Merge pull request #153 from WeOwnNetwork/fix/nik-cichecks-false-positives

fix(ci): boolean false-positive in SOC2 secret grep + Trivy DO-firewall suppressions

Author: ncimino

.github/workflows/validation.yml

@@ -122,7 +122,7 @@ jobs:
           #   b64enc / {{              – Helm template expressions in secrets.yaml
           #   \$                       – shell env-var references (e.g. $MARIADB_PASSWORD)
           #   ""                       – empty-string sentinels (auto-generated at deploy time)
-          if grep -RInE '^[[:space:]]*[^#]*password[^:]*[:=][[:space:]]*[^[:space:]#]+' --include="*.yaml" --include="*.yml" . | grep -Eiv 'valueFrom|secretKeyRef|envFrom:|example|sample|placeholder|b64enc|\$|\{\{|""'; then
+          if grep -RInE '^[[:space:]]*[^#]*password[^:]*[:=][[:space:]]*[^[:space:]#]+' --include="*.yaml" --include="*.yml" . | grep -Eiv 'valueFrom|secretKeyRef|envFrom:|example|sample|placeholder|b64enc|\$|\{\{|""|:[[:space:]]*(false|true)[[:space:]]*$'; then
             echo "::error::Hardcoded secrets detected - SOC2 violation"
             exit 1
           fi

.trivyignore

@@ -113,3 +113,13 @@ AVD-KSV-0125
 # earlier version of the chart mounted host `/`, which has been removed.
 KSV-0023
 AVD-KSV-0023
+
+# AVD-DIG-0001 / AVD-DIG-0003 — DO firewall world-open ingress/egress
+# Fleet-standing pattern for public droplet sites (billing, sso, gitea):
+# 80/443 ingress must be world-open (public HTTPS service, Caddy/LE);
+# egress is open by design (apt, Infisical, Stripe, DO Spaces).
+# SSH (22) starts world-open FIRST-BOOT ONLY and is narrowed via the
+# ssh_source_cidrs variable after the deploy window — tracked per-site
+# (Keycloak-Gitea board row 16 pattern).
+AVD-DIG-0001
+AVD-DIG-0003