CodeMonkeyCybersecurity
diff --git a/‎.gitleaks.toml‎
Lines changed: 203 additions & 0 deletions b/‎.gitleaks.toml‎
Lines changed: 203 additions & 0 deletions
diff --git a/‎.golangci.yml‎
Lines changed: 188 additions & 0 deletions b/‎.golangci.yml‎
Lines changed: 188 additions & 0 deletions
@@ -0,0 +1,203 @@
+# .gitleaks.toml - Secret scanning configuration for Eos
+# Last Updated: 2025-11-07
+# Documentation: https://github.com/gitleaks/gitleaks
+#
+# This configuration detects secrets specific to Eos infrastructure:
+#   - Vault tokens, Consul tokens, Nomad tokens
+#   - Database passwords, API keys
+#   - TLS certificates and private keys
+#   - Generic secrets (passwords, tokens, keys)
+#
+# Used by:
+#   - Pre-commit hook (.git/hooks/pre-commit - gitleaks protect --staged)
+#   - CI/CD (future GitHub Actions workflow)
+#   - Manual scans (gitleaks detect)
+
+title = "Eos Secret Scanning Configuration"
+
+# Use gitleaks' default ruleset as baseline
+[extend]
+useDefault = true
+
+# ============================================================================
+# Eos-Specific Secret Patterns
+# ============================================================================
+
+[[rules]]
+id = "vault-token"
+description = "HashiCorp Vault Token (hvs.* or s.* format)"
+regex = '''(hvs\.[a-zA-Z0-9]{90,}|s\.[a-zA-Z0-9]{24})'''
+tags = ["vault", "token", "hashicorp"]
+[rules.allowlist]
+paths = [
+    '''.*_test\.go$''',          # Test files may have fake tokens
+    '''testdata/.*''',           # Test data
+    '''docs/.*\.md$''',          # Documentation examples
+]
+
+[[rules]]
+id = "consul-acl-token"
+description = "HashiCorp Consul ACL Token (UUID format)"
+regex = '''[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}'''
+tags = ["consul", "token", "hashicorp"]
+[rules.allowlist]
+paths = [
+    '''.*_test\.go$''',
+    '''testdata/.*''',
+    '''docs/.*\.md$''',
+]
+# Allow UUIDs in comments (often examples)
+regexes = [
+    '''// .*[0-9a-f]{8}-[0-9a-f]{4}''',  # UUID in comment
+]
+
+[[rules]]
+id = "nomad-token"
+description = "HashiCorp Nomad ACL Token"
+regex = '''(?i)(nomad[_-]?token|x-nomad-token)[\s:=]+["\']?([a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})["\']?'''
+tags = ["nomad", "token", "hashicorp"]
+
+[[rules]]
+id = "postgres-connection-string"
+description = "PostgreSQL Connection String with Password"
+regex = '''postgres(ql)?://[a-zA-Z0-9_-]+:[^@\s]+@[a-zA-Z0-9_.-]+(:[0-9]+)?/[a-zA-Z0-9_-]+'''
+tags = ["database", "postgresql", "connection-string"]
+[rules.allowlist]
+paths = [
+    '''.*_test\.go$''',
+    '''testdata/.*''',
+]
+# Allow placeholder passwords
+regexes = [
+    '''postgres.*:password@''',
+    '''postgres.*:REPLACE_ME@''',
+    '''postgres.*:\$\{.*\}@''',  # Environment variables
+]
+
+[[rules]]
+id = "api-key-pattern"
+description = "Generic API Key Pattern"
+regex = '''(?i)(api[_-]?key|apikey|access[_-]?key)[\s:=]+["\']([a-zA-Z0-9_\-]{20,})["\']'''
+tags = ["api-key", "secret"]
+[rules.allowlist]
+paths = [
+    '''.*_test\.go$''',
+    '''testdata/.*''',
+    '''docs/.*''',
+]
+
+[[rules]]
+id = "private-key"
+description = "Private Key (RSA, EC, etc.)"
+regex = '''-----BEGIN (RSA |EC |OPENSSH )?PRIVATE KEY-----'''
+tags = ["private-key", "tls", "certificate"]
+[rules.allowlist]
+paths = [
+    '''.*_test\.go$''',
+    '''testdata/.*''',
+]
+
+[[rules]]
+id = "jwt-token"
+description = "JSON Web Token (JWT)"
+regex = '''eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}'''
+tags = ["jwt", "token"]
+[rules.allowlist]
+paths = [
+    '''.*_test\.go$''',
+    '''testdata/.*''',
+]
+
+[[rules]]
+id = "litellm-master-key"
+description = "LiteLLM Master Key (for BionicGPT/Moni)"
+regex = '''(?i)(litellm[_-]?master[_-]?key|master[_-]?key)[\s:=]+["\']?(sk-[a-zA-Z0-9_-]{20,})["\']?'''
