This is an automated email from the ASF dual-hosted git repository.
morrySnow pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/doris.git
The following commit(s) were added to refs/heads/master by this push:
new fedf8740ca3 [fix](build) Allow Doris hidden columns in Gitleaks
(#67477)
fedf8740ca3 is described below
commit fedf8740ca35c8943a6db7db09353f543b0cb080
Author: Dongyang Li <[email protected]>
AuthorDate: Thu Sep 3 16:24:14 2026 +0800
[fix](build) Allow Doris hidden columns in Gitleaks (#67477)
## Problem
Doris internal hidden column identifiers such as
`__DORIS_IVM_UNION_KEY_0_0_COL__` can match the `generic-api-key`
heuristic even though they are deterministic schema names, not
credentials.
## Solution
Add a rule-scoped allowlist for the exact hidden-column pattern
`__DORIS_[A-Z0-9_]+_COL__`.
## Validation
- `git diff --check`
- Gitleaks 8.30.0 config parse and hidden-column sample scan: 0 findings
- PR #62606 reproduction: `generic-api-key` false positive in the
IvmNormalizeMTMVTest hidden-column assertion
---
.gitleaks.toml | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/.gitleaks.toml b/.gitleaks.toml
index ffb973c0931..760bb211194 100644
--- a/.gitleaks.toml
+++ b/.gitleaks.toml
@@ -24,6 +24,12 @@ condition = "AND"
regexTarget = "match"
regexes = ['''token:\s*iceberg/paimon''']
+[[rules.allowlists]]
+description = "Ignore Doris internal hidden-column names; these deterministic
identifiers are not credentials"
+condition = "AND"
+regexTarget = "match"
+regexes = ['''__DORIS_[A-Z0-9_]+_COL__''']
+
[[rules.allowlists]]
description = "Ignore the fake OIDC token fixture in AuthenticatorManagerTest"
condition = "AND"
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
