, semgrep drop, hadolint (WS6/D3 + WS1.7) (#7099)

* chore(ci): gate hygiene — secrets baseline 0, semgrep metric drop, hadolint gate (WS6/D3 + WS1.7)

- .gitleaks.toml: allowlist (with mandatory justification) for the 3 frozen
  generic-api-key false positives — latencyP50Ms/latencyP95Ms are metric FIELD
  NAMES and interleaved-thinking-2025-05-14 is Anthropic's PUBLIC beta header.
  quality-baseline secretFindings 3 -> 0: the ratchet is now zero-tolerance
  (verified: check:secrets --ratchet reports 0 findings, no regression).
- quality-baseline: semgrepFindings removed — orphaned metric never wired to a
  blocking gate (semgrep.yml only echoes the count); CodeQL covers OWASP.
- ci.yml lint job: hadolint on the Dockerfile (image pinned by digest,
  --failure-threshold error). Verified green against the current Dockerfile
  (5 pre-existing warnings visible, 0 errors).
Also evaluated publint for the fast path (WS1.6) and REJECTED it with data:
1554 findings, ~all noise from the vendored dist/node_modules of the standalone
package — wrong tool for this package shape; check:pack-boot is the real gate.

* chore(ci): surgical baseline edit — preserve unicode formatting (was json.dump ensure_ascii noise)

.github/workflows/ci.yml

@@ -125,6 +125,11 @@ jobs:
       - run: npm run check:route-guard-membership
       - run: npm run check:test-discovery
       - run: npm run check:tracked-artifacts
+      # WS1.7 (v3.8.49 plan): Dockerfile lint (hadolint, pinned by digest).
+      # failure-threshold=error keeps the 5 pre-existing warnings (DL3008/DL3003/
+      # DL3016 version pinning / WORKDIR) visible without blocking; any ERROR fails.
+      - name: hadolint (Dockerfile)
+        run: docker run --rm -i hadolint/hadolint@sha256:27086352fd5e1907ea2b934eb1023f217c5ae087992eb59fde121dce9c9ff21e hadolint --failure-threshold error - < Dockerfile
       - run: npm run check:lockfile
       - run: npm run check:licenses
       # check:docs-sync is run by the docs-sync-strict job (via check:docs-all) and the

.gitleaks.toml

@@ -74,3 +74,16 @@
 #       '''tests/unit/''',
 #     ]
 #
+
+[[rules]]
+  # Falsos-positivos comprovados do generic-api-key — zerados em 2026-07-13 (WS6/D3,
+  # plano v3.8.49). Revisar em v3.9.0. Nenhum é credencial: dois são NOMES DE CAMPO
+  # de métricas de latência; o terceiro é o valor PÚBLICO de um beta header da API
+  # da Anthropic (documentado publicamente, não é segredo).
+  id = "generic-api-key"
+  [rules.allowlist]
+    description = "Field names + public Anthropic beta-header value (não são segredos)"
+    regexes = [
+      '''latencyP\d{2}Ms''',
+      '''interleaved-thinking-2025-05-14''',
+    ]

changelog.d/maintenance/gate-hygiene-secrets-semgrep-hadolint.md

@@ -0,0 +1 @@
+- **Quality gates hygiene (WS6/D3 + WS1.7)**: gitleaks baseline zeroed — the 3 frozen `generic-api-key` false positives (latency field names + the public Anthropic beta-header value) are allowlisted with justification, so any NEW secret finding now regresses the ratchet from 0; the orphaned `semgrepFindings` baseline metric was dropped (never wired to a gate; CodeQL covers the OWASP families); Dockerfile now has a hadolint gate in the lint job (digest-pinned, error-threshold — the 5 pre-existing warnings stay visible without blocking)

config/quality/quality-baseline.json

@@ -158,7 +158,8 @@
       "dedicatedGate": true
     },
     "secretFindings": {
-      "value": 3,
+      "_note": "Zeroed 2026-07-13 (WS6/D3): the 3 frozen generic-api-key FPs are allowlisted with justification in .gitleaks.toml — any NEW finding regresses the ratchet.",
+      "value": 0,
       "direction": "down",
       "dedicatedGate": true
     },
@@ -187,12 +188,6 @@
       "dedicatedGate": true,
       "_note": "oasdiff breaking-change gate (Fase 9 Onda 0). Blocks any breaking change vs base spec."
     },
-    "semgrepFindings": {
-      "value": 0,
-      "direction": "down",
-      "dedicatedGate": true,
-      "_note": "semgrep owasp/secrets findings. ADVISORY until first CI value is frozen, then flip blocking (Fase 9)."
-    },
     "mutationScore.src/sse/services/auth.ts": {
       "value": 52.57,
       "direction": "up",