+tags = ["litellm", "api-key", "bionicgpt"]
+
+[[rules]]
+id = "openai-api-key"
+description = "OpenAI API Key"
+regex = '''sk-[a-zA-Z0-9]{32,}'''
+tags = ["openai", "api-key"]
+[rules.allowlist]
+paths = [
+    '''.*_test\.go$''',
+    '''testdata/.*''',
+]
+
+[[rules]]
+id = "generic-password"
+description = "Generic Password Assignment"
+regex = '''(?i)(password|passwd|pwd)[\s:=]+["\']([^"\']{8,})["\']'''
+tags = ["password", "secret"]
+[rules.allowlist]
+paths = [
+    '''.*_test\.go$''',
+    '''testdata/.*''',
+    '''docs/.*''',
+]
+# Allow obvious placeholders
+regexes = [
+    '''(?i)password.*["\'](password|changeme|example|test|demo|placeholder|REPLACE_ME)["\'  ]''',
+]
+
+# ============================================================================
+# Global Allowlist (applies to ALL rules)
+# ============================================================================
+
+[allowlist]
+description = "Global allowlist for files that can contain secrets"
+
+# File paths to ignore completely
+paths = [
+    '''vendor/.*''',             # Third-party dependencies
+    '''\.git/.*''',              # Git internals
+    '''\.github/.*''',           # GitHub workflows (may contain examples)
+    '''testdata/.*''',           # Test fixtures
+    '''.*_test\.go$''',          # Test files
+    '''docs/.*\.md$''',          # Documentation
+    '''.*\.pb\.go$''',           # Protobuf generated files
+    '''.*_gen\.go$''',           # Generated files
+    '''^\.golangci\.yml$''',     # Linter config
+    '''^go\.sum$''',             # Go dependencies checksum
+]
+
+# Regex patterns to ignore (applies to file content)
+regexes = [
+    # Ignore environment variable placeholders
+    '''\$\{[A-Z_]+\}''',
+    '''\$[A-Z_]+''',
+
+    # Ignore common placeholders
+    '''(?i)(example|test|demo|placeholder|changeme|replace_me|your_.*_here)''',
+
+    # Ignore URLs with placeholders
+    '''https?://localhost''',
+    '''https?://127\.0\.0\.1''',
+    '''https?://example\.(com|org|net)''',
+
+    # Ignore comments with "fake" or "example"
+    '''//.*(?i)(fake|example|test|mock)''',
+]
+
+# Files to ignore by content (hash-based)
+# Note: This is for intentionally committed secrets in test fixtures
+stopwords = [
+    "test",
+    "example",
+    "fake",
+    "mock",
+    "placeholder",
+]
+
+# ============================================================================
+# Additional Configuration
+# ============================================================================
+
+# Maximum file size to scan (bytes) - skip very large files
+[max-file-size]
+value = 10485760  # 10 MB
+
+# Performance tuning
+[parallelism]
+value = 4  # Number of parallel workers
@@ -0,0 +1,188 @@
+# .golangci.yml - golangci-lint v2 configuration
+# Last Updated: 2025-11-07
+# Documentation: https://golangci-lint.run/docs/configuration/
+#
+# This configuration enforces Eos code quality standards as defined in CLAUDE.md.
