Harden secret-scan allowlists and MCP skill import typing

[Copilot]

Canonical issue

Outcome

CI stops flagging sanitized OpenAI/Stripe token-shaped fixtures in web API route tests, and the MCP skill-import validator is hardened for stricter TypeScript/ESLint analysis without changing its runtime contract.

Scope

• Included:
  • gitleaks allowlist coverage for apps/web/src/app/api/__tests__/.*
  • regression test pinning that allowlist in .gitleaks.toml
  • type-safety cleanup in apps/web/src/lib/chatgpt-mcp-skill-import.ts to remove unsafe object/non-null assumptions
  • preserved deterministic MCP receipt behavior and manifest validation
• Explicitly excluded:
  • workflow trigger changes
  • route behavior changes
  • dependency updates

Risk

• Risk level: low
• Failure mode:
  • secret scanning could become too broad if the allowlist expanded beyond the targeted route-test directory
  • MCP receipt validation could reject malformed inputs differently if a typing cleanup changed control flow
• Rollback:
  • revert the .gitleaks.toml path addition and the chatgpt-mcp-skill-import.ts typing cleanup

Verification

List exact automated and manual checks, tied to the current head SHA.

• Focused tests
• Required CI
• Review threads resolved

Production evidence

Not applicable: changes are limited to CI policy/config and a fixture-validation library path; no deployable runtime behavior or production state transition is involved.

Agent handoff

• One canonical issue is linked
• No competing PR implements the same issue
• Acceptance criteria are satisfied
• Required checks pass on the current head
• Human decision is requested only for product, security, irreversible infrastructure, or production approval

• Fixes Harden secret scanning and MCP auditor CI policy checks #1962

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: groupthinking/EventRelay/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: d1130646-2dde-4a63-96bd-536e3b0f4a11

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
v0-uvai	Ready	Preview, v0	Sep 18, 2026 9:53pm UTC

[github-actions]

🔍 PR Validation

⚠️ PR title should follow conventional commits format

[github-actions]

Dependency Review Summary

The full dependency review summary was too large to display here (13153KB, limit is 1024KB).

Please download the artifact named "dependency-review-summary" to view the complete report.

View full job summary

[Copilot]

Copilot review overview

🟡 Changes recommended

The new test breaks Python 3.10 collection, and the directory-wide secret-scan exclusion could conceal real credentials.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 2

Open (2)

• Avoid directory-wide gitleaks exclusions for route tests · New
• Use tomli fallback for Python 3.10 test collection · New

What changed in this PR

Hardens MCP import typing and adjusts secret-scan handling for sanitized fixtures.

Changes:

• Adds JSON-object validation and safer TypeScript narrowing.
• Adds and tests a web API test-directory gitleaks allowlist.

File	Description
.gitleaks.toml	Adds route-test secret-scan exclusion.
tests/​unit/​test_secret_scan_gitleaks_config.py	Pins allowlist configuration.
apps/​web/​src/​lib/​chatgpt-mcp-skill-import.ts	Strengthens MCP validation typing.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.