+# Used by:
+#   - Local development (golangci-lint run)
+#   - Pre-commit hooks (.git/hooks/pre-commit)
+#   - CI/CD (.github/workflows/comprehensive-quality.yml, lint.yml)
+
+version: "2"
+
+# Linter Selection
+linters:
+  # Use recommended linters as baseline, then enable additional ones
+  default: recommended
+
+  enable:
+    # Code Quality
+    - errcheck        # Check for unchecked errors (P0 - critical)
+    - gosimple        # Suggest code simplifications
+    - govet           # Standard go vet checks
+    - ineffassign     # Detect ineffectual assignments
+    - staticcheck     # Advanced static analysis (comprehensive)
+    - unused          # Find unused constants, variables, functions
+
+    # Security (P0 - critical for Eos)
+    - gosec           # Security issues (G101-G602)
+
+    # Style & Best Practices
+    - gofmt           # Ensure code is formatted
+    - goimports       # Check import formatting
+    - misspell        # Find commonly misspelled English words
+    - unconvert       # Remove unnecessary type conversions
+    - unparam         # Find unused function parameters
+    - goconst         # Find repeated strings that could be constants
+    - prealloc        # Find slice declarations that could be preallocated
+
+    # Bug Prevention
+    - exportloopref   # Prevent loop variable capture bugs
+    - nolintlint      # Ensure //nolint directives are used correctly
+    - bodyclose       # Ensure HTTP response bodies are closed
+    - contextcheck    # Ensure context.Context is used correctly
+
+    # Performance
+    - nakedret        # Find naked returns in functions > 5 lines
+    - nilerr          # Find code that returns nil even if it checks != nil
+
+# Linter-Specific Settings
+linters-settings:
+  # Security scanner configuration
+  gosec:
+    severity: medium
+    confidence: medium
+    excludes:
+      # G104: Audit errors not checked - covered by errcheck linter
+      - G104
+      # G304: File path from variable - common in CLI tools, manually audited
+      - G304
+      # G306: Expect WriteFile permissions to be 0600 or less - we use constants
+      - G306
+
+  # Error checking configuration
+  errcheck:
+    check-blank: true              # Report assignments to blank identifier
+    check-type-assertions: true    # Report type assertions without error check
+    exclude-functions:
+      - (*github.com/spf13/cobra.Command).MarkFlagRequired  # Cobra flags
+
+  # Go vet configuration
+  govet:
+    enable-all: true
+    disable:
+      - shadow      # Too noisy for large projects
+      - fieldalignment  # Struct field ordering for memory - not critical
+
+  # Staticcheck configuration
+  staticcheck:
+    checks: ["all", "-SA1019"]  # All checks except deprecated usage (we handle separately)
+
+  # Style configuration
+  gofmt:
+    simplify: true  # Use gofmt -s
+
+  goimports:
+    local-prefixes: github.com/CodeMonkeyCybersecurity/eos
+
+  # Complexity limits
+  nakedret:
+    max-func-lines: 5  # Only allow naked returns in very short functions
+
+  # Constant detection
+  goconst:
+    min-len: 3                # Minimum length of string constant
+    min-occurrences: 3        # Minimum occurrences to trigger
+    ignore-tests: true        # Don't check test files
+
+  # Unused parameters
+  unparam:
+    check-exported: false  # Don't check exported functions (may be interface implementations)
+
+# Run Configuration
+run:
+  timeout: 10m              # Maximum time for linters to run
+  tests: true              # Include test files
+  build-tags:
+    - integration
+    - unit
+  skip-dirs:
+    - vendor
+    - testdata
+    - .github
+    - docs
+  skip-files:
+    - ".*\\.pb\\.go$"      # Skip protobuf generated files
+    - ".*_gen\\.go$"       # Skip generated files
+
+# Issues Configuration
+issues:
+  # Maximum issues to report (0 = unlimited)
+  max-issues-per-linter: 0
+  max-same-issues: 0
+
+  # Show all issues, even in new code
+  new: false
+
+  # Exclude rules for specific cases
+  exclude-rules:
+    # Test files - allow certain patterns
+    - path: _test\.go
+      linters:
+        - errcheck        # Tests can ignore errors for brevity
+        - gosec           # Tests can have security "issues" (like hardcoded creds for mocks)
+        - unparam         # Test helpers may have unused params
+        - goconst         # Tests can repeat strings
+
+    # cmd/ orchestration layer - allow embedding
+    - path: ^cmd/
+      linters:
+        - goconst         # Orchestration layer can embed strings
+        - unparam         # CLI commands may not use all cobra.Command fields
+
+    # Mock/stub files
+    - path: "(mock|stub|fake).*\\.go"
+      linters:
+        - errcheck
+        - gosec
+
+    # Exclude specific error messages globally
+    - text: "Error return value of .((os\\.)?std(out|err)\\..*|.*Close|.*Flush|os\\.Remove(All)?|.*print(f|ln)?|os\\.(Un)?Setenv). is not checked"
+      linters:
+        - errcheck
+
+    # Exclude TODOs/FIXMEs from being errors (warnings only)
+    - text: "Line contains TODO/BUG/FIXME"
+      linters:
+        - godox
+
+  # Don't exclude issues in vendor or generated code
+  exclude-use-default: false
+
+# Output Configuration
+output:
+  formats:
+    - format: colored-line-number  # Human-readable colored output
+  print-issued-lines: true         # Show the lines with issues
+  print-linter-name: true          # Show which linter found the issue
+  uniq-by-line: true              # Show multiple issues on same line
+  sort-results: true               # Sort results for consistent output
+  path-prefix: ""                  # Don't modify paths in output
+
+# Severity Configuration
+severity:
+  default-severity: error
+  case-sensitive: false
+  rules:
+    - linters:
+        - gosec
+      severity: error
+    - linters:
+        - errcheck
+        - staticcheck
+        - govet
+      severity: error
+    - linters:
+        - misspell
+        - goconst
+      severity: